Cyber Insurance Policy Guide: Cover, Limits and Exclusions
A cyber insurance policy should be reviewed against the systems, data and payments your business relies on. Use this guide to compare response services, limits, exclusions and the information to discuss with ABS Insurance Brokers.
You're approving supplier payments between site calls when an email arrives with updated bank details. It looks like the same subcontractor you've paid before. Meanwhile, your project manager can't open the scheduling platform, and nobody's sure whether the problem is your system or the provider's.
That's the practical test for a cyber insurance policy in 2026. Not whether the schedule shows an impressive headline limit, but whether it covers the missing payment, the interruption and the specialists needed to get you operating again. For builders and SMEs, those costs need separate attention.
Table of Contents
- What a Cyber Insurance Policy Covers at a Glance
- Where Claims Get Cut Back by Exclusions and Sub-Limits
- What Insurers Check and What Drives Your Premium
- How to Set Limits, Excesses and Waiting Periods
- Claims in Practice for Builders and Small Businesses
- Assess Your Exposure and Choose Your Next Step
What a Cyber Insurance Policy Covers at a Glance
A cyber insurance policy can pay for the costs of a digital incident your business suffers, called first-party cover, and claims others bring against you, called third-party cover. Think of a car policy that covers your own repairs and damage you cause another driver. Here, the damage involves systems, data, payments and the people affected.
First-party sections address your own financial impact. Third-party sections address allegations from customers, suppliers or other affected parties. Neither category means every resulting expense is insured.
The Australian Cyber Security Centre responded to more than 1,200 cyber-security incidents in 2024–25, an 11% annual increase, while business cybercrime costs rose 50% overall, according to its businesses and organisations factsheet.
Match costs to the insuring clause
Cyber insurance cover sections and what they pay for
| Cover section | What it pays for | Type |
|---|---|---|
| Incident response | Forensic investigation, legal advice, crisis management and notification costs | First-party |
| Data restoration | Rebuilding or recovering lost or corrupted systems and records | First-party |
| Business interruption | Lost income and extra expenses while systems are down, after the waiting period | First-party |
| Cyber extortion | Response to a ransom demand, subject to insurer approval and the law | First-party |
| Fraudulent transfer | Direct loss from payment redirection or invoice fraud, often under a low sub-limit | First-party |
| Privacy and regulatory liability | Covered claims and regulator action after personal information is exposed | Third-party |
| Network security liability | Claims alleging your systems spread malware or blocked a third party's access | Third-party |
| Media liability | Covered copyright, defamation or privacy claims involving online content | Third-party |
| Legal defence | Reasonable costs to investigate, defend and settle a covered claim | Third-party |
These are sections to look for, not a promise that every policy includes them. Fraudulent-transfer and media cover, for example, need explicit confirmation. Regulatory cover also needs careful reading, particularly where penalties or other amounts may not be legally insurable.
Insurers name sections differently. Match the insured event, payable costs and conditions, rather than assuming similar labels deliver identical protection. Check whether defence costs reduce the amount available to settle a claim, and whether response expenses share the overall policy limit.
Buying incident-response assistance doesn't automatically insure the money a fraudster persuades you to transfer.
Insurance ownership itself shouldn't be confused with business preparedness. According to Insurance Business's account of the Australian Institute of Criminology survey, cyber-insurance uptake among 10,593 online Australians fell from 4.6% in 2024 to 3.7% in 2025; that's a respondent measure, not an SME coverage rate.
The exposure map in the final section turns these cover sections into a checklist for your own systems.
Where Claims Get Cut Back by Exclusions and Sub-Limits
A compromised email account sends a convincing supplier payment request. Your accounts person recognises the conversation, changes the bank details and releases a progress payment. The fraud emerges only when the supplier chases payment.
The insurer might pay to investigate the compromised mailbox but exclude, or tightly cap, the transferred money. Your headline limit doesn't override a smaller limit written specifically for social-engineering fraud.
