Cyber Insurance for UK SMEs: What You Need to Know in 2026

Cyber insurance has shifted from a nice-to-have to a near-necessity for UK SMEs. With the average cost of a cyber breach now exceeding £25,000 for small businesses — and ransomware incidents increasingly targeting SMEs rather than large enterprises — the financial risk of being uninsured is significant.

But the cyber insurance market has hardened considerably. Premiums have risen, policy exclusions have expanded, and insurers are requiring much more robust security controls before offering cover. In 2026, you can't simply buy a policy and assume you're protected.

This guide explains what UK SMEs need to know about cyber insurance — what it covers, what it doesn't, and what you need to have in place to qualify.

---

What Does Cyber Insurance Cover?

Cyber insurance policies vary significantly between providers, but most cover some or all of the following:

First-Party Coverage (Your Own Losses)

• Business interruption: Lost revenue and extra expenses during a cyber incident
• Data recovery costs: Restoring lost or corrupted data
• Ransomware payments: Some policies cover ransom payments (though this is increasingly controversial and restricted)
• Crisis management: PR costs to manage reputational damage
• Forensic investigation: IT forensics to identify the cause and scope of a breach
• Notification costs: The cost of notifying affected individuals (required under UK GDPR within 72 hours for reportable breaches)

Third-Party Coverage (Claims Against You)

• Data breach liability: Claims from customers or employees whose data was compromised
• Regulatory defence costs: Legal costs if the ICO investigates or prosecutes
• Regulatory fines: Some policies cover ICO fines (subject to insurer discretion and policy terms)
• Network security liability: Claims from third parties affected by an attack that spread through your network
• Media liability: Claims relating to online content

---

What Cyber Insurance Does NOT Cover

This is where SMEs frequently get caught out. Cyber insurance has significant exclusions:

Common Exclusions

• Unpatched systems: If a breach occurs because you failed to apply a security patch that was available, your claim may be rejected
• Insider threats: Employee theft or deliberate data exfiltration is often excluded or covered under a separate crime policy
• Previously known vulnerabilities: Incidents arising from known weaknesses you hadn't remediated
• Social engineering/fraud: Many policies have sublimits or exclusions for fraudulent transfer of funds (CEO fraud, invoice fraud)
• War and state-sponsored attacks: The "cyber war" exclusion — incidents attributed to nation-state actors may be excluded (this has been a major area of legal dispute)
• Regulatory fines in certain jurisdictions: ICO fines are often excluded or subject to a sublimit
• Reputational damage beyond direct costs: Speculative future revenue loss from reputational harm is generally not covered

---

The Controls Insurers Now Require

In 2026, cyber insurers conduct detailed security questionnaires before offering cover — and increasingly, they verify answers through technical scans. The following controls are now near-universally required:

Essential Requirements (Non-Negotiable)

• Multi-Factor Authentication (MFA): Required on all remote access, email, and administrative accounts. No MFA = no cover from most insurers
• Endpoint Detection and Response (EDR): Basic antivirus is no longer sufficient. Insurers want EDR tools (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
• Backups: Offline or immutable backups, tested regularly. Backups must be isolated from the main network (so ransomware can't encrypt them)
• Patch management: Evidence of a regular patching programme — critical patches applied within defined timeframes
• Email security: DMARC, DKIM, and SPF records configured; anti-phishing filtering in place

Increasingly Required (Will Be Essential by 2027)

• Privileged Access Management (PAM): Controls over administrator accounts
• Vulnerability scanning: Regular internal and external vulnerability assessments
• Security awareness training: Evidence that staff receive regular phishing simulation and security training
• Incident response plan: A documented plan for responding to a cyber incident
• Cyber Essentials certification: Some insurers offer discounts; others are beginning to require it

---

How Much Does Cyber Insurance Cost for UK SMEs?

Premiums depend on your industry, revenue, data volumes, and security posture. Approximate 2026 ranges for UK SMEs:

| Annual Revenue | Approximate Annual Premium | |---|---| | Under £1M | £800 – £2,500 | | £1M – £5M | £2,500 – £8,000 | | £5M – £25M | £8,000 – £30,000 | | £25M – £50M | £25,000 – £75,000 |

Businesses in high-risk sectors (healthcare, financial services, legal, professional services) typically pay 20–40% more than the above ranges.

Businesses with Cyber Essentials Plus certification typically qualify for discounts of 10–20% with many insurers.

---

The Most Common Reason Claims Are Rejected

Insurers are increasingly scrutinising claims and rejecting them where:

1. MFA wasn't in place on the account or system that was compromised — even if you stated it was during the application
2. Backups were also encrypted by ransomware, meaning the attacker got to your backup system too
3. Patches were outstanding: The CVE (vulnerability) exploited had a patch available that you hadn't applied
4. The incident pre-dated the policy: Attackers often sit in networks for months before triggering an incident — if they gained access before your policy started, cover may be disputed
5. Misrepresentation on the application: If you stated controls were in place that weren't, the insurer can void the policy entirely

---

Cyber Essentials and Cyber Insurance

Cyber Essentials is the UK government-backed certification that validates your organisation's basic cyber hygiene. Getting certified:

• Demonstrates to insurers that you've met a verified baseline of controls
• Can reduce premiums with many providers
• Is increasingly a prerequisite for UK government contracts and supply chain requirements
• Provides a documented, independently verified record of your security posture at a point in time

Cyber Essentials Plus goes further — it includes a technical audit by an accredited certification body, providing stronger evidence for insurers.

Coreitech provides Cyber Essentials and Cyber Essentials Plus certification support for UK SMEs. Find out more.

---

Practical Steps Before Buying Cyber Insurance

1. Get MFA deployed everywhere: Email, VPN, remote desktop, cloud apps — MFA is the single most impactful control
2. Upgrade to EDR: Replace basic antivirus with an EDR solution that can detect and respond to advanced threats
3. Audit and test your backups: When did you last restore from backup? If you don't know, test it now
4. Sort your email authentication: DMARC, DKIM, and SPF should be configured on all your domains
5. Run a Cyber Essentials gap assessment: Identify where you fall short before the insurer does
6. Document your controls: Insurers are asking for evidence, not just assertions

---

Summary

Cyber insurance is an important part of your risk management strategy — but it's not a substitute for good security hygiene. In 2026, insurers are more rigorous than ever about what they require before offering cover, and what they'll pay out when a claim is made.

The best approach: invest in the foundational security controls first (MFA, EDR, backups, patching, Cyber Essentials), then approach insurers with documented evidence of your posture. You'll get better terms, better cover, and far less risk of a claim being disputed.

Coreitech can help UK SMEs prepare for cyber insurance — assessing your current controls, remediating gaps, and supporting Cyber Essentials certification. Contact our team for a free initial conversation.