Your Cyber Policy Looks Reassuring Until You Claim: A Five-Question MOT for UK Micro-Firms Before Renewal

Picture a joinery in Leeds with five employees. The bookkeeper gets an email that looks exactly like the usual one from a timber supplier, except the bank details have changed 'following an account review'. She pays £14,000. Two weeks later the real supplier rings about the unpaid invoice.

The firm's cyber insurance, bought two renewals ago and never read closely, declines the claim. Not because the insurer is wicked, but because invoice fraud and social engineering were excluded, or buried under a sub-limit so small it barely covered the phone calls. The premium was real. The protection was mostly theatre.

This is the single most common misunderstanding in the UK micro-business market, and it is worth an hour of your time before the renewal date lands.

The gap starts with the sales conversation

Cyber policies are usually sold on the fear of ransomware, because ransomware makes a good story. But the loss most likely to hit a firm with fewer than ten staff is not a locked server. It is a persuasive email that gets someone to pay the wrong person, or a phishing page that harvests the credentials to the accounts system.

That matters because of how policies are built. Cyber liability cover, crime cover, fidelity guarantee and funds transfer fraud are different products with different triggers, and the words matter enormously. A clause covering attack on a 'computer system' may not respond to a human being tricked into pressing send. Some policies bundle a social engineering extension; many sub-limit it so heavily that it is little more than a gesture.

Gap one: the human being in the middle

Authorised push payment fraud, invoice redirection and CEO impersonation all involve someone at your firm voluntarily making a payment. In insurance language, 'voluntary' is a dangerous word. Check whether social engineering fraud is expressly included, how much the sub-limit is, and what evidence the insurer will want. If the answer involves the phrase 'we'll look at it on a case-by-case basis', treat that as a no.

Gap two: ransomware 'downtime' is not the same as your downtime

Business interruption cover often includes a waiting period — 12, 24 or 48 hours — before anything counts. It typically covers loss of gross profit, not the extra costs you actually incur: overtime, temporary kit, subcontracted work to keep a deadline, or the two weeks you spend rebuilding trust with clients.

Ask how 'loss' is calculated, whether forensic investigation and data restoration have their own sub-limits, and whether the policy pays for the notification costs if customer data is involved. UK GDPR duties under the ICO do not pause while you argue about the definition of a claim.

Gap three: the supplier who gets breached, not you

Your payroll bureau, your CRM, your hosted accounting package, your website host — if any of them is breached and your data leaks, your policy may not respond, because the compromised system was not yours. Look for dependent business interruption or outsourcing extensions, and find out whether third-party breaches are covered at all, and for how much.

Gap four: the conditions that quietly kill claims

Most cyber policies are claims-made, meaning the policy in force when you notify is the one that applies, subject to retroactive dates. Add in a duty to notify 'as soon as reasonably practicable' and a requirement to disclose any known circumstances at renewal, and a late notification or a half-remembered incident from March can wipe out a perfectly valid claim.

Then there are the condition precedents: multi-factor authentication on email and remote access, maintained backups, patching on a schedule, staff training. Fail to evidence one of these and the insurer may reduce or refuse payment. Underwriters have also tightened state-backed attack exclusions, which can affect attribution in ransomware cases. None of this is unreasonable — it just has to be read before you need it.

What Cyber Essentials Plus does — and doesn't

Cyber Essentials Plus is the NCSC-backed certification built on five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. The Plus version adds an assessed verification, including an internal network scan and tests of your setup, carried out by a qualified assessor.

What it does: it forces a baseline of hygiene, closes the obvious doors and signals seriousness to underwriters. Many insurers discount premiums for certified firms, and some will not offer certain limits without it.

What it does not do: it will not stop a convincing invoice fraud email, because it does not test people or processes. It is not a guarantee of cover, not a legal defence, not a substitute for multi-factor authentication on cloud services, and not a magic wand that makes an underwriter ignore a poor claims history. Treat certification as the floor, not the ceiling.

Five questions to ask before you renew

1. Show me the actual wording on social engineering and funds transfer fraud. What is the sub-limit, what triggers it, and what evidence would you need from us?
2. What is my ransomware business interruption waiting period, and exactly how is my loss calculated? Which costs are excluded?
3. Which conditions could void or reduce a claim — MFA, backups, patching, training — and how do you want me to prove we met them?
4. If one of our suppliers or our cloud provider is breached, does this policy respond? For how much?
5. What must I do in the first 24 hours of an incident, and who do I call at 2am? Is there an incident response retainer included?

The file that makes a claim survivable

Underwriters and loss adjusters do not want heroics; they want paperwork. Keep a living cyber file with your asset register, evidence of MFA across email and remote access, dated backup restoration tests, staff training records and your incident contacts. It takes an afternoon to assemble and it is the difference between a claim and a conversation about why the claim is invalid.

Finally, do the arithmetic honestly. A £600 annual premium against a realistic £14,000 invoice fraud loss is not a hard sum. But a policy that excludes the very event that hits you is not cheap at any price. Read the wording, ask the five questions, and buy the cover that matches the scam your firm would actually fall for.