Most Australian businesses run on digital systems. Customer details sit in databases, payments move online and staff rely on their email inboxes, all of which bring risk. A single phishing email, stolen password or fake invoice can halt trading, expose customer data and leave a business with a large bill.
The average self-reported cost of cybercrime for a small business was $56,600 per report in the 2024-25 financial year, according to the Australian Signals Directorate (ASD). Cyber insurance helps cover the financial cost of these incidents, so one bad day online doesn’t have to derail your business.
What is cyber liability insurance?
Cyber insurance, also called cyber liability insurance, cyber security insurance or cyber risk insurance, is a business insurance policy that helps pay for the costs of a cyber attack or data breach. It covers your own losses and claims made against you by others.
How does cyber insurance work?
In terms of how it works, you’ll choose a cover limit, pay a premium and agree to an excess, which is the amount you pay towards each claim. It doesn’t stop an attack; rather, it helps pay for the response and recovery.
If an incident happens, you notify your insurer, who assesses the claim against your policy. Many policies require you to report quickly and get approval before hiring outside specialists, so check the Product Disclosure Statement (PDS) for the steps.
First-party and third-party cyber insurance cover
Cyber insurance policies are generally split into two cover types: first party cover and third party cover.
- First party cover: pays for costs your business faces directly, such as investigating the cause of an incident, restoring data and income lost while you can’t trade.
- Third party cover: responds to claims from customers or regulators after a privacy breach, including the legal costs of defending them.
The exact inclusions depend on the insurer and policy. You can buy cyber insurance on its own or alongside other cover such as professional indemnity and public liability insurance.
What does cyber liability insurance cover?
Cyber liability insurance covers the costs of responding to and recovering from a cyber incident, plus claims made against your business afterwards. What you’re covered for depends on the insurer and policy, so check the PDS before you buy. Common inclusions are:
- Data breaches: costs when customer or business data is stolen, lost or accessed illegally, including notifying the people affected.
- Incident response: specialists to contain an attack, such as forensic investigators, legal advisers and public relations support.
- Ransomware and cyber extortion: help responding when attackers lock your systems or threaten to release your data.
- Data and system restoration: the cost of recovering lost or damaged data and getting software and systems running again.
- Business interruption: income lost and extra costs incurred while you can’t trade, usually after a waiting period.
- Phishing and invoice scams: financial loss when someone in your business is tricked into paying a fake invoice or redirecting a payment.
- Legal and regulatory costs: defending claims from customers or regulators, plus some fines and penalties where the law allows them to be insured.
- Supplier incidents: some policies respond when a breach starts at an IT provider or other service you rely on.
Limits and sub-limits
A policy has an overall limit, but individual covers often sit under lower sub-limits. BizCover lists limits from $100,000 to $2 million for cybercrime losses, depending on the type of loss and the insurer.
Payment fraud is a common example of a sub-limit. It’s often an optional extra capped well below the headline limit.
What does cyber insurance not cover?
Cyber liability insurance doesn’t cover every loss linked to a cyber incident. Exclusions vary by insurer, but common ones are:
- Upgrades and improvements: the cost of making your systems better than they were before the incident.
- Bodily injury and property damage: these fall under other policies, such as public liability.
- Hardware damage: damaged computers and devices, although some insurers cover limited repair or replacement after a covered event.
- Deliberate acts: intentional or fraudulent conduct by the business or its people.
- Known issues: incidents or circumstances you knew about before the policy started.
- Natural disasters and utility failures: outages caused by events such as storms or a power or internet provider failing.
- Intellectual property claims: certain claims that you infringed someone else’s copyright, trademark or patent.
Conditions that can affect a claim
Cover can depend on what you do as well as what happens. Policies may require you to keep security measures in place, such as regular data backups. They may also set deadlines for notifying the insurer and require approval before you hire outside specialists.
Payment fraud cover can come with a condition that you verify changes to payment details, such as by calling a known number. Missing a condition can reduce or void a claim, so read them before you buy.
Who needs cyber liability insurance?
Cyber insurance isn’t legally required in Australia, but any business that relies on digital systems or holds customer data faces the risk. Cover is worth considering if:
- Your business runs on digital systems: your team needs email, cloud software or online platforms to work and bring in revenue.
- You hold customer data: names, addresses, payment details or health records.
- You take payments online: through a website, online store or EFTPOS terminal.
- You pay invoices by bank transfer: fake invoices and changed bank details are among the most common scams.
- Clients ask for it: some contracts require you to hold cyber cover.
Small businesses are targets, too
Large breaches make the news. Optus and Medibank, both hit in 2022, faced legal action and regulator scrutiny afterwards. While a small business is unlikely to make headlines, it can still lose customers’ trust and face legal claims if private data leaks.