Global claims data reported for 2025 found that business-email compromise and funds-transfer fraud accounted for 58% of claims, according to Australian Small Business's cyber-insurance commentary. That global finding isn't an Australian construction claims rate, but it supports treating payment fraud as a separate buying decision.
Common cyber exclusions and sub-limits to check
| Exclusion or limit | What it means | What to check |
|---|---|---|
| Social-engineering fraud | Fake invoices or payment redirection may be excluded or capped | Sub-limit and whether dual payment approval is required |
| Infrastructure or utility outage | Power, telecoms or third-party cloud failures may not trigger cover | Whether dependent-system cover includes the cause of failure |
| Employee wages during interruption | Some policies don't reimburse continuing staff wages | Whether wages sit inside the business interruption schedule |
| Betterment | Upgrades beyond the original system may not be paid | Whether restoration is described as like-for-like |
| State-backed or war-related attacks | Certain attacks linked to state actors may be restricted | Exact war and state-backed attack wording |
| Unmet security conditions | Missing required controls can jeopardise a claim | Written confirmation of MFA and backup practices |
Test the exclusions against site operations
Consider ransomware disabling project scheduling during a concrete pour. The covered interruption might involve rescheduling and emergency administration, but that doesn't automatically bring defective work, physical damage or contractual delay penalties into the cyber policy.
Now consider a cloud platform unavailable because its electricity supplier fails. Cover for a cyberattack on a provider isn't necessarily cover for every provider outage. The trigger must match the actual cause.
Continuing wages deserve the same scrutiny. Paying staff while they work manually is a real cash cost, but reimbursement turns on the interruption calculation and any extra-expense provisions. Don't assume the insurer reimburses every outgoing during downtime.
Search the wording for war, state-backed, betterment, wages, dependent systems and social engineering. Read the definitions and endorsements attached to each result, not just the exclusion heading.
Put this question to the insurer in writing: Which policy responds when the same event causes system downtime and an unauthorised payment, and how do cyber, crime, management liability and business-interruption cover interact?
What Insurers Check and What Drives Your Premium
Industry estimates cited to a parliamentary inquiry put SME cyber-insurance uptake at roughly 20%, compared with 70–75% for larger organisations, while an Australian Institute of Criminology survey found about 25% of SME owners reported cybercrime affecting their business during the preceding 12 months, according to Insurance Business's parliamentary inquiry coverage. Those different measures don't establish why businesses remain uninsured. They do make it unwise to assume price is the only obstacle.
An insurer needs to understand both how an incident could start and how expensive recovery could become. Security controls influence the former; turnover, staffing and operational dependencies help explain the latter.
Controls and factors insurers check
| Control or factor | Why insurers ask | Evidence to provide |
|---|---|---|
| Multi-factor authentication | Limits account takeover and payment fraud | Confirmation MFA is enforced on email and admin accounts |
| Tested backups | Supports recovery without relying on a ransom payment | Backup schedule and recent restore-test record |
| Payment verification | Reduces invoice and bank-detail fraud | Call-back procedure for bank-detail changes |
| Privileged-access controls | Restricts system changes and payment authority | Admin-account list and approval steps |
| Incident-response panel | Provides access to approved specialists | Panel contacts in the response plan |
| Revenue and headcount | Indicates the potential scale of a loss | Latest turnover and staff numbers |
| Supplier dependence | Identifies reliance on external platforms | Critical-platform list and provider details |
Give evidence, not optimistic answers
For Microsoft 365 or Google Workspace, distinguish MFA available from MFA enforced. Ask your IT provider to confirm coverage of administrator accounts, remote access and any exceptions. A screenshot showing one protected user doesn't establish that every relevant account is protected.
Backups need evidence of successful restoration, not merely a subscription invoice. Payment procedures should specify a call to an independently held supplier number, rather than the number supplied in the bank-change email.
Use Networking2000's a practical IT security audit guide to organise the technical review with your IT provider. Keep the insurer's actual questions beside the findings so unresolved gaps aren't accidentally recorded as completed controls.
Missing controls can affect eligibility, premium, excess or available limits. An inaccurate proposal answer can also jeopardise a claim, although the outcome depends on the circumstances and applicable policy and legal provisions.
