A logistics SME discovers on a Monday morning that all its workstations display the same message: files encrypted, ransom demanded in cryptocurrency. Operations are halted, customer orders are blocked, and the IT service provider announces several days of restoration. The question of cyber risk insurance arises urgently, when it should have been considered long before.
Exclusions and security prerequisites: what leads to a failed cyber indemnification
Most content on cyber insurance focuses on the guarantees. There is less discussion about what nullifies these guarantees when they are most needed.
Insurers have tightened their subscription conditions. Before agreeing to cover a company, they now check for the presence of concrete measures: multi-factor authentication (MFA) activated on all critical access, regularly tested backups, EDR solution deployed on workstations, and documented vulnerability management. Without these prerequisites, there is no contract, or a contract with exclusions so broad that it becomes useless.
The trap lies in the details. A company may have backups, but if they have never been tested under real conditions, the insurer may contest the coverage. Similarly, an active MFA on email but absent from the VPN or file server access leaves a gap that the insurance policy will not cover. To learn everything about cyber risk insurance, one must first understand that coverage relies on a verifiable cybersecurity foundation.
Cyber insurance functions like a permanent security audit. Insurers require proof of maturity, and this requirement pushes companies to structure their defenses. It is far from a simple transfer of financial risk.
Cyber insurance for SMEs: a double risk when the IS is also the sales channel
For an SME whose activity relies on an e-commerce site or an online management platform, a cyberattack does not cause a single problem but a cascade. The information system is both the production tool and the sales channel. When it fails, everything stops simultaneously.
The interruption of activity generates immediate revenue losses. Ongoing orders are no longer processed, and customers turn to competitors. Meanwhile, cash flow deteriorates, and if customer invoices remain unpaid due to the billing system blockage, one enters a risk of non-payment that falls under a different insurance logic.
This is an angle that usual content does not address: the coupling of cyber insurance and credit insurance makes perfect sense for online SMEs. A cyberattack can trigger a domino effect on the financial chain, not just on the technical infrastructure.
Covered losses beyond ransomware
Cyber insurance is often associated solely with the ransomware scenario. The coverage goes further:
- Notification costs to affected individuals in case of personal data breaches, an obligation imposed by the GDPR within strict deadlines
- Legal defense and management of claims from third parties (clients, partners) whose data has been compromised
- Costs for system restoration, forensic investigation, and sometimes the intervention of a crisis communication provider
- Business interruption losses calculated based on the actual duration of unavailability
This legal and compliance dimension often represents a significant part of the total cost of an incident. The GDPR compliance chain can cost as much as technical remediation.
Contractual obligation for cyber insurance: what clients impose
In France, no law requires private companies to take out cyber insurance. The constraint comes from elsewhere: clients, particularly in sensitive sectors (healthcare, defense, financial services), who demand it in their contracts with subcontractors.
For an SME working as a subcontractor, not having cyber insurance can mean losing a contract. It is no longer a matter of internal risk management; it is a condition for commercial access. Feedback varies on this point depending on the sectors, but the trend is clear: cyber insurance is becoming a contractual prerequisite before being a management choice.
What insurers check at subscription
Here are the most common control points during a quote request:
- Presence and scope of MFA (email, VPN, administrator access, business applications)
- Backup policy: frequency, outsourcing, documented restoration tests
- Deployment of an EDR (Endpoint Detection and Response) across the entire fleet
- Patch management and security update processes
- Employee awareness of phishing, with evidence (test campaigns, dated training)
An incomplete file on any of these points leads to either a refusal, a surcharge, or targeted exclusions that drain the guarantee of its substance.
Choosing cyber insurance: read exclusions before guarantees
The natural reflex is to compare coverage limits between insurers. One looks at the maximum amount covered, the waiting period, the deductible. This is not where the quality of a contract is determined.
Exclusions determine the real value of a cyber policy. Some policies exclude acts of state war, a category that insurers sometimes interpret broadly in the face of attacks attributed to groups linked to states. Others exclude gross negligence, which brings us back to the issue of poorly respected security prerequisites.
Before signing, it is wise to ask the insurer three specific questions: what scenarios trigger an exclusion for negligence? What is the response time of the incident response team? And above all, does the contract cover business interruption losses beyond mere technical remediation?
A poorly calibrated cyber contract gives a false sense of protection. For an SME, the risk is not only to suffer an attack but to discover afterward that the policy does not cover anything that actually happened. Reading the exclusions in detail, verifying one’s own security measures, and documenting every cybersecurity action: this is the only way to turn an insurance premium into real protection.