What it covers
Specialist incident response and negotiation, the costs of restoring or recreating data and systems, and extortion payments where lawful, insurable and approved in advance. [TODO: confirm extortion payment position]
Ransomware cover backed by people who've seen it before.
When systems are encrypted or data is stolen and held to ransom, decisions have to be made in hours. This section brings in specialist responders and covers the costs of getting back to normal.
How this cover works
When it responds
From the first call to the incident hotline, as soon as you suspect an extortion event. Early notification protects both your recovery options and your cover.
What we look at
Backup design and restore testing, endpoint detection and response, privileged access, patching of internet-facing systems and exposed remote access.
Typical scenarios
Encrypted file servers
Staff arrive to find file servers and the finance system encrypted, with a ransom note demanding payment in cryptocurrency.
Data theft without encryption
Attackers copy client records and threaten to publish them unless paid, even though no systems are encrypted.
Backups targeted first
Attackers delete online backups before encrypting production. Recovery depends on whether offline copies exist and can be restored.
Controls that matter here
These are the controls that most influence our terms for this section of cover. Missing one doesn't automatically mean no cover. It means we'll talk about it, and explain the effect on your terms.
- Offline or immutable backups, with restores tested on a schedule
- Endpoint detection and response (EDR) on servers and workstations
- No internet-exposed RDP; remote access through MFA-protected gateways
- Separate, MFA-protected privileged accounts; no daily use of domain admin
Common questions.
Paying is a last resort and never automatic. Any payment must be lawful, must not breach sanctions, and must have our and the insurer's prior written consent. Often the better route is restoring from backups with specialist help. [TODO: confirm wording].
See how your controls shape your terms.
Start a Cyber Risk Check for a clear view of your exposure and what this cover could look like for you.
Get a Cyber Risk Check
Cover is subject to underwriting acceptance and to the terms, conditions, limits, sub-limits, deductibles and exclusions in the policy wording. [TODO: link to policy wording / product summary]