Cyber insurance is not a substitute for cybersecurity because it pays some costs after an incident and prevents none of them. It cannot restore customer trust, recover lost time, or guarantee a payout, since claims depend on policy terms, exclusions and the controls you said you had. Treat it as one risk-transfer tool beside real defenses.
What does a policy actually do?
A cyber policy is a contract. In general terms, it may reimburse specified costs of an incident, such as forensic investigation, legal advice, notification of affected people, and some business interruption losses, up to limits and after a deductible. What is covered varies by insurer and by policy, so nothing here describes a particular product. Read yours.
The word that matters is "specified." Whatever the policy does not list, you pay.
What does it not do?
It does not reduce the chance of an attack. Insurance changes who bears part of the cost, not how likely the event is.
It does not repair operations. When systems are encrypted, the payout arrives after the outage, not during it. CISA describes ransomware as malware that encrypts files so the files and the systems depending on them become unusable, and frames its resources around preventing attacks that leave organizations without the data they need to operate. Preparation is the part money cannot buy afterward.
It does not remove your obligations. Notification duties, customer contracts and regulators do not wait on a claim.
Where do claims go wrong?
Here is a constructed example. A company answers an application form saying multi-factor authentication is enforced for all remote access. In practice, a legacy VPN account for a contractor was exempt. An attacker uses that account. The insurer, reviewing the claim, points to the inaccurate answer on the application. Whether that voids cover depends on the policy and the law where the company operates, but the dispute alone costs months.
Common friction points to read for in any policy:
- Exclusions for events such as war or state-backed activity, with wording that has been argued over.
- Sub-limits on specific costs, such as ransom, social engineering fraud, or data restoration.
- Conditions that require certain controls to be in place and maintained.
- Requirements to use the insurer's approved responders.
- Retroactive dates and notification deadlines for claims.
A legal or broker review before signing is worth the cost.
How should the two work together?
Use a framework to decide what to build and insurance to cover what remains. The NIST Cybersecurity Framework 2.0 organizes outcomes into Govern, Identify, Protect, Detect, Respond and Recover. CISA's Cross-Sector Cybersecurity Performance Goals, aligned with CSF 2.0, give a short list of practical actions, starting with an asset inventory updated at least monthly and a single accountable leader for cybersecurity.
Many insurers ask about controls such as MFA, backups and incident response plans. Those questions are a free checklist. Do the controls and answer truthfully.
What should you spend first?
Before buying more cover, make sure the basics are done: MFA on email, remote access and admin accounts; tested offline or immutable backups; patching for internet-facing systems; an incident plan with named people; and logs retained long enough to investigate. These reduce both the chance of a loss and the size of any claim.
How to check or apply this
- Read the policy's exclusions, sub-limits and conditions, and have someone qualified explain them.
- Compare each application answer with reality, and correct either one.
- Implement the basics above and record the evidence.
- Test a restore from backup and time it.
- Write the incident plan, including who calls the insurer and when.
- Estimate a plausible worst case and check whether limits would cover it.
- Review cover and controls together every year.
Where does Safeguard fit?
Safeguard focuses on software: scanning code and dependencies, and compliance automation that helps keep evidence of the controls you run. It is not insurance and does not guarantee outcomes.
Quick check
Will my insurer pay if I get breached?
It depends on the policy terms, exclusions, limits and whether you met its conditions. Do not assume. Read the policy and ask your broker about specific scenarios.
Is insurance cheaper than security?
They answer different questions. Insurance covers part of the cost after loss. Security lowers the chance and size of loss. Insurers also often expect baseline controls before they will cover you.
Sources
- CISA, Ransomware and StopRansomware.gov
- NIST Cybersecurity Framework
- CISA, Cross-Sector Cybersecurity Performance Goals
Last reviewed: 18 October 2026.
