A cyber attack can happen to a business of almost any size. A phishing email can compromise an employee’s account, ransomware can lock critical files, or criminals can steal customer information from a digital system. The financial consequences can extend well beyond the cost of restoring a computer.

What insurance covers cyber attacks? For businesses exposed to digital risks, the relevant solution is generally cyber insurance, sometimes called cyber liability insurance. Depending on the policy, it can help address certain first-party losses and third-party liabilities arising from covered cyber incidents.

For Kenyan businesses, the issue is particularly relevant as more organisations rely on digital payments, cloud services, online customer platforms and electronic records. Kenya’s National Cybersecurity Strategy recognises the growing cybersecurity risks associated with increased digital adoption and identifies cybersecurity as an important component of the country’s digital economy.

However, insurance is only one layer of protection. Strong passwords, multi-factor authentication, secure backups, staff awareness and an effective incident-response plan remain essential.

What insurance covers cyber attacks? Understanding cyber insurance

Cyber insurance is designed to address financial risks associated with specified cyber events. The exact protection varies significantly between insurers and policies, so businesses should examine the wording carefully before purchasing cover.

Depending on the policy, protection may include certain costs associated with:

• Data breaches
• Cyber extortion and ransomware
• Business interruption
• Data restoration
• Incident response
• Cyber-related liability claims
• Notification and communication expenses
• Legal and forensic services
• Certain regulatory or defence expenses, where legally insurable

Not every policy includes all these benefits. Some may be available as extensions, while others may have separate limits, waiting periods, deductibles or exclusions.

Why ordinary business insurance may not be enough

Traditional property or business insurance can protect physical assets against specified risks, but cyber incidents create a different type of exposure.

For example, a fire could damage a shop’s computers and furniture. A cyber attack, by contrast, could leave the equipment physically intact while making the business’s data inaccessible.

Similarly, a standard liability policy may not automatically provide the specialised incident-response services or cyber-related protection a business needs after a data breach.

Therefore, businesses that depend heavily on digital systems should discuss cyber risks separately with their insurance adviser.

What cyber risks should Kenyan businesses consider?

Cyber threats take many forms. Understanding the most common exposures can help business owners decide what protection and security controls they need.

Ransomware

Ransomware can prevent an organisation from accessing systems or data until criminals demand payment. Even if a business has backups, restoring systems can take time and may interrupt operations.

A cyber policy may provide cover for certain losses arising from a ransomware incident, subject to the policy wording and applicable law. Some policies can also provide access to specialist incident-response services.

Phishing and social engineering

An employee may receive a convincing message that appears to come from a manager, supplier or financial institution. If the employee follows fraudulent instructions, the business could suffer a financial loss or compromise an account.

Whether a particular fraudulent-transfer loss is covered depends heavily on the wording of the policy. Businesses should therefore ask specifically about social engineering, phishing and fraudulent instruction risks rather than assuming they are automatically included.

Data breaches

A business that stores customer, employee or supplier information may face consequences if personal data is accessed without authorisation.

Kenya’s Office of the Data Protection Commissioner (ODPC) oversees data protection compliance under the Data Protection Act. The ODPC provides a formal process for controllers and processors to report personal data breaches.

Businesses should therefore consider both their insurance arrangements and their obligations under Kenya’s data protection framework.

Business interruption

A cyber incident can stop a business from accepting orders, processing payments, accessing systems or delivering services.

Depending on the policy, cyber business-interruption cover may respond to certain income losses or additional expenses following an insured cyber event. The policy will normally define the circumstances in which an interruption qualifies and how the loss is calculated.

What can cyber insurance potentially cover?

The following table provides a useful starting point, but actual cover depends on the policy purchased.

The purpose of this table is to show the types of protection that may be available, not to suggest that every cyber policy automatically includes each item.

How much cyber insurance does a business need?

There is no universal amount that suits every Kenyan business.

A small consultancy that stores client information may have different exposures from an e-commerce company processing thousands of transactions. Likewise, a healthcare organisation can face particularly sensitive data-related risks.

When assessing your needs, consider:

• Annual revenue
• Number of employees
• Amount and type of data stored
• Dependence on IT systems
• Online sales and payment systems
• Cloud service usage
• Third-party technology providers
• Potential business interruption period
• Regulatory and contractual obligations
• Cost of restoring systems and data

A useful exercise is to estimate the financial effect of being unable to access your core systems for one day, one week or longer. This can help demonstrate why business interruption protection and adequate limits matter.

What should you check before buying cyber insurance?

Cyber insurance works best when the business understands both the benefits and the conditions attached to them.

Review the exclusions

Ask what the policy does not cover. Common exclusions or restrictions may relate to circumstances such as known vulnerabilities, inadequate security controls, intentional acts, certain infrastructure failures or events outside the policy’s definition of a cyber incident.

The exact exclusions differ between policies.

Check security requirements

Some policies require businesses to maintain specific cybersecurity controls. These may include:

• Multi-factor authentication
• Regular backups
• Endpoint protection
• Access controls
• Security updates
• Employee awareness training
• Incident-response procedures

If a policy requires particular controls, ensure your business can actually maintain them.

Understand the deductible

A deductible, also called an excess, is the amount the insured may need to bear before the insurer responds to a covered loss.

Compare the deductible with the potential size of the loss. A policy with a lower premium but a substantially higher deductible may produce a different financial outcome during a claim.

Examine sub-limits

A policy may have a headline limit but smaller limits for specific expenses. For instance, particular incident-response, notification or cyber-extortion costs may have their own sub-limits.