Some industries see more claims than others. Healthcare and social assistance made up more than 24% of the claims Emergence received in 2026 to date. Professional services, including lawyers, real estate agents and accountants, ranked second for claim costs in 2025.
Reporting rules for larger businesses
Since 30 May 2025, businesses with annual turnover above $3 million must report a ransomware or cyber extortion payment to the ASD within 72 hours. The obligation applies even if someone else makes the payment on your behalf. Cyber insurance doesn’t replace this requirement, so speak to a legal adviser about your obligations.
How much does cyber insurance cost?
Cyber insurance policies cost an average of $110 per month, or about $1,320 a year, through BizCover in the 2025-26 financial year. The factors that can affect your premium calculation include:
- Industry: businesses that handle more sensitive data or rely heavily on IT, such as health and IT services, tend to pay more.
- Business size: more employees means more people who can click a bad link.
- Data you hold: a clinic storing patient records is a bigger risk than a local bakery.
- Cover limit: a higher limit costs more.
- Security controls: strong practices such as backups and staff training can help.
- Claims history: past claims can push premiums up.
- Optional extras: add-ons such as payment fraud cover can change the price.
- Excess: choosing a higher excess can lower your premium.
Average monthly premiums by industry
| Profession | Average monthly premium |
|---|---|
| IT services | $154 |
| General practice (GP) | $135 |
| Allied health professional | $130 |
| Financial planning service | $128 |
| Accounting service | $114 |
| Savings bank | $110 |
| Clothing retailing | $102 |
| Marketing consultancy | $95 |
| Plumbing | $89 |
| Figures are industry averages from BizCover. Individual premiums depend on your business and insurer. | |
How much cyber insurance cover do I need?
The right limit depends on what a serious incident would cost your business, not on the average claim. As discussed previously, you may be able to take out policies with limits from as little as $100,000 (or sometimes less) up to $2 million.
If you want an idea of how much the average cyber-attack can set you back, these figures give a sense of scale:
- Cybercrime reports: small businesses reported an average cost of $56,600 per report, according to ASD.
- Business email compromise: the average claim was $36,250 between 2023 and 2025, according to Emergence.
- Ransomware: the average claim exceeded $256,000 over the same period, the highest of any claim type Emergence recorded.
You’ll need to weigh up factors specific to your business, such as the size and nature of your database, the size of your operation, whether having a policy in place is a contractor requirement and what sort of financial damage an attack would do.
It’s worth noting that while choosing a lower limit can reduce your premium, it could also risk leaving you further out of pocket at claim time, so weigh the saving against the risk.
Top tips for comparing cyber insurance providers
-
Match the cover to your biggest risk
If your team pays invoices by bank transfer, payment fraud cover matters most. If you hold lots of customer data, look closely at breach response and legal costs.
-
Check the limit and sub-limits
Look at the overall limit and the caps on individual covers, such as payment fraud and ransomware. A high headline limit can hide a much lower cap on the claim you’re most likely to make.
-
Read the exclusions and conditions
Check what isn’t covered and what you must do to keep cover in place, such as maintaining backups. Missing a condition can reduce or deny a claim.
-
Check the business interruption terms
Look for the waiting period before income cover starts and any time limit on how long it pays. A long wait can leave you covering the first days of lost trade yourself.
-
Ask about supplier incidents
Some policies respond when a breach starts at an IT provider, cloud platform or payment service you rely on, and others don’t. Check whether the policy covers incidents that begin outside your business.
-
Look at the support included
Some policies connect you with specialists such as forensic investigators and legal advisers after an attack. Check what help is included and whether you need approval before you use it.
Case study: a fake supplier invoice
Mia runs a landscaping business with six staff. Her bookkeeper receives an email from a regular supplier saying its bank details have changed. The tone is right and the invoice matches a recent order.
The bookkeeper pays $24,500 to the new account. Two weeks later, the real supplier chases the unpaid invoice, and Mia realises the email was a scam.
Mia has cyber liability insurance with optional payment fraud cover. Here’s what happens next:
- Mia notifies her insurer: she reports the incident straight away, because the sooner an insurer hears about a fraudulent payment, the better the chance of recovering funds.
- The claim is assessed: the insurer checks the incident against Mia’s policy, including the payment fraud sub-limit and any conditions, such as verifying changed bank details.
- The insurer pays out or declines: if the claim is accepted, the insurer pays the loss up to the sub-limit, minus the excess.
Mia’s policy has a $50,000 payment fraud sub-limit and a $1,000 excess. If her claim is accepted and the funds can’t be recovered, the insurer pays $23,500.
This example is illustrative only. Whether a claim is paid depends on the insurer and policy wording.
