VZ/HSLU study: eight cyber insurers rated, with big differences in policy wordings

In short: Cyber insurance policies look similar at first glance but differ considerably in their general terms and conditions (GTC). That is the finding of the study “Cyberrisiken für KMU” (Cyber risks for SMEs) by VZ VermögensZentrum and Lucerne University of Applied Sciences and Arts (HSLU), published in October 2026, which rates eight insurers in three areas. There is deliberately no overall ranking: different insurers lead in different areas.

Key facts

• Study: VZ VermögensZentrum and HSLU, “Cyberrisiken für KMU” (October 2026), published on the Swiss Confederation’s SME portal
• Rating: 8 insurers, 3 areas, maximum 100 points each; only benefits included as standard under the GTC valid as of 1 June 2026 were assessed
• Range: contract conditions 57 to 86 points, first-party cyber losses 40 to 83, cyber liability 84 to 100
• Market (SIA figures): gross premiums in the corporate segment rose to CHF 153 million in 2025, up on CHF 71 million in 2021; corporate policies rose to 72,000, up on 38,000; only around 11.5 per cent of companies are insured
• Survey of 515 small businesses: only 42 per cent consider their protection adequate; only around 30 per cent have an IT security concept, an emergency plan or regular training

The VZ rating at a glance

Points per area (max. 100), in alphabetical order. Source: VZ VermögensZentrum analysis. Optional modules and individual agreements were not rated.

Contract conditions cover territorial and temporal scope, extended reporting period, cancellation after a claim and policyholder obligations. Liberty (86) leads ahead of Chubb (78). First-party cyber losses cover data and system restoration, business interruption, immediate measures, IT forensics, cyber theft, social engineering and cyber extortion; Zurich scores 83 points, Mobiliar 40. In cyber liability, all insurers score 84 to 100 points.

VZ stresses that the points system makes comparison easier but does not replace an individual risk analysis.

What policies often exclude

The study lists typical exclusions: the economic value of lost data itself, often fines and contractual penalties, and frequently war and state cyber operations, intent and sanctions clauses. Ransom payments are insured, excluded or only covered through an optional module depending on the insurer, often subject to prior consent and a sublimit. None of the GTC analysed explicitly excludes AI-related losses, but AI is generally not explicitly named as an insured risk either.

VZ names industry, revenue and headcount, IT security level, deductible, sum insured and product design as premium factors.

Fictional model case: AlpPrecision AG

To illustrate, the study describes the fictional company AlpPrecision AG, a manufacturer with 160 employees. In the model case, an attacker uses a stolen password to access an internal AI assistant, manipulates CNC parameters and extorts the company. The modelled total loss is CHF 3.28 million, including CHF 960,000 for eight days of production downtime and CHF 780,000 for recalling and replacing parts. It is a constructed example, not a real case.

What this means for Swiss SMEs

1. Compare wordings, not brochures: check temporal scope, extended reporting period, obligations and business interruption in particular. Our cyber insurance comparison shows what matters.
2. Put the premium in context: Cyber insurance costs explains what drives the premium and why only an individual quote is binding.
3. Negotiate optional modules actively: get social engineering, extortion and AI-related scenarios clarified in writing.
4. Implement basic protection: according to VZ, a demonstrably high security level (MFA, patching, backups, training) has a positive effect on the premium, while gaps can increase it or lead to rejection. Start with the cyber risk check; see reporting obligations and Cyber insurance for SMEs.

Sources

• VZ VermögensZentrum / HSLU: Cyberrisiken für KMU, October 2026 (PDF in German, Swiss SME portal)