Cyber insurance is not cyber security. You need both.
One reduces the chance of an incident. The other funds what happens when it occurs anyway.
Firewalls, endpoint protection, backups and training reduce the likelihood of a breach. None of them pays the forensic bill, the legal notification cost or the income lost during two weeks of downtime.
Where the money actually goes after an incident
- Forensic investigation to establish what was accessed
- Legal advice on notification obligations
- Notifying affected people and handling their queries
- Restoring systems and data from backups
- Lost income during the outage
- Third party claims from customers and partners
- Regulatory investigation costs
What insurers now expect before they quote
Underwriting has tightened. Expect questions on multi-factor authentication, backup frequency and whether backups are offline, patch cadence, privileged access control and staff training. Weak answers mean a higher premium, a sub-limit, or a declined risk.
The overlap that works
Good controls lower the premium and improve the terms; the policy funds the response that controls cannot prevent. Businesses that treat them as alternatives end up with neither working when it matters.
Under Indian data protection law, obligations follow personal data you hold. That obligation does not scale down because the company is small.