Cyber Insurance for Australian Businesses

Cyber insurance is designed to respond to the financial consequences of a cyber incident, which commonly includes a data breach, a ransomware attack, business email compromise or a system outage caused by malicious activity. Policies typically combine first party costs, such as incident response, IT forensics, data restoration and business interruption, with third party liability where others allege loss.

Annex Risk Advisory is a Perth commercial insurance brokerage. As a cyber insurance broker, we help businesses understand where their exposure sits, review the sections, sub-limits and wordings they currently hold, and explore options from a range of insurance markets. We act on the insurance and risk side rather than the technical one.

Cyber is among the least standardised classes in the market. What counts as an incident, whether social engineering and funds transfer fraud are included, how business interruption is triggered and measured, what waiting period applies, and whether regulatory response costs are covered all vary between insurers.

Insurers also ask about controls before offering terms. Multi-factor authentication, offline backups and patching frequently affect both what is available and what it costs.

Reading a wording against how a business actually operates, and what it actually holds, is where broker involvement tends to be most useful.

Cyber exposure exists wherever a business holds data, depends on systems, or moves money electronically. That includes technology and software businesses handling client data, professional services firms holding client records and trust account details, transport and logistics operators running scheduling and tracking systems, manufacturers with connected production equipment, and any business that pays supplier invoices on the strength of an email.

Businesses often assume the exposure tracks their size. It does not. Business email compromise and ransomware are largely opportunistic and volume driven, and smaller operators are frequently targeted precisely because their controls are lighter.

Australian regulatory obligations matter here as well. Businesses covered by the Privacy Act carry notifiable data breach obligations where a breach is likely to result in serious harm, and working through that process carries cost whether or not a claim is ultimately made.

Supply chain matters too. Where a business depends on a managed service provider, a booking platform or a hosted accounting system, an outage at that provider can stop trading without anything happening on the business’s own network. How dependent systems are treated varies between wordings.

Contracts increasingly require it. Client agreements, supplier onboarding, government tenders and larger head contracts now commonly specify a minimum cyber limit, and sometimes require particular parties to be noted. Limits of $1 million, $2 million, $5 million and $10 million are common in the Australian market.

Where a contract sets those requirements, the policy needs to be read against the agreement rather than assumed to comply.

Annex takes a risk-first approach. Before approaching any insurer, we work to understand what data the business holds, which systems it depends on to trade, how payments and supplier invoices are authorised, what controls are already in place, and what its contracts require.

That analysis carries more weight on this class than most, because insurers assess and price against controls. Multi-factor authentication, offline backups, patching and staff training often determine what terms are available at all.

From there we assist with insurance program design and placement, comparing options across a range of insurance markets and looking at what triggers cover, whether social engineering and funds transfer fraud are included and at what sub-limit, how business interruption is measured, what waiting period applies and how incident response is accessed, alongside premium.

We can also review the insurance obligations in client agreements, supplier contracts and tender documents to consider whether existing cyber insurance aligns with them.

If an incident occurs, claims management and advocacy is part of the service. Most cyber policies operate through an insurer appointed incident response panel, and notifying early matters, because engaging an unapproved provider first can affect how the policy responds.

We are insurance and risk advisers rather than IT security providers, and we do not carry out security audits, penetration testing or technical remediation.

Both directors are active practitioners, so clients deal directly with senior brokers rather than a rotating account team. Cover is subject to insurer approval, policy terms, conditions and exclusions. Annex Risk Advisory is a signatory to the NIBA Insurance Brokers Code of Practice, and our Financial Services Guide and Terms of Engagement are available online.