Compare online
Cyber insurance
Cover for the cost of a cyber attack on your business: ransomware, data breaches, business email compromise and the downtime that follows. Compare cyber insurance with your other covers in one request.
- No phone number needed to request quotes
- No MFA or backups? A broker reviews your cover
What is cyber insurance?
Cyber insurance helps protect your business from the costs of cybercrime. business.gov.au lists the costs it can cover: cyber extortion or ransomware, interruptions to your business because of a cyber event, network security and data breaches including data recovery, and the inadvertent loss or release of customer personal information.
What it covers, and what it doesn’t
Cyber wordings vary widely, so the PDS is the final word.
Usually covered
- Incident response. Specialists to contain an attack and work out what happened.
- Data recovery. Restoring systems and data after an event.
- Business interruption. Lost income while systems are down.
- Extortion and ransomware. Response costs, subject to the policy and the law.
- Claims from others. If customer data is exposed and they claim against you.
Usually not covered
- Known weaknesses left unfixed. Policies can exclude losses from issues you knew about.
- Events before the policy started. Including breaches you discover later.
- Upgrading your systems. Improvements beyond restoring what you had.
- Invoice fraud, in some policies. Funds transfer fraud can be excluded, optional or capped. Check.
Your obligations after an attack
Two Australian reporting rules can apply, depending on your size:
| Obligation | Who it applies to |
|---|---|
| Notifiable Data Breaches scheme (OAIC) | Businesses and not-for-profits with annual turnover over $3 million, plus some smaller ones regardless of turnover, such as private health service providers, credit providers and TFN recipients. |
| Ransomware payment reporting (Cyber Security Act 2024) | Businesses with annual turnover of $3 million or more must report a ransomware or cyber extortion payment within 72 hours. Active since 30 May 2025. |
| Reporting cybercrime | Any business can report through ReportCyber at cyber.gov.au. |
A small market growing fast
Cyber is the smallest of the commercial insurance classes APRA reports and the fastest growing. Insurers wrote A$212 million of cyber premium in the year to 30 June 2026, up 14% on the year before, against A$3.83 billion for public and product liability. A young, growing book is why insurers ask about multi-factor login, backups and record counts before they quote: the questions in the next section are how they keep the class profitable enough to keep offering it.
What insurers ask before they quote
The Australian Cyber Security Centre’s small business guide starts with three measures: multi-factor authentication, software updates and backups. Insurers ask about the same things.
If you don’t yet have multi-factor authentication or backups, we route your request to a licensed broker rather than quoting online.
When cyber insurance isn’t the right cover
Cyber covers losses from a cyber event. These need other cover:
- A client says your advice cost them money.That’s professional indemnity. Professional indemnity
- A laptop is stolen from your office.The hardware is covered by a business pack. Business insurance packs
- An employee steals from the business.Crime cover, usually part of management liability. Management liability
How to compare cyber insurance
Cyber insurance questions
Do small businesses need cyber insurance?
It isn’t compulsory. It’s worth considering if you rely on email and online systems, hold customer data, or take payments online.
Does cyber insurance cover ransomware?
business.gov.au lists cyber extortion and ransomware among the costs cyber insurance can cover. Check the PDS for conditions and limits.
Does cyber insurance cover invoice fraud?
Sometimes. Business email compromise and funds transfer fraud can be excluded, optional or capped, so check before you buy.
Do I have to report a data breach?
If you’re covered by the Notifiable Data Breaches scheme, generally businesses with turnover over $3 million and some others, you must notify affected people and the OAIC of an eligible breach.
Do I have to report a ransomware payment?
Businesses with annual turnover of $3 million or more must report a ransomware or cyber extortion payment within 72 hours.
Is cyber insurance the same as cyber liability insurance?
Yes. Insurers use both names. The policy covers your own costs after an incident, such as restoring systems and notifying customers, and your liability to others whose data was exposed.
What do insurers ask about before they quote cyber cover?
Your security basics: whether you use multi-factor authentication, keep backups, patch software and train staff. The answers affect the price and whether an insurer will quote.
What does cyber insurance not cover?
Incidents you knew about before the policy started, upgrades that leave you better off than before the attack, fines that can’t legally be insured, and losses from outages at a utility or internet provider, unless the policy extends to them. Some policies also exclude claims where basic security the insurer required, such as multi-factor authentication, wasn’t in place. Read the PDS.
How much does cyber insurance cost?
It depends on your turnover, how much customer data you hold, your industry, the limit you choose and your security controls, especially multi-factor authentication and backups. There are no prices on this page; compare quotes for your business in one request.
Keep reading
More cover to compare online
Sources
- business.gov.au: Types of business insurance
- Australian Cyber Security Centre: Small business cyber security guide
- Australian Cyber Security Centre: Business email compromise
- OAIC: Notifiable Data Breach scheme
- Australian Cyber Security Centre: Ransomware payment reporting
- APRA: Quarterly general insurance performance statistics, June 2026
Cyber insurance