You don't need to be a target. You just need an inbox.

• Funds lost to a scam such as a fake invoice or redirected payment, where the policy allows it.
• IT forensic investigation to work out what happened and shut the door behind it.
• Data recovery and getting your systems and website working again.
• Loss of income while your business can't trade normally because your systems are down.
• Ransom negotiation and payment where the policy provides it, and the costs of dealing with an extortion demand.
• The cost of notifying customers if their data was exposed, and setting up a call centre or credit monitoring if the breach is big enough to need it.
• A customer or client suing you because their personal or financial information was exposed on your systems.
• The cost of defending a regulatory investigation, for example from the Office of the Australian Information Commissioner, if a data breach is reported.
• Claims from a business partner whose systems were compromised through yours (a supply-chain claim).
• Costs if content on your website or social media is alleged to infringe copyright or defame someone, where that section is included.

The mix of sections you actually need depends on what your business holds and does online. A tradie with a booking app and a supplier's bank details needs a very different shape of policy to a business holding thousands of customer records. Most of the small and medium businesses we place cyber cover for land on somewhere between $500,000 and $1 million of cover once the premium is weighed against the risk, shaped around the sections that actually matter to them rather than a generic limit, on our own placements as at July 2026.

Losses to business email compromise reached $152.6 million across Australia in 2024, up 66% on the year before (National Anti-Scam Centre, Targeting Scams Report 2024), and it works precisely because everything about the email looks right: the logo, the invoice number, the tone.

The second risk is one most business owners never see coming, and it isn't your security setup, it's the form you fill out to buy the policy. Insurers still ask about things like multi-factor authentication and tested backups, the basic controls the Australian Cyber Security Centre's Essential Eight framework recommends every business have in place. But we've checked the actual policies we place, clause by clause, and here's what we found: none of them cancel your cover because those controls turn out to be less than perfect.

What can go wrong is the application itself. When you answer a question about your security, that answer is treated as a promise, not a guess, and if the true answer was different, an insurer can use that gap to challenge your claim later, even on a part of the loss that had nothing to do with the gap.

Most business owners genuinely don't know what's backed up, what's tested, or what "multi-factor" even covers across every system they use, so answering confidently isn't the same as answering correctly. That's exactly why we place cyber cover with insurers whose application is written so you can answer it honestly, without guessing at your own IT setup, rather than one that asks a string of detailed technical questions and hopes you get every one right.

The scam itself keeps evolving too, from a straight fake invoice to a cloned voice or a deepfaked video call pretending to be someone you trust. Current cyber policies are already being written to keep pace: on at least one of the wordings we place, a loss caused by this kind of AI-enabled deception is covered on the same terms as any other cyber event, rather than sitting outside the wording as some exotic new risk.

We've educated our brokers to place cyber cover with an insurer whose question set your business can answer honestly, all the way through, rather than one whose questions are so specific that an honest "I'm not sure" ends up looking like a wrong "yes."

A lot of cyber cover gets bought in ten minutes online, where a form asks yes/no questions about your security and nobody checks the answers against what's actually true in your business.

On some of the cyber policies we place, a redirected-payment claim is not paid if nobody in your business independently checked the request to change the bank account, or checked that the payment instructions were genuine, before the money went out. Most of the cyber policies we place that include scam-payment cover do not ask for that. Yours might.

Where yours carries it, skipping that step can get that part of a claim declined, however convincing the scam was. Ask us what your own policy needs from you, while there is time to put it in place. Write that check down as a procedure either way: it is worth real money at quote stage, which we break down in how much cyber insurance costs.

We also don't sell cyber cover as an afterthought bundled onto a business pack without checking whether the limits and sections actually match what you hold. A cafe taking card payments and a bookkeeping firm holding years of client financial records are not the same risk, even if they're both "small business," and a one-size policy treats them as if they were.

On some of the covers we place, the full limit is available again for a second, unrelated incident in the same year, rather than one annual pot that empties and stays empty. If you have a bad year, that difference is the whole claim.

Cyber is one of the newer covers we place, and like most brokers, we haven't yet had a client's cyber claim tested end to end. That's not a gap in what we know, it's exactly why the work happens at the application, before anything goes wrong, rather than after: you can't lean on years of watching a policy pay out, so getting the placement right the first time is what actually protects you.

Australia's Notifiable Data Breaches scheme, part of the Privacy Act 1988 (Cth), currently only applies to businesses with annual turnover over $3 million, plus specific categories regardless of size (health service providers, credit reporting bodies, businesses that trade in personal information, and a few others). Government has agreed in principle to remove that small business exemption, but it isn't law yet. The net is tightening at the edges, though: since 1 July 2026, the anti-money-laundering rules have brought accountants, lawyers, conveyancers and real estate agents under the Privacy Act for the client information they handle under those rules, whatever their turnover.

Outside those groups, many small businesses genuinely sit outside the mandatory reporting regime today. That doesn't mean you're safe from the fallout. A customer whose card details were used fraudulently after buying from you doesn't care whether the Privacy Act technically applied to your turnover, they care that it happened. Contracts with bigger clients increasingly require you to hold cyber cover as a condition of doing business with them, whether or not the law requires it.

"We're too small to matter." This is the mistake underneath all the others. Small businesses aren't targeted individually, they're caught by automated scams sent at scale, which makes size irrelevant to whether you get hit.

Answering the application wrong without ever meaning to. This is not about dishonesty. Business owners get a cyber proposal full of IT jargon and answer it the way anyone would: you assume your IT provider is doing the backups, and if there's an authenticator app on your phone, multi-factor authentication must be running everywhere. Often neither is true, and you'd have no way of knowing.

In a widely reported US case, an insurer sought to void an entire cyber policy after a ransomware claim showed multi-factor authentication was only switched on for part of the business's systems, despite the application stating it covered all of them.

Rather than fight it, the policyholder agreed to let the court rescind the policy (Travelers Property Casualty Co. of America v. International Control Services, Inc., US District Court, Northern District of Illinois, 2022). Australian insurers work from the same principle.

The fix is never a better-sounding answer: in live testing on the covers we place, answering every security question at its worst still produced a quote with no added conditions and no cover removed; the honest answer changed the price, not the protection.

Assuming a fake-invoice payout is automatic. Cover for a redirected payment or fake invoice is not always there. On some of the covers we place it is built in; on others it is an optional section, or one that can be left off, so it has to show on your schedule; and at least one cyber policy we place has none at all.

Assuming your IT provider's insurance has you covered. If your website host, cloud provider or IT contractor is breached and your customer data goes with it, you still own the notification and regulatory fallout to your own customers, they don't. An IT provider's insurance is written to protect the IT provider, not to stand in for your own cyber cover.

Calling your own IT contractor before your insurer. Several cyber policies require the insurer's own incident response team to run point on an incident, and bringing in your own IT contractor first, without asking, can put part of your cover at risk right when you need it most.

Telling your customers before you tell your insurer. On some of the wordings we place, any breach notification you send to customers or a regulator has to go out with the insurer's written consent first, and the insurer's own panel runs the notification so it lands correctly and on time. Getting in front of it yourself, however decent the instinct, can leave you paying for a notification the policy would otherwise have covered. Wordings differ, so ask what yours requires while nothing is happening, not at 9pm on the night you find out.

Buying it once and never reviewing it. What your business holds, how it takes payments, and who runs your IT all change constantly. A policy bought two systems and one IT provider ago, without anyone telling your broker what changed, may no longer match what you'd actually need to recover.