The short answer
Cyber insurance pays for the costs of a digital incident: investigating a breach, notifying people, restoring systems, responding to extortion, lost income and claims made against you. Some policies also cover funds sent to a fraudster. Insurers judge a business by the data it holds and the controls it has in place. A licensed broker compares the market and walks through the policy wording with you.
- Businesses that store customer, patient, student or employee personal information
- Online sellers, bookkeepers and agencies whose income depends on a website or a cloud service
- Professionals who handle client files and bank details by email
- Organizations whose customer contracts now ask for evidence of cyber cover
- Owners who were targeted by a phishing email or a fake invoice and want to understand what would respond next time
1 licensed broker in the network handles this. In Alberta, Canada, a request for cyber insurance can be offered to up to three of them, chosen because they are licensed for this line and place. They are test brokers while we are in demo.
See the brokers → Outside Alberta, Canada you can prepare and save a request today; sending opens place by place. Brokers answer with their own quotes. Broker.insure does not quote, advise or take commission.
01 / What it covers
The parts worth understanding
Breach response
The costs of finding out what happened and responding: forensic investigators, legal advice, notifying affected people, call-centre help and credit monitoring where it applies. Privacy rules differ between provinces and federally, so ask which notification duties the cover is built around.
Ransomware and extortion
Help negotiating and responding when systems are locked or data is threatened. Ask how the policy treats a ransom payment, because rules and sanctions can limit what an insurer is able to pay.
Business interruption
Lost income and extra expense when systems are down because of a cyber event. Ask about the waiting period before it applies and whether an outage at a cloud provider you rely on is included.
Data restoration
The cost of rebuilding or recovering lost data and software. Backups reduce the loss, and some insurers ask whether they are kept offline and tested.
Liability to others
Claims from customers, partners or regulators alleging that you failed to protect their data or that your systems harmed them. Fines may be covered only where the law allows.
Funds-transfer and social engineering fraud
Losses where an employee is tricked into sending money to a criminal, for instance by a fake invoice or a spoofed email. This is often a sub-limit or a separate extension, so ask whether it is included and how a call-back check is treated.
02 / Get ready
Bring this, and expect these questions
Gather
- The kinds of data you hold, such as names, health details, payment cards or identity numbers, and roughly how many people they relate to
- How customers pay you: card terminals, an online checkout, a processor, or cash and cheque
- Whether multi-factor authentication is switched on for email, remote access and administrator accounts
- How backups work, how often they run, where copies are stored and when a restore was last tested
- The software and cloud services your business depends on to operate
- Who has administrator access, and how a former employee's accounts are closed
- Any past incidents, near-misses or fraudulent payments, with dates and what was done
- How payment changes are verified, such as a call to a known number before updating bank details
- Customer or lender contracts that mention cyber cover or data protection
A broker will ask
- What kinds of personal or confidential information do you keep, and in what systems?
- Is multi-factor authentication required for email, remote access and administrator accounts?
- How are backups made and kept, and has a restore actually been tested?
- Do you accept card payments directly, or through a processor?
- Which outside providers could stop your business if they failed, such as a cloud host or a payment platform?
- Has the business ever been hit by ransomware, a business email compromise or a data breach?
- How would an employee check a request to change a supplier's bank details?
- Do any contracts require you to hold cyber cover or to notify a client of an incident?
Not sure of an answer? Leave it. "Not known yet" is a fine answer, and a broker will help you fill it in.
03 / Build your request
Answer a few questions. Get your own list.
Pick what fits. Your answers shape the list beside them, and they are saved to your request as plain facts a broker can read. "Not sure yet" is always a fine answer.
04 / Three situations
See which one sounds like yours
A dental clinic with patient records on a shared server
A four-chair dental clinic in Kelowna keeps digital charts and x-rays on a server in the back office, with a nightly backup to an external drive that sits next to it. A neighbouring clinic was recently locked out by ransomware, and the owner wants to know what would respond if the same happened.
First steps. Note what records the server holds, how backups are stored, and who has remote access. Ask the broker about breach response, interruption and restoration, how privacy rules for health information are treated, and whether insurers expect backups kept away from the building.
