On the map of business insurance, the “operations” compass point was for a long time about fire, machinery breakdown and business interruption. Today, a small business's operations are threatened at least as much by an opened attachment, a password-stealing phishing email or an invoice with altered bank account details. Hungary's National Cyber Security Institute (Nemzeti Kiberbiztonsági Intézet) regularly issues warnings about Hungarian-language phishing and fraudulent emails and about business email compromise (BEC) fraud – and these target not large corporations but businesses where a single email is what decides things between the accountant, the managing director and the bank. As a broker, I see that most SMEs have not yet placed this risk anywhere: property insurance does not deal with it, liability insurance typically excludes data protection losses, and business interruption cover is tied to physical damage. This article is an overview of cyber insurance: what it is, what it covers, what it does not, and who should request a quote at all.
- Cyber insurance works in two directions: it covers the company's own loss (incident response, data and system restoration, business interruption, extortion) and loss caused to third parties (data protection liability, the costs of regulatory proceedings).
- One of the most common sources of loss for SMEs – transfer fraud using swapped invoices – is the most sensitive point: some Hungarian policy conditions exclude it, while others cover it in a separate module with a lower limit, so this line is worth checking separately.
- Before the policy is taken out, the insurer asks for a completed IT security questionnaire, and the policy conditions typically stipulate basic measures (backups, updates, access management); if these are missing, payment of a claim may be called into question.
What does cyber insurance protect against?
Based on a study published in Biztosítás és Kockázat (Insurance and Risk), the journal of MABISZ (the Hungarian insurers' association), and on insurers' product descriptions, Hungarian products are built from two main areas of cover. The first is the company's own loss: initial expert assistance after an incident (IT forensics, legal counsel, communications), the cost of restoring destroyed or encrypted data and systems, loss of revenue and additional costs caused by downtime (cyber business interruption), and costs connected with a ransomware attack. The second is loss caused to third parties: if personal data of customers or partners leaks, the compensation and restitution for non-pecuniary harm (sérelemdíj) owed to them, the cost of notifying those affected, legal costs arising in regulatory proceedings – and, under some policy conditions, any fine imposed, where the law allows it to be insured. This dual structure matters: most SMEs think only of the first, although for a webshop or an accounting firm the second is the larger item.
The common denominator here is the same as for any insurance: the insurer pays only for what is an insured event under your contract. Cyber insurance policy conditions differ significantly from insurer to insurer – the same word (“business interruption”, “data loss”) can mean different things, with a different deductible, a different limit and a different waiting period. On the SME insurance map, cyber cover is a separate line under the operations compass point, not an extension of your existing policies.
Transfer fraud: the sensitive point
One of the most common actual losses for SMEs is not a hacked server but money transferred away: an invoice arriving in a supplier's name with altered bank account details, an “urgent transfer” request impersonating the managing director, hijacked email correspondence. In legal terms this is not a break-in into the system but deception – the company's own employee initiates the transfer. For exactly this reason, some cyber policies exclude this loss or cover it only under a separate clause, with a sublimit well below the main limit (in the policy conditions, look for it under names such as “social engineering”, “átutalási csalás” (transfer fraud) or “cyber crime”). If your company regularly pays suppliers by bank transfer, this single line counts for more in the decision than the rest of the coverage table put together – and if it is missing, you need to know that before you sign a policy. It is also worth clarifying the process with your bank, because a bank typically does not refund a transfer approved by the customer.
What does the insurer expect of you?
The underwriting of a cyber risk starts with a questionnaire: whether there is a regular backup kept separate from the network, whether multi-factor authentication is used for email and remote access, whether systems are kept up to date, who holds the rights to initiate transfers, and whether employees have received training. Using one Hungarian insurer's product as an example, the study published in the MABISZ journal in 2019 shows that conditions such as password management and access control, the professional configuration of firewalls, and the continuous updating of antivirus software and operating systems are written into the contract – and that the use of self-developed or unlicensed software can be a ground for exclusion. The practical consequence cuts both ways. On the one hand, your answers to the questionnaire fall under the duty of disclosure: anything that is not true when the policy is taken out can come back to haunt you when you make a claim. On the other hand, failure to implement a measure stipulated in the policy conditions can – in a structure that differs from insurer to insurer – lead to an exclusion or to the exemption of the insurer (the insurer being released from paying); in the latter case the burden of proof lies with the insurer, but the simpler way to avoid a dispute is for the company to actually operate the minimum it committed to when the policy was taken out. For many SMEs, working through the questionnaire is more useful in itself than the policy: it shows what is missing.
Who is it for – and what does it not replace?
Cyber insurance is not the first insurance task for every SME. It is strongly justified where operations depend on data and on systems being available: webshops and online service providers, accounting and law firms, design offices, medical practices, software developers, any company that handles partners' personal or business data, and any manufacturing or logistics company where a system outage stops deliveries for days. For a one-person business that works on paper, the same cover may be unnecessary – this is a decision to make using the logic of gap hunting, not out of fear. There are two things cyber insurance does not replace: real IT security (backups, updates, training – without these the policy is not worth much either) and legal compliance. Data protection rules (GDPR) apply to every company, while Hungary's cyber security legislation transposing the NIS2 Directive (Act LXIX of 2024 on the Cybersecurity of Hungary) imposes compulsory security measures on certain medium-sized and larger companies, depending on their activity and size; whether your company falls under it is something to clarify with a lawyer or an IT expert, not to read out of an insurance quote.
How does it fit into your portfolio?
Three existing policies are worth placing alongside the cyber quote. Under Hungarian policy conditions, property insurance for your premises typically covers only physical damage, not the loss of electronic data – or only as narrow supplementary cover. General and professional liability insurance often excludes data protection and network losses – though not in every case, so there may be overlap here too. And business interruption cover is triggered by physical damage (fire, machinery breakdown), not by a cyber attack. In the article on insurance questions for webshops, I showed these three boundaries with concrete examples. Cyber insurance is a good decision if it answers these real gaps – and does not duplicate what you already have.
What should you do now?
Write down which data and systems your company's operations depend on, and how many days it could manage without them. Check your existing policies to see whether electronic data, data protection losses and network outages are excluded. Ask your IT provider where backups, updates and multi-factor authentication stand today – the questionnaire will ask about this anyway. If you request quotes, compare the transfer fraud line, the limits, the deductible and the waiting period across the quotes, not just the premium. If you contact me with this list, I prepare the comparison of the quotes and summarise the essentials of the policy conditions in plain language – the decision, as ever, is yours.
Have a question about your own company's data and processes? Book a free 20-minute consultation →
Sources
- National Cyber Security Institute (Nemzeti Kiberbiztonsági Intézet) – warnings about fraud and phishing
- National Cyber Security Institute (Nemzeti Kiberbiztonsági Intézet) – BEC attacks (business email compromise)
- MABISZ (Hungarian insurers' association) – Biztosítás és Kockázat (Insurance and Risk), Vol. VI, No. 3: The insurability of cyber risk at company level (2019)
- Colonnade Biztosító – What is cyber insurance? Covers and risks (insurer's product description)
- Act LXIX of 2024 on the Cybersecurity of Hungary – Hungarian transposition of the NIS2 Directive (from 1 January 2025)
