One email. One click. Your business exposed.
Ransomware. Data breaches. Phishing scams. If you store customer data, process online payments, or use email, you're a target. Cyber Protection covers the costs when (not if) you're attacked.
What could go wrong
Cyber attacks aren't just for big corporations. Small businesses are easier targets with weaker defences. Here's what Cyber Protection actually protects you from:
The ransomware attack
You're a 6-person marketing agency. An employee clicks a phishing email. Within hours, all your files are encrypted.
A message appears: "Pay $50,000* in Bitcoin or lose everything." Your backups? Also encrypted. You can't access client work, contracts, or financial records. Every day you're offline costs you $3,000* in lost revenue.
The data breach
You run an online store with 8,000 customer records. Your website has been hacked, and customer data, including names, addresses, and credit card details, has been stolen. Under Australian privacy law, you are required to notify every affected customer.
You're facing potential fines from the OAIC (Office of the Australian Information Commissioner), customer lawsuits, and a PR disaster.
The fake invoice scam
Your accountant receives an email that appears to be from your regular supplier, requesting an update to their bank details for payment.
The email is fake; it's a sophisticated phishing attack. You transfer $45,000* to the scammer's account. By the time you realise, the money's gone.
What this actually covers
Cyber attacks aren't just for big corporations. Small businesses are easier targets with weaker defences. Here's what Cyber Protection actually protects you from:
Cyber Protection
First-party costs (your business directly)
- Ransom payments to unlock your systems
- IT forensics and investigation costs
- Data recovery and system restoration
- Lost income while systems are down
- PR and crisis management
- Legal costs to comply with privacy laws
- Customer notification costs (letters, emails, call centre)
- Credit monitoring services for affected customers
Third-party costs (when others sue you)
- Legal defence costs when customers sue over data breaches
- Compensation to affected customers
- Regulatory fines (OAIC, ACCC, Privacy Commissioner)
- Breach of contract claims from clients
- Professional costs (lawyers, forensic experts, privacy consultants)
What's typically covered:
- Ransomware attacks and extortion
- Data breaches and theft of customer information
- Phishing and social engineering fraud
- Business email compromise (fake invoice scams)
- Cyber extortion and threats
- Privacy law violations and regulatory investigations
- System downtime and business interruption
- Costs to restore data and systems
When you need this
Pre-launch to first year
You need this from Day 1 if:
- Store customer data (names, emails, addresses)
- Take payments online (credit cards, bank transfers)
- Use cloud systems for business operations (Google Workspace, Xero, CRM)
- Send and receive emails with clients or suppliers
- Have a website with login functionality
- Hold confidential client information
Reality check:
If you're reading this on a laptop and using email, you need Cyber Protection. It's not optional anymore.
Growing and hiring
Your cover needs to increase when:
- You're storing more customer data (thousands of records, not hundreds)
- Your revenue exceeds $1M (you're a more attractive target)
- You're taking payments online at scale
- You're handling sensitive data (health records, financial info)
- You're processing data for EU customers (GDPR compliance)
- Clients contractually require Cyber insurance
Established and optimising
Review your cover if:
- You've moved more operations to the cloud
- You've had a near-miss (phishing attempt, suspicious login)
- Your industry has seen high-profile cyber attacks
- You're launching new digital products or services
- You're expanding internationally (different privacy laws)
Common questions
I'm too small to be a target—do I really need this?
Small businesses are actually prime targets. You have valuable data, but weaker security than large corporations. Automated attacks don't discriminate by size; they hit whoever's vulnerable. In 2024, 43% of cyber attacks targeted small businesses.
I use Google Workspace / Microsoft 365, aren't they secure?
They're secure platforms, but that doesn't protect you from phishing, ransomware, or employee mistakes.
Most cyber incidents are caused by human error (clicking bad links, weak passwords, and social engineering). Insurance covers you when technical security isn't enough.
What's the difference between Cyber insurance and IT support?
IT support helps prevent attacks and maintains systems. Cyber insurance pays the costs when prevention fails. You need both.
Think of IT support as your seatbelt; insurance is your airbag.
Will insurance cover the ransom if I'm hit with ransomware?
Most policies will cover the ransom payment if negotiation experts recommend paying (usually as a last resort).
But they'll only pay if you've taken reasonable security measures. If you've ignored basic security, they may refuse.
Always discuss ransom scenarios with your broker before you need them.
Do I need this if I don't store payment details?
Yes. Even if you use payment gateways (such as Stripe or PayPal) that store credit card information, you likely also store customer names, emails, and addresses.
That's personal information under Australian privacy law. If it's breached, you're liable.
What counts as 'reasonable security measures'?
These will vary by insurer but may include multi-factor authentication (MFA) on all accounts, regular software updates, anti-virus software, regular backups (offline/offsite), staff training on phishing, strong password policies, and encrypted data storage.
If you ignore the basics, insurers may refuse claims.