An online shop with a hijacked supplier invoice
An e-commerce seller in Halifax receives a convincing email from what looks like its usual supplier, asking that future payments go to a new bank account. The owner pays one invoice before a call to the real supplier reveals the email was forged.
First steps. Gather the email, the bank record and a note of what was done once the fraud was found, and report it to the bank and the police right away. A broker can explain how funds-transfer fraud is covered or excluded, and what verification steps insurers expect for payment changes.
A small accounting practice handling client tax files
A three-person accounting firm in Winnipeg holds tax returns, identity documents and bank details for several hundred clients, shared by email and a cloud folder. A larger client has asked for evidence of cyber cover as part of an engagement letter.
First steps. Prepare a short inventory of what is kept and where, the access controls in place and the engagement letter wording. Ask the broker to explain how a professional liability policy and a cyber policy fit together, and what a client's contract expects to see.
05 / Words you will hear
The jargon, in plain words
- Ransomware
- Malicious software that locks files or systems and demands payment to release them. Cover can include response help and restoring data, though how a payment is treated varies.
- Social engineering
- Trickery that persuades a person to hand over money or access, such as a forged invoice or a call pretending to be the bank. It is a separate extension in many policies.
- Multi-factor authentication
- A sign-in that needs something extra beyond the password, like a code on a phone. Insurers often ask whether it protects email, remote access and administrator accounts.
- Waiting period
- The number of hours an outage must last before lost income starts to be covered. A shorter wait means a smaller gap that the business absorbs itself.
- Breach notification
- The legal duty to tell affected people, and sometimes a regulator, when personal data is exposed. Policies often pay for the work involved in doing this properly.
06 / Common mistakes
What trips people up
- Assuming a general liability or property policy already responds to a breach or ransomware.
- Answering the application about security controls from memory instead of checking what is switched on.
- Keeping the only backup connected to the network, where an attacker can reach it too.
- Ignoring the funds-transfer fraud extension and discovering it is limited or optional only after a loss.
- Leaving a former employee or a contractor with live access to email or administrator accounts.
- Waiting to tell the insurer about an incident, when the policy requires prompt notice.
Ready when you are
Turn this into one clear request.
Save it, add what you know, and choose when to send it. A licensed broker who handles cyber insurance takes it from there.
07 / Questions people ask
Straight answers
What does cyber insurance cover?
Typically the cost of responding to a breach, including investigators, legal advice and notifying people, restoring systems, responding to extortion, lost income while systems are down and claims from others. Some policies also respond to funds-transfer fraud. Exactly what is included and the limits vary, so a licensed broker should walk through the wording with you.
Do small businesses need cyber insurance?
Any business that stores customer or employee information, takes payments or relies on online systems has some exposure, whatever its size. Small businesses are often targeted because security is lighter. Whether a policy makes sense depends on the data you hold, how you operate and any contract requirements. A broker can help you weigh it.
What is the difference between cyber and general liability insurance?
General liability responds to bodily injury and property damage claims. It typically excludes or does not address data breaches, ransomware and digital losses. Cyber insurance is written for those, covering response costs, restoration and related claims. They are separate policies, though some packages add limited cyber features, so check the wording.
Will cyber insurance pay a ransom?
Some policies cover extortion payments and the expertise to handle the negotiation, subject to law and the insurer's conditions. Others limit it or exclude it. Rules and international sanctions can restrict whether a payment is lawful. Ask the broker how the policy treats ransom and what the insurer must approve before anything is paid.
What security controls will an insurer ask about?
Commonly multi-factor authentication, backups that are separate and tested, up-to-date software, training for staff and a process for verifying payment changes. Answers affect whether cover is offered and on what terms. Check what is actually in place before you answer, because inaccurate statements can create problems at claim time.
What should I do first if I think there has been a cyber incident?
Check your policy for the notice requirements and the incident number to call, and contact your broker. Many policies give access to a response team, and acting without their knowledge may complicate a claim. Disconnect affected devices if you can, keep evidence, and avoid deleting anything until you have advice.
Specialists
Sites for a specific line of work
General information, not insurance advice. Broker.insure is a directory and request service: it is not an insurer and does not quote, bind or advise. Policy terms, availability and what is required where you live depend on your situation and on licensed professionals. Updated 2026-10-31.