Frequently Asked Questions About Cyber Insurance

Cyber insurance can cover contractually defined financial consequences of cyber incidents. Depending on the policy, this may include IT forensics, data recovery, business interruption, liability and crisis management; exclusions, sublimits and security requirements remain decisive. Learn more

That depends on your data, operational dependencies, available reserves and existing policies. According to the Swiss Insurance Association, 10.8% of Swiss companies had a cyber policy in 2024. First review the actual cover in your current liability and property policies, then compare suitable quotes. Review decision criteria

Possible modules include IT forensics, data recovery, business interruption, liability and crisis communications. Whether cyber fraud, extortion, legal advice or external service providers are included depends exclusively on the policy wording, sublimits, conditions and exclusions. Compare insurers

Business liability insurance is primarily intended for insured bodily injury, property damage and resulting financial losses. Cyber insurance addresses defined digital risks. Both policies must be checked to identify overlaps, exclusions and gaps.

A reliable premium is only available after underwriting and a formal quote. Factors include industry, revenue, data types, dependence on IT, loss history, security controls, coverage amount, sublimits and deductible. Understand cost factors

Depending on the product, insurers assess industry, revenue, data types, remote access, MFA, backup and patch processes, loss history, coverage amount and deductible. Weightings and acceptance criteria differ between insurers.

Effective controls such as MFA, tested backups, prompt patching and staff training can improve insurability and, depending on the insurer, the terms offered. There is no guaranteed discount; only an individual quote is binding. The damage calculator models incident costs, not an insurance premium.

Relevant threats include phishing, ransomware, online fraud, data exfiltration, DDoS and supply-chain attacks. The NCSC/BACS recorded 64,733 voluntary reports in 2025; the Federal Statistical Office recorded 57,761 digital offences, with phishing up 24.9% from 2024. These statistics measure different things. View threat landscape

Ransomware can encrypt or steal data and threaten publication. MFA, prompt updates, segmentation, protected and tested backups, and a rehearsed incident plan reduce risk. Whether cyber insurance covers specific costs depends on its wording, conditions and exclusions.

There is no complete count of attacked companies. For national context, the NCSC/BACS received 64,733 voluntary reports in 2025, while the Federal Statistical Office recorded 57,761 police-registered digital offences. Neither figure represents confirmed attacks on companies alone.

No comparable national ranking of attacks per industry is available. Exposure depends more on data types, internet-facing systems, business interruption and dependencies. Healthcare, retail, financial services and public administration each have different risk profiles that should be assessed individually. View industry risks

A medical practice should assess its exposure because it processes sensitive patient data and depends on clinical systems. Whether insurance is appropriate depends on its reserves, existing cover and the specific quote. A personal data breach may trigger reporting duties. Healthcare risks

Law firms process confidential client information and depend on available IT. They should assess security controls, incident response, professional secrecy and potential liability together. Cyber insurance can transfer part of the financial risk but does not replace security controls. Law firm risks

Several insurers offer cyber cover in Switzerland; availability, target groups and terms can change. A sound comparison therefore uses current, individual quotes rather than a generic ranking. Compare insurers

Compare insured events, exclusions, security obligations, waiting periods, sublimits, the business-interruption definition, response providers and deductibles. Derive the coverage amount and deductible from a realistic outage scenario rather than a generic minimum.

It depends on the incident and your organisation. Operators of critical infrastructure within the statutory scope must report certain cyberattacks to the NCSC/BACS within 24 hours since April 2025. Under Article 24 FADP, personal data breaches likely to create a high risk must be reported to the FDPIC as soon as possible. Reporting details

Consequences depend on the applicable duty, fault and procedure. Document the risk assessment and obtain legal advice early when uncertain. Insurance or incident-response providers can only assist if the policy or service agreement includes that support.

Immediate steps: 1) Activate the incident plan and isolate affected systems in a controlled way, 2) Contact IT forensics and, where relevant, the insurer, 3) Preserve evidence and document decisions, 4) Assess reporting duties, 5) Coordinate communications. Notify authorities or affected people when the relevant legal assessment requires it.

There is no general answer. Extortion cover may be excluded, limited or subject to prior consent and legal or sanctions checks. Do not pay independently; review the policy, official guidance and applicable law.

First identify critical systems and data, daily revenue, maximum tolerable downtime, existing policies and available reserves. Then request multiple quotes using the same coverage amount, deductible and sublimits so the premiums can be compared meaningfully. Prepare a quote

The deductible should match liquidity, potential loss and risk tolerance. A higher deductible may affect the premium but increases the amount retained by the business. Compare alternative deductibles in binding quotes.

The revised FADP has applied since September 2023 and requires risk-appropriate technical and organisational measures. Under Article 24 FADP, breaches likely to create a high risk must be reported to the FDPIC as soon as possible; there is no general 24- or 72-hour deadline.

Depending on its wording, a policy may include legal advice, forensics, notification or crisis management. Fines and regulatory proceedings are not automatically insured and may be excluded by law or contract. Check services, consent requirements and sublimits before an incident.

Cyberversicherung.ch is an information platform in partnership with BTAG Versicherungsbroker AG in Bern. BTAG is a FINMA-registered insurance broker. Get in touch. Contact us

An enquiry with BTAG is free and does not oblige you to buy. BTAG can compare current quotations and terms; which insurers can be approached depends on the risk. Any commission is disclosed before conclusion.