Cyber Liability Insurance

A standard cyber liability policy responds to several distinct cost lines after an incident: first-party costs (the costs you absorb directly — forensic investigation, system rebuilds, business interruption losses, public relations and customer notification), and third-party costs (claims brought against you by customers, vendors or regulators whose data was affected). Optional or higher-tier add-ons typically cover ransomware extortion, social engineering and funds transfer fraud, regulatory fines and penalties where insurable, and reputational harm. Policies vary widely on what is included by default versus what is added; reading the actual wording matters more than the marketing description. We can help you understand what your specific policy responds to and where the gaps are.

Almost never. General liability covers bodily injury and property damage; commercial property covers physical damage to assets; technology errors-and-omissions covers professional negligence claims if you sell technology services. None of these respond to ransomware, data breach notification, business interruption from a cyber event, regulatory penalties, or incident response costs. Some general policies have a small cyber endorsement (typically NZ$10,000 to NZ$50,000) — useful for a very small incident, immediately exhausted by a real one. A dedicated cyber liability policy is a separate purchase, with its own underwriting, its own coverage levels, and its own claim process. Pacific brokers can write standalone cyber cover today; the market has matured considerably in the last three years.

The bar has risen sharply. Most underwriters today expect: multi-factor authentication enforced across all users for email, VPN and privileged accounts; endpoint detection and response on every endpoint; immutable or air-gapped backups with regular restore testing; a documented incident response plan that has been tabletop-tested in the last 12 months; security awareness training across all staff; timely patching and vulnerability management; and email security controls (SPF, DKIM, DMARC at enforcement). Without these, underwriters either decline the risk outright or quote at premiums that are not commercially viable. The same controls also reduce the probability of an incident significantly, which is why insurers ask for them.

Not reliably, and there are legal and ethical reasons to avoid it where possible. Industry statistics consistently show that even when ransom is paid, around a third of victims do not recover all their data, and the decryption process is slow and incomplete in most cases. Paying ransom also funds the next attack, marks the organisation as willing-to-pay, and may breach sanctions law in some jurisdictions (paying a ransom to certain criminal groups can expose the business to regulatory penalties separately from the incident itself). The current consensus from insurers and incident-response specialists is that ransom payment is a last-resort option after backup restoration, decryption tools and rebuild-from-scratch have all been exhausted. A good incident response plan and tested backups are a materially better answer than any ransom payment strategy.

Most cyber insurance policies include access to a panel of pre-approved incident response specialists — forensic firms, legal counsel, public relations, ransom negotiators where applicable. We work alongside that panel, not in competition with it. The panel typically runs forensics, legal containment, regulator engagement and (if needed) negotiation; we run the technical work the panel cannot — system rebuilds, identity recovery, restore-from-backup operations, infrastructure remediation. The carrier pays the panel costs and (subject to policy) the remediation costs we incur. Coordination is essential: one team, one timeline, one set of decisions. We will work with whichever carrier and panel your policy specifies — there is no preferred-vendor lock-in.

Premium ranges vary substantially by organisation size, sector, claim history and the security baseline in place. For a Pacific business with under 50 staff, an entry-level cyber policy with around NZ$1 million in cover typically starts in the low-to-mid four-figure annual premium range — when the security baseline meets underwriter expectations. Without that baseline (no MFA, no EDR, no incident response plan), premiums are either materially higher or coverage is unavailable. Larger organisations with higher cover limits run into five-figure premiums. Compared to the cost of a single uninsured incident (often hundreds of thousands of dollars in our experience), the premium is one of the highest-ROI line items in a business budget. We are not the broker — we connect customers with Pacific cyber insurance specialists who can quote against the current security posture.

Small businesses are not too small to be targeted — they are targeted disproportionately because they typically lack the security baseline that makes the attack expensive for the attacker. A ransomware incident at a 15-person firm runs the same cost profile as one at a 150-person firm: forensic costs, downtime, system rebuilds, customer notification, regulatory engagement. The difference is that the smaller business has materially less working capital to absorb the loss. For any business holding customer data, processing payments, or running operations that would suffer from being offline for more than a day, cyber liability insurance is no longer optional — it has moved into the same category as general liability or property insurance for the modern business.