Practical distinction: A security discount changes what you pay. A condition of cover can change whether the insurer pays.
When reviewing business insurance costs, separate premium savings from costs you retain yourself. A cheaper quote with a restrictive payment-fraud endorsement may be poor value for a builder handling substantial supplier transfers.
Keep the completed proposal, supporting evidence and insurer clarifications together. Ask which controls must remain operational throughout the policy period, and arrange a review when you change IT providers or platforms.
How to Set Limits, Excesses and Waiting Periods
The limit is the most the insurer pays under the relevant section or policy. The excess is the amount you contribute to a covered loss. The waiting period is the time threshold before eligible business-interruption loss becomes payable, with the exact calculation controlled by the wording.
A large limit can still leave a substantial interruption uninsured. In a hypothetical five-day outage with a 72-hour waiting period, the business may carry the first three days of interruption costs. Confirm whether the wording operates that way, rather than assuming every waiting period has the same effect.
Cyber remains a specialised insurance line: Front Row Tech's analysis of APRA quarterly data put Australian cyber gross written premium at approximately AUD 32 million in the March 2026 quarter, representing fewer than 0.2% of total Australian general-insurance premium. Comparing wording matters more than assuming a standard product.
Build a credible outage budget
Estimate the outage your business could realistically suffer using payroll, gross profit, subcontractor commitments, project delays and emergency technology expenditure. Separate economic damage from insured expenses, and avoid counting continuing wages twice within both margin loss and extra expenses.
The following amounts are hypothetical budgeting assumptions, not market prices or a promised settlement.
Illustrative outage cost and the policy item that responds
| Cost component | Policy item to test |
|---|---|
| Incident response and forensics, AUD 20,000 | Incident response sub-limit |
| Data restoration, AUD 15,000 | Data restoration limit |
| Business interruption, five days of lost margin, AUD 30,000 | Indemnity period and waiting period |
| Emergency IT and contractor support, AUD 12,000 | Extra expense cover |
| Notification and legal advice, AUD 8,000 | Notification sub-limit and relevant legal-cost clause |
| Total illustrative loss, AUD 85,000 | Compare against limit, sub-limits and excess |
The first expenses fund investigation and rebuilding. Lost margin requires financial evidence and a covered interruption trigger; emergency contractors need to meet the extra-expense wording. Breach advice and notifications may be payable under response provisions, while legal defence concerns a covered claim against you.
For context, the ASD Annual Cyber Threat Report 2024–2025 put average self-reported cybercrime costs at approximately AUD 56,600 for small businesses and AUD 97,200 for medium businesses, with the medium-business figure increasing 55% year on year. These averages aren't recommended limits.
Choose an excess you could fund without delaying payroll. Weigh the premium saving against the cash needed for urgent work before reimbursement.
Use these final checks alongside your broader business interruption insurance arrangements:
- Indemnity period: Allow for operational recovery, not just servers restarting.
- Dependent-business interruption: Confirm the critical provider and event are eligible.
- Notification and ransom sub-limits: Test each separately against the scenario, including approval requirements.
Claims in Practice for Builders and Small Businesses
A cyber claim needs two workstreams running together: containing the incident and documenting the loss. The following scenarios are illustrative, not actual claims or assurances of payment.
A supplier payment goes to the wrong account
At payment time, a bookkeeper receives an email appearing to come from a known supplier and transfers a hypothetical AUD 45,000 to updated bank details. On discovery, the business contacts its bank immediately, requests attempted recovery and notifies the insurer using the policy's incident channel.
The response team preserves the email, mailbox logs, payment instructions and approval records. The direct financial loss is tested against the social-engineering section, including its sub-limit and verification conditions. Investigation costs may sit under a different clause.
If the proposal declared mandatory supplier call-backs, the insurer may request evidence that the procedure operated at the time. A written procedure nobody followed isn't the same as an implemented control.
Ransomware stops estimating and scheduling
In this hypothetical scenario, ransomware encrypts estimating and project-scheduling software for four days. At discovery, the business engages its IT team and approved response panel to contain the event and preserve evidence before rebuilding.
