Incident response
- Reporting number outside office hours
- Forensic IT investigation
- Legal and communications support
- Support with the notification to the AP
Acceptance · conditions · exclusions
Cyber insurance on the rise: what has changed
Demand for cyber insurance is growing, but today's policy is not the policy of a few years ago. Insurers accept more strictly and have tightened their exclusions.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
Deze pagina in het Nederlands: Cyberverzekeringen in opkomst: wat er is veranderd.
Calculate your premium or request a quote
Without obligation; a reply within one working day.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert.nl or call 072 - 509 24 56 and we will take it from there.
Work out your own premium with the calculator.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Cyber incidents have become a daily risk for businesses of every size. Ransomware, compromised email accounts, manipulated invoice details and outages at an IT supplier are widespread, and attacks are largely carried out automatically. That does not select by company size. At the same time businesses have become more dependent on one or two systems: if something fails there, production, invoicing or service delivery stops immediately.
As a result cyber insurance has moved from a product for large organisations to cover that is also offered to smaller businesses. The emphasis lies not on the payout afterwards but on incident response: one reporting number, forensic investigation, restoring systems and legal assistance. The first hours determine how large the loss becomes, and that is exactly what most companies have no team of their own for.
The other side of that growth is that insurers have become stricter. Acceptance runs through a questionnaire about your security, and the answers become part of the contract. Exclusions have also been tightened, particularly around acts of war and attacks by or on behalf of a state. Also read the general page about cyber insurance.
What do you get with cyber insurance?
The cover consists of help during the incident, your own loss and liability towards others.
Repair and downtime
The costs of recovery and the loss for as long as you cannot work normally.
- Restoring data and systems
- Loss of turnover after a waiting period
- Additional costs to keep working
- Ransomware only subject to conditions
Liability
Claims and costs when other people's data has been leaked from your systems.
- Defence against claims
- Informing data subjects
- Costs of an investigation by the AP (the Dutch data protection authority)
- Administrative fines fall outside this
What is covered
| Situation | Basic | Extended |
|---|---|---|
| Investigation and containment immediately after an attack | Yes | Yes |
| Restoring data, systems and websites | Yes | Yes |
| Loss of turnover from business interruption | Provided that | Yes |
| Failure at an external IT or cloud service provider | No | Provided that |
| An attack by or on behalf of a state | No | No |
| Administrative fine from the regulator | No | No |
What is actually covered, including exclusions, limits, the waiting period and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) you receive before you take out cover.
Four things that have changed
The market has matured, and you notice that above all at the acceptance stage and in the small print.
Acceptance turns on demonstrable basic measures
Where a short application used to be enough, insurers now ask about two-factor authentication on email and remote access, about back-ups kept separate from the network and restored periodically, about updating software in good time and about managing administrator accounts. Those answers fall under the duty of disclosure under Article 7:928 of the Dutch Civil Code. If it turns out when a loss occurs that the statement was not correct, the payout may be reduced or refused under Article 7:930 of the Dutch Civil Code. Answer the list together with your IT manager and keep the evidence.
Exclusions around war and state actors have been tightened
Since cyber attacks began to be used as a means in geopolitical conflicts, insurers have rewritten their war and state actor clauses and made them more specific. Attacks attributed to a state, or taking place in the context of an armed conflict, generally fall outside the cover. The wording differs from insurer to insurer, as does the question of who may make the attribution. For businesses in critical sectors or with activities in high-risk areas this is a point to go through expressly before taking out cover.
Supply chain dependence is the new focal point
The largest incidents of recent years often arose not in the company's own network but at a supplier: a hosting provider, a software supplier or a cloud service. Not every policy covers that failure, and where it does there is often a separate limit and a longer waiting period. So map out which parties you really depend on, set out what you will do if they fail and check whether the policy matches. Also put data processing agreements and recovery arrangements in place with those parties.
What is not included
Outside the cover are, among other things: incidents and vulnerabilities that before the start date were already known, damage caused by software for which the supplier no longer provides support, and failure of the power supply or the telecoms network. Also administrative fines are generally not insurable under Dutch law, and the costs of carrying out