Read these carefully rather than focusing only on the overall sum insured.

What should you do after a cyber incident?

The first priority is to contain the incident and protect affected systems. Businesses should have an incident-response plan before anything goes wrong.

After discovering a suspected attack:

1. Activate your incident-response process.
2. Secure affected systems without unnecessarily destroying evidence.
3. Contact your IT or cybersecurity specialists.
4. Notify your insurer or insurance adviser promptly, following the policy’s claims procedure.
5. Document what happened, including relevant dates, systems and actions taken.
6. Seek legal and regulatory advice where appropriate.
7. Assess whether personal data was affected.

The last point is particularly important in Kenya. The ODPC’s breach-reporting system asks organisations to provide details about the breach, affected data subjects and remedial measures. Its reporting process also specifically asks whether a breach was reported after 72 hours of discovery.

Accordingly, businesses should understand their data-protection responsibilities before an incident occurs.

Cyber insurance should complement cybersecurity

Insurance cannot prevent hackers from entering a network. It is a financial risk-management tool, not a substitute for cybersecurity.

Kenya’s national cybersecurity strategy emphasises coordinated cybersecurity governance, investment in capability and capacity, and the need for a secure and resilient digital environment.

Businesses should therefore combine insurance with practical security measures such as:

• Use multi-factor authentication.
• Keep software and operating systems updated.
• Back up critical data regularly.
• Test whether backups can actually be restored.
• Limit administrative access.
• Train employees to identify phishing attempts.
• Use reputable endpoint and network security tools.
• Create an incident-response plan.
• Review suppliers that handle sensitive data.
• Conduct periodic cybersecurity risk assessments.

These measures can reduce the likelihood and impact of an incident, while insurance can provide another layer of financial protection where a covered event occurs.

Why professional insurance advice matters

Cyber risk is different from conventional property risk because a single incident can create technical, financial, legal and reputational consequences at the same time.

Up and Go Insurance Agency can help businesses consider their insurance needs across motor, medical, travel, life, business, home and personal accident insurance. For businesses adopting more digital systems, discussing cyber-related exposures as part of a wider business insurance review can help identify areas that may require specialist protection.

When discussing cyber insurance, provide accurate information about your systems, data, revenue, security controls and previous incidents. That information helps an insurance adviser understand your risk profile and identify suitable options.

Kenyan businesses should also use licensed insurance providers and intermediaries. The Insurance Regulatory Authority regulates, supervises and develops Kenya’s insurance industry.

Key takeaways

• Cyber attacks can create both direct financial losses and third-party liabilities.
• Cyber insurance can provide specialised protection for certain covered cyber risks.
• Coverage varies considerably between policies, so don’t assume every cyber risk is insured.
• Data breaches can create obligations under Kenya’s data protection framework.
• Business interruption can be an important consideration for digitally dependent organisations.
• Review exclusions, sub-limits, deductibles and cybersecurity conditions before purchasing cover.
• Maintain strong cybersecurity controls alongside insurance.
• Notify your insurer promptly after a suspected covered incident.
• Review your cyber exposure regularly as your business and technology change.

Frequently asked questions

1. Does cyber insurance cover ransomware?

Some cyber insurance policies can cover specified ransomware-related expenses or losses, subject to the policy wording, applicable law, limits and exclusions. Ask specifically about cyber-extortion and ransomware when comparing cover.

2. Does cyber insurance cover a data breach?

Potentially. Depending on the policy, it may cover certain incident-response, forensic, legal, notification and liability-related expenses. The definition of a covered data breach is important.

3. Is cyber insurance mandatory in Kenya?

Cyber insurance is not generally a universal statutory requirement for every Kenyan business. However, businesses can have legal and regulatory obligations relating to cybersecurity and personal data protection. The appropriate insurance decision depends on the organisation’s risks and contractual requirements.

4. Does cyber insurance cover money stolen through phishing?

It depends on the policy. Some policies may address certain social-engineering or fraudulent-instruction losses, while others may exclude them or require a specific extension. Always ask the insurer to explain this exposure clearly.

5. Will cyber insurance pay for business interruption?

Some policies provide business-interruption protection for specified cyber events. Check the waiting period, indemnity period, calculation method, sub-limit and qualifying triggers.

6. Can a small business benefit from cyber insurance?

Yes. Small businesses can still hold valuable customer information, rely on online systems and experience significant disruption after an attack. The appropriate level of cover should reflect the business’s actual exposure.

7. Does having cyber insurance mean my business does not need cybersecurity?

No. Insurance and cybersecurity serve different purposes. Good security controls can reduce the likelihood and severity of an attack, while insurance can provide financial protection for certain covered losses.

Conclusion

What insurance covers cyber attacks? For businesses exposed to digital threats, cyber insurance is the specialised form of protection to investigate. Depending on the policy, it may address certain costs associated with data breaches, ransomware, business interruption, data restoration, incident response and cyber-related liability.

However, the right approach is broader than buying a policy. Kenyan businesses should strengthen cybersecurity controls, understand their data-protection responsibilities and carefully review policy exclusions, limits and conditions.

As your business grows more dependent on digital systems, your insurance strategy should evolve with it. Up and Go Insurance Agency can help you review your wider protection needs across business, motor, medical, travel, life, home and personal accident insurance.

Take the next step in protecting your business. Contact Up and Go Insurance Agency for expert insurance advice and personalized quotes at info@upandgoinsurance.com, +254741133544 or 0141778121.