On a Monday morning, orders stop coming in, accounting systems are inaccessible and the workshop is waiting for production instructions. In this fictional scenario, familiar to ransomware specialists, the business owner has cyber insurance. Good news? Yes. An immediate solution? No. Between calling the assistance line, finding usable backups and reviewing coverage, one thing becomes clear: the policy can fund part of the crisis response, but it cannot create resilience where none exists. Looking ahead to September 2026, this distinction is likely to carry more weight in SMEs’ decisions. This analysis draws on developments documented through 2024, extended here through explicitly conditional projections.
Useful insurance, but not a restart button
Cyber insurance addresses a tangible risk: a cyberattack generates a wide range of costs, often simultaneously. Technical expertise, system restoration, legal advice, notification of affected individuals, crisis communications, business interruption and customer claims may fall within a policy’s scope. But rarely without conditions, limits or distinctions. Two offerings carrying the same label can therefore provide very different protection for a business.
Its value goes beyond reimbursement. Access to an incident response team can be crucial for an SME without a cybersecurity manager. But the business still needs to know whom to call, when and with what authorization to incur costs. A service provider brought in independently is not necessarily covered on the same terms as one appointed by the insurer. The emergency number and claims reporting procedure should be recorded in a document accessible outside the IT network.
The fine print defines the risk you retain
Exclusions: examine scenarios, not just headings
Exclusions are the first filter. Some policies distinguish between a cyber intrusion and fraud involving the manipulation of an employee. A fraudulent transfer instruction sent to an accountant may fall under specific coverage, another insurance policy or no coverage at all. Incidents at suppliers, infrastructure failures and certain circumstances involving war or state operations also require careful scrutiny.
These last issues are not theoretical. Litigation following NotPetya, the 2017 attack that caused damage internationally, demonstrated how the classification of an event could become decisive. Since 2023, Lloyd’s has required clauses addressing state-backed attacks in certain standalone cyber policies underwritten in its market. This does not mean that every attack attributed to a state is automatically excluded: the policy’s wording and criteria remain essential.
Deductibles, waiting periods and sublimits: the true out-of-pocket cost
The deductible is only part of the equation. Business interruption coverage may include a waiting period, leaving the company to bear the cost of the first hours of downtime. Sublimits may cap certain expenses, even when the overall limit appears generous. The indemnity period and the method used to calculate losses matter just as much: lost revenue and compensable loss are not the same thing.
Consider a distributor that depends on its business management software. If its systems restart quickly but order fulfillment remains disrupted for several days, when does the covered period end? How can it prove that sales were genuinely lost rather than deferred? These questions should be discussed before signing. The cash needed to cover expenses upfront also warrants assessment: insurance payments do not necessarily arrive as quickly as the bills.
Prevention is becoming a condition of insurability
The market hardening seen in the early 2020s, against a backdrop of ransomware claims, led to more detailed questionnaires and stricter underwriting requirements. Multifactor authentication, isolated backups, endpoint protection, patch management and restrictions on privileged access are recurring themes. Whether they are mandatory varies by insurer and policy. There is no universal checklist whose completion automatically guarantees a payout.
For an SME, the danger lies in ticking boxes too quickly. Stating that multifactor authentication protects remote access when an old maintenance account is exempt creates a gap between the declaration and reality. The consequences depend on the applicable law, the questions asked and the policy clauses. The questionnaire should be validated with the people who actually administer the system, then retained alongside evidence supporting the answers.
Maintaining these commitments matters just as much as meeting them when the policy is taken out. Acquiring a subsidiary, changing hosting providers or creating new supplier access can alter exposure. Periodic reviews involving management, IT and the broker help identify what needs to be corrected or reported. Insurance then becomes a tool for dialogue rather than a form forgotten once payment has been made.
The real budget combines insurance and continuity
Comparing premiums alone creates a false economy. The relevant cost combines the premium, security investments, continuity resources and retained financial risk. A cheaper policy with a high deductible or narrow interruption coverage may be poorly suited to a business that cannot withstand a single day of downtime.
Conversely, not all cybersecurity spending delivers the same operational value. For a small business, testing a full restoration may be more urgent than adding a poorly utilized tool. Describing a backup as daily proves neither its integrity nor its availability after a compromise, nor the ability to reinstall the necessary applications. The right metric is concrete: how long will it take to resume an acceptable level of operations?
- Map what matters most: essential applications, data, suppliers and people.
- Test a shutdown: orders, invoicing, payroll and communications without the usual tools.
- Calculate out-of-pocket costs: deductibles, excluded expenses and cash requirements.
- Check the scenario against the policy: coverage triggers, supporting documentation and authorized providers.
External dependencies complicate the equation
Outsourcing does not eliminate risk: it shifts it. A compromised IT provider can affect multiple customers; an unavailable cloud service can bring operations to a halt without any intrusion into the SME’s premises. Businesses need to check whether interruption at these suppliers is covered, which suppliers are included and under what circumstances. The provider’s commercial contract and the cyber policy should be read together, without assuming that one will make up for the other’s limitations.
Looking ahead to 2026, the spread of digital services and pressure from major corporate customers could intensify this demand for evidence. SMEs would then benefit from assembling a simple documentation pack: an inventory, restoration tests, an incident procedure and clearly assigned responsibilities. This pack would help both in negotiating insurance and in reducing time lost during a crisis.
What next? The next step is not necessarily to buy more coverage, but to organize a simulation with the broker and IT provider. What happens if the business comes to a standstill tomorrow? Who responds, who pays and what data will be used to restart operations? Looking ahead to 2026, the best-prepared SMEs could be those that treat insurance and prevention as two complementary budgets: one absorbs part of the shock, while the other makes recovery possible.