Cyber insurance for businesses

A ransomware attack that locks up your systems, a leak of customer data, a fraud using a spoofed email that diverts a bank transfer: cyber incidents are today among the most concrete operational risks, even for Swiss SMEs. Cyber insurance exists to cushion the economic impact of these events. It is not a substitute for IT security, but one piece of a digital risk management strategy.

Why SMEs are targets too

Many entrepreneurs think they are “too small” to interest attackers. That is a mistake: most attacks are automated and hit anyone with weak defences. SMEs are often attractive targets precisely because they are less protected and more inclined to pay in order to restore operations.

The consequences of an incident go well beyond the ransom:

Business interruption and loss of revenue during the days of downtime.
Costs of restoring systems and recovering data.
Liability towards customers and partners for the breach of their data.
Reputational damage that is hard to quantify.

What a cyber policy covers

Coverage varies widely between insurers, but the typical modules are:

Incident assistance: access to forensic IT specialists, lawyers and crisis communication experts, often the most concrete value in the first few hours.
First-party losses: costs of restoring data and systems, business interruption expenses, and in some policies the managed payment of a ransomware extortion.
Third-party liability: claims from customers or partners for the compromise of their data.
Notification costs and management of the consequences of a personal data breach.
Ancillary coverage for cyber fraud and social engineering, usually with specific conditions and limits.

The Swiss data protection framework

The revised Federal Act on Data Protection (revFADP), in force since September 2023, has strengthened the obligations of companies that process personal data. Among them, the obligation to notify the Federal Data Protection Commissioner of data security breaches that entail a high risk to the individuals concerned, and stricter requirements on security and transparency.

A cyber policy does not replace compliance: it helps cover the costs that a breach generates, including notification and management activities. But the company remains responsible for adopting adequate technical and organisational measures.

Prevention before the policy

Insurers increasingly require a minimum level of security in order to grant coverage or to pay out in the event of a claim. The basic measures that count:

Backups that are regular, tested and stored offline or isolated.
Multi-factor authentication on critical accesses and email.
Timely updates and patches of systems.
Training of staff on phishing and email fraud.
An incident response plan defined before it is needed.

Those who present themselves with solid defences obtain better terms and reduce the very likelihood of a claim.

How to size the coverage

The key parameters are the limit, consistent with the potential damage from downtime and liability, the deductibles, the waiting periods for business interruption and the precise scope of the exclusions. Pay attention also to the coverage of social engineering fraud, which is often limited. Coverage must be calibrated to the company’s real dependence on digital systems and to the sensitivity of the data processed.

How we help

We assess your exposure to digital risk, your level of data protection and the security measures in place, to understand which cyber coverage makes sense and how to integrate it into your overall risk management. Let’s analyse your digital risk.