Property insurance for business premises has been built on physical damage for decades: fire, storm, water damage from pipes, burglary. Among today's risks, however, a physically "invisible" source of danger is taking on ever greater weight: an attack on, or a failure of, the IT system. Many business owners assume that if "we're insured", this is included in the package too – this article clarifies when that's true, and when it isn't.
- Traditional property insurance, built around named perils, does not in the basic case extend to cyber-originated events (a data breach, ransomware, a system outage) – these typically do not qualify as the physical damage named in the policy.
- An exception can arise if physical damage occurs as a consequence of the cyber event – but recognising and proving this is itself a complex question, handled differently from policy to policy.
- A separate product category exists for cyber risks, and its scope and terms are evolving quickly – it's worth treating this as a separate agenda item at the needs assessment, rather than assuming it's "included" in property insurance.
Why does it fall outside traditional cover?
Property insurance is built around named perils – fire, storm, water damage from pipes, burglary – or, in a narrower circle, on an "all risks" basis covering every physical event that isn't excluded: its essence is material damage occurring to the insured property. A cyber event typically doesn't cause loss this way: it brings data loss, a disruption to operations, extortion, or recovery costs, without physical damage to the server or the machine. This kind of loss simply doesn't appear as a named event in the language of a traditional policy – as the what it covers and what not article, and the exclusion map article, also show for other types of loss.
Sometimes the two worlds do meet
If a cyber event – for example, a fault in a control or process-management system – also causes physical damage (overheating, equipment damage), that moves closer to the normal territory of claim types, similar to what the electronic equipment article describes about internal failures. This doesn't mean, however, that every cyber-originated problem can automatically be filed under this – proof that an IT event genuinely caused the physical damage, together with the exact wording of the given policy, together decide what happens.
What does a cyber add-on typically cover?
Cyber covers available on the market typically target recovery costs, the expenses of handling a data breach (notification, experts, legal costs), business interruption arising from an IT cause, and, in some structures, liability towards third parties. The scope and the detailed terms vary considerably by insurer, and the field is developing quickly – which is precisely why it's not worth relying on a general description, and the current market offering needs to be checked against the company's profile instead.
Who does it pay to look into this?
It doesn't depend on whether the topic is "trendy", but on how much data the company handles, and how dependent day-to-day operations are on a continuously running IT system – a webshop, production control, customer records, a logistics system. Where this dependence is significant, once the traditional property basics are in order – without underinsurance, with correct sums insured – it's worth deliberately examining the cyber add-on too, within the same portfolio view the company uses to manage its other cover.
What's worth asking at the survey?
If the topic comes up at all, a few practical questions help decide how much weight it's worth giving it. What kind of, and how much, customer data or payment data does the company handle, and in what system is it stored? How long would a single IT outage hold up day-to-day operations – is the disruption measured in hours or in days? Is there any partner, banking or contractual expectation that specifically requires some form of cyber cover to be in place – in practice, an increasingly common stipulation in larger client contracts? And finally: what basic IT protection measures (backups, access management, updates) are already in place, because insurers typically ask about these during underwriting. Together, the answers determine whether the topic stays simple background reading, or becomes a stand-alone agenda item at the next survey.
Have a question specific to your premises? Book a free 20-minute site survey consultation →
