- Cyber insurance is a critical financial safeguard complementing ICT controls, essential for managing residual cyber risk under DORA and similar frameworks.
- Supply chain vulnerabilities are one of the biggest driver of cyber incidents; limited visibility and insurance gaps can amplify systemic losses.
- Boards must oversee insurance policy design aligned with operational realities, regulatory requirements, and tested business continuity approaches to enable true business survivability.
The Jaguar Land Rover cyberattack in 2025 demonstrated how a complex cyber incident can freeze a global manufacturer’s operations for weeks — with no insurance safety net to absorb the financial impact. For businesses – the lesson is clear: no security stack is fool-proof, and full oversight of third parties is impossible. Risk must be structured so that one incident does not threaten business survival. This article guides boards on embedding cyber insurance in ICT governance to strengthen resilience and regulatory compliance.
1. Cyber Insurance: The Financial Backbone of ICT Resilience
Cyber insurance is not an alternative to ICT controls — it’s the financial safeguard that sustains resilience when incidents exceed technical and operational defences.
The Digital Operational Resilience Act (DORA), effective January 2025, mandates robust ICT risk management, supplier oversight, and continuity testing for EU financial institutions. Within this framework, insurance acts as the financial recovery layer, enabling institutions to absorb and recover from residual risk that cannot be fully engineered away.
The NIST Cybersecurity Framework 2.0 (2024) explicitly recognises cyber risk transfer as a core component of cyber risk treatment – an integral pillar of holistic security strategy.
ISO/IEC 27001:2022 and ISO 27005 identify insurance as part of the risk treatment cycle, working alongside controls and recovery mechanisms such as business continuity and disaster recovery.
In short: resilience without financial recovery is incomplete. Cyber insurance turns operational resilience into business survivability.
Board Accountability: Boards should regard cyber insurance oversight as a core responsibility within ICT governance and risk appetite frameworks, ensuring coverage aligns with enterprise strategic risks.
2. The Supply-Chain Weak Link
Many modern cyber incidents originate from third-party compromise, making supplier risk one of the greatest challenges to organisational resilience.
CIS Control 15 requires organizations to maintain a live, up-to-date inventory of ICT service providers, enforce clear contractual clauses covering security expectations and incident reporting, and conduct regular resilience assessments and penetration testing of critical suppliers.
Complementing this, the Digital Operational Resilience Act (DORA) mandates EU-regulated financial entities to implement rigorous ICT third-party risk management frameworks, including detailed oversight of suppliers, continuous monitoring, mandatory incident notifications, contractual rights for audits and testing, and regular resilience validations. DORA elevates third-party dependency to a board-level risk, emphasizing that governance and oversight must extend beyond direct operations to encompass suppliers’ security postures.
3. Market Reality & Emerging Trends
- Coverage gap: Only 45% of UK businesses and 60–70% of FTSE 100 firms carry cyber insurance; EU SME uptake remains below 20% (Howden, Infrascale 2025).
- Pricing direction: Premiums eased by approximately 15% year-over-year in Europe (Marsh 2025), but underwriting scrutiny and control expectations have increased significantly.
- Control expectations: Multi-factor authentication (MFA), endpoint detection and response (EDR), immutable backups, privileged access management, and tested incident response plans are now baseline requirements.
- Policy exclusions: Boards must watch carefully for “war,” “state-actor,” and “systemic event” clauses that limit recovery.
- Global influence: The New York Department of Financial Services (NYDFS) Cyber Insurance Risk Framework (2021) continues to guide global policies on “silent cyber” (unintentional or unclear cyber-related risk embedded within traditional insurance policies—such as property or liability—that neither explicitly include nor exclude coverage for cyber incidents) and aggregated exposures, helping EU insurers anticipate emerging risks.
- Trends to watch: Ransomware remains the top claim driver; exclusion wording and business interruption limits are evolving rapidly.
Emerging systemic risks and silent cyber exposures demand boards maintain ongoing dialogue with brokers to anticipate coverage gaps before crisis.
4. Designing the Right (Insurance) Policy
Boards should regard cyber insurance policy design as an extension of ICT risk management -ensuring coverage aligns with operational, regulatory, and technical realities.
- Business interruption: Align sub-limits and deductible periods with your tested recovery time and point objectives (RTO/RPO).
- Regulatory cover: Confirm inclusion of breach response, legal, and notification costs.
- Third-party exposure: Ensure contingent-vendor and cloud/SaaS outage coverages are included.
- Exclusions: Model systemic and geopolitical scenarios with broker input before binding to avoid “silent cyber” surprises.
A well-structured policy should directly reflect the continuity and recovery posture validated under DORA and tested through your business continuity/disaster recovery (BCP/DRP) exercises.
Closing Thought
Cyber insurance is a foundational pillar of effective cyber risk management and business resilience in today’s digital landscape. It provides essential financial protection that allows organizations to absorb the escalating costs of cyber incidents – covering everything from ransomware payments and operational recovery to regulatory fines and legal expenses.
Far from being merely a last resort, cyber insurance is a strategic enabler. It ensures continuity for businesses when breaches or disruptions exceed the preventive power of technical controls and governance frameworks. In fact, insurers increasingly require demonstrable cybersecurity maturity – such as strong access controls, detection mechanisms, and tested incident response plans – as a condition for coverage and favourable premiums.
Just like seatbelts and airbags, which work best when combined with active safety systems like brakes and driver vigilance, cyber insurance delivers maximum value when embedded within a comprehensive, integrated cyber defence strategy. It bridges the gap between what organisations can proactively prevent and what risk remains unavoidable, transforming potentially devastating cyber events into manageable, recoverable incidents.
For boards, championing cyber insurance means acknowledging its indispensable role in safeguarding organizational viability. It is not a silver bullet but a critical financial lifeline – and one that must be actively managed alongside robust cybersecurity investments and continuous resilience testing.
Key References
- KnowBe4 Cyber Insurance & Security: Meeting the Rising Threat (2025)
- Munich Re Cyber Insurance: Risks and Trends 2025 (Mar 2025)
- Howden Cyber Report 2025 (Sep 2025)
- Infrascale Cyber Insurance Statistics: USA 2025 (Jun 2025)
- Marsh Global Insurance Market Index (Apr 2025)
- CIS Control 15 v8.1 (2023)
- ISO/IEC 27001:2022 Clause 6.1.3
- NYDFS Cyber Insurance Risk Framework (2021)
- Swiss Re Cyber Insurance Rate Deterioration (Sep 2025)
Embark can help enhance your cyber resilience through our services. Please visit our Technology Assurance & Advisory Services section for further info.
This article was authored by Mark Vella (Senior Consultant – ICT)
