What does cyber insurance cover for businesses?
limited Core covered, edges open
Cyber insurance for businesses is made up of 17 modules: 4 are almost always included, 11 vary by insurer and 2 are almost always missing. For each module we show what the 9 business products we read pay, with sublimit and source.
As of
17 modules on three shelves
Sorted over the 5 business policies with public terms: AXA, Sunrise (AXA), Mobiliar, Zurich, Helvetia.
Almost always included4
- Immediate help in an emergency
- Restore data and systems
- Third-party claims after a data breach
- Inform affected people
Covered in at least 4 of 5 policies.
What these modules pay
- Immediate help in an emergency
- Hotline, IT forensics, crisis PR and legal advice. Of 9 business products read: 7 covered, 2 unclear.
- Restore data and systems
- Costs of getting data, software and systems running again. Of 9 business products read: 5 covered, 1 limited, 2 unclear, 1 no information.
- Third-party claims after a data breach
- Liability for data protection and network security breaches. Of 9 business products read: 6 covered, 1 limited, 2 unclear.
- Inform affected people
- Letters, call centre, credit monitoring. Of 9 business products read: 6 covered, 1 unclear, 2 no information.
Varies by insurer11
- Replace unusable devices
- Loss of income after an attack
- Outage at the IT provider
- Outage due to operating error
- Cyber extortion
- Proceedings before authorities
- Fraud with fake instructions
- Hacked e-banking
- Phone hacking and extra costs
- Card industry penalties
- Media liability
Sometimes covered, sometimes only as an add-on, sometimes limited.
What these modules pay
- Replace unusable devices
- Hardware that no longer starts after the attack. Of 9 business products read: 1 add-on, 4 limited, 4 no information.
- Loss of income after an attack
- Business interruption, only after the waiting period. Of 9 business products read: 3 covered, 3 add-on, 1 limited, 2 unclear.
- Outage at the IT provider
- Loss of income if the cloud or a provider is attacked. Of 9 business products read: 1 add-on, 5 limited, 3 no information.
- Outage due to operating error
- Loss of income without an attack, e.g. after a mistake by your own IT. Of 9 business products read: 2 add-on, 2 limited, 2 not covered, 3 no information.
- Cyber extortion
- Help and negotiation; only some insurers pay the ransom, see note. Of 9 business products read: 1 covered, 3 add-on, 2 limited, 1 not covered, 2 unclear.
- Proceedings before authorities
- Costs of FDPIC or GDPR proceedings, usually not fines. Of 9 business products read: 1 covered, 5 limited, 1 unclear, 2 no information.
- Fraud with fake instructions
- CEO fraud, diverted payment, fake invoice. Of 9 business products read: 4 add-on, 1 limited, 4 no information.
- Hacked e-banking
- A hacker triggers payments from e-banking. Of 9 business products read: 4 add-on, 1 limited, 1 not covered, 3 no information.
- Phone hacking and extra costs
- Expensive calls, cryptojacking, misused computing power. Of 9 business products read: 1 covered, 3 add-on, 1 limited, 4 no information.
- Card industry penalties
- Contractual penalties under PCI DSS for card payments. Of 9 business products read: 2 covered, 1 add-on, 1 limited, 2 not covered, 1 unclear, 2 no information.
- Media liability
- Copyright, trademark and personality rights online. Of 9 business products read: 2 covered, 4 limited, 3 no information.
Almost never included2
Not covered or not addressed in at least 4 of 5 policies.
What these modules pay
- Property damage caused by an attack
- Spoiled goods, damaged machine. Of 9 business products read: 6 not covered, 3 no information.
- Reputational damage
- Loss of income because customers stay away after the incident. Of 9 business products read: 1 add-on, 1 not covered, 1 unclear, 6 no information.
All modules per insurer compared
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.