During restoration, the business recovers from backups, but delayed certificates lead to overtime and a late handover. Incident response and restoration costs are assessed under their respective sections. Eligible interruption loss is calculated using the policy's waiting period and financial definitions.
After operations resume, the business submits contractor invoices, restoration records, timesheets and evidence linking each claimed expense to the incident. A late-handover penalty still needs its own coverage analysis; it isn't automatically insured because ransomware started the chain of events.
A customer alleges exposure of contact details
The customer complaint arrives after a phishing attack. The business promptly notifies the insurer and preserves relevant correspondence without admitting liability or promising compensation.
The investigation establishes what information was accessed and whether notification is required. Covered notification expenditure may fall under incident response, while privacy liability and legal defence address an eligible allegation against the business. Counsel should guide communications so staff don't speculate about facts not yet established.
Preserve the evidence that explains what happened, what controls were operating and why each recovery expense was necessary.
For a response-plan review with your IT provider or auditor, DevArmor's response planning guide for auditors offers a useful starting point. Align the resulting plan with the insurer's panel, notification instructions and consent requirements.
Across these scenarios, notify promptly, retain logs and receipts, and obtain required approval before settlements or ransom-related expenditure. Never assume a payment is lawful or covered merely because an attacker demands it.
Coordinate cyber arrangements with insurance for construction companies so liability and project-related claims reach the relevant insurer. The same event can produce different outcomes because schedules, endorsements and proposal answers differ.
Assess Your Exposure and Choose Your Next Step
Start with the systems that keep work and money moving. Name their business owners, the people relying on them and the manual workaround available if access disappears.
Turn operations into an exposure map
List critical systems and dependencies. Include email, cloud files, estimating, accounting, payroll and payment platforms. Naming systems helps expose gaps, although an unlisted system isn't automatically uninsured unless the wording requires it to be identified. The common slip is recording the software but not the subcontractors or staff who depend on it.
Cost short and prolonged outages. As a planning exercise, model a hypothetical three-day and ten-day outage, including payroll commitments, lost gross profit, emergency purchases and delayed projects. Don't stop at the IT repair invoice. Nerds 2 You Edmonton's guidance to identify and rank IT risks can help organise this discussion.
Map each loss to a cover section. Allocate investigation, rebuilding, interruption, fraudulent payments and liability separately. Mark anything without a clear insuring clause as unresolved, rather than forcing it into the nearest category.
Record the conditions beside each exposure. Include the waiting period, indemnity period, dependent-system wording, social-engineering sub-limit and approved panel. The common mistake is comparing only the total limit.
Verify controls before submitting the proposal. Attach current MFA evidence, restore-test results, payment procedures and administrator records. Distinguish planned improvements from controls already operating; inaccurate answers can jeopardise a claim.
Compare at least three quotes in one grid where available. Put limits, sub-limits, excesses, waiting periods and conditions side by side. Check whether lower premiums reflect narrower protection, rather than assuming the cheapest option offers equivalent cover.
Decide what to transfer and what to retain
If a compromised email could halt payments on a live project, price cover now. Compare a standalone cyber policy with an extension to existing business insurance, or defer purchase while closing controls gaps if useful cover isn't yet available. Deferring means retaining the exposure, so document the decision and the improvements required.
We're an Australian-owned brokerage based in Bankstown, NSW, supporting builders and SMEs. Our process is Tell Us What You Need, Risk Assessment, Compare Cover Options, and Arrange Your Cover, with ongoing support after placement.
Request written explanations of unclear exclusions and sub-limits before accepting cover. Send bank details and sensitive information only through secure channels, never unencrypted email. Bring your system list, outage cost estimate and evidence of current controls to the conversation.
ABS Insurance Brokers Pty Ltd offers a free insurance quote on request through our Quotation Services platform and can help compare cyber cover against your payment and downtime exposures. Visit ABS Insurance Brokers Pty Ltd to request a quote, with your exposure map and control evidence ready for assessment.
