Short answer
Cyber insurance can make sense if an IT outage, a data incident or a digital liability claim could overwhelm the company’s own financial and organisational reserves. It makes less sense if a company is mainly looking for insurance to replace basic security work. A policy does not prevent an attack and only covers the events and costs defined in the contract.
The decision should therefore not start with a general probability of loss, but with four questions:
- What must be available immediately after an incident? This includes forensics, legal advice, crisis communication and recovery.
- What outage can the company absorb itself? Liquidity, tolerable downtime and internal specialist resources are what count.
- Which risks are already insured? Liability, property, fidelity or electronic equipment policies may include or exclude certain areas.
- What would the specific cyber policy actually provide? The wording, triggers, limits, sublimits, deductible, waiting period and exclusions are decisive.
Pointers from Swiss data
The 2024 Swiss SME cyber study surveyed 515 companies. 25% had a security concept, 32% ran regular training and 33% had an incident plan. According to the Swiss Insurance Association, around 72,000 companies were insured against cyber risks in 2025, about 11.5% of companies domiciled in Switzerland; premiums in the business segment amounted to CHF 153 million (SIA, 3 September 2026). In the VZ/HSLU study «Cyberrisiken für KMU» (October 2026), only 42% of 515 surveyed small companies considered their protection adequate.
These figures describe a sample and a market. They neither prove that every SME needs a policy nor provide a probability of occurrence for any individual business.
When a policy is particularly worth considering
- core business processes come to a halt without IT, the cloud or a single service provider;
- the company processes sensitive personal, health, financial or professional-secrecy data;
- an incident could trigger claims from customers or other third parties;
- internal forensic, legal or crisis resources are lacking;
- a prolonged recovery would put significant strain on liquidity;
- customers or supervisory rules require certain safeguards or response capabilities.
These are indicators for assessment, not an automatic recommendation to buy.
When other work needs to come first
Before comparing insurance, companies should address known, significant weaknesses. These include in particular missing multi-factor authentication for critical access, untested backups, unclear administrator rights and an incident plan that has never been rehearsed. Such gaps do not only increase the risk; they can also affect acceptance, terms or benefits in the event of a claim.
Separating prevention and insurance properly
Your own prevention reduces the likelihood and impact of an incident. Insurance transfers a contractually limited share of the financial consequences and, depending on the product, organises external assistance. A sensible solution combines both:
| Own prevention | Possible insurance benefit, if agreed |
|---|---|
| MFA, updates and limited rights | coordination of external incident response |
| separate and tested backups | insured recovery costs |
| incident plan and exercises | crisis advice and communication |
| secure payment approvals | protection against cyber fraud only if expressly included |
| supplier controls | cover for external service providers only as defined in the contract |
How to make a sound decision
- Quantify tolerable downtime and available own funds.
- Check existing policies for overlaps and gaps.
- Define the benefits you want before requesting a quotation.
- Give all insurers you approach the same risk information.
- Compare not only premiums, but also definitions, sublimits, deductibles, waiting periods and security obligations.
- Document which residual risks you deliberately retain.
An individual quotation is only meaningful once these fundamentals have been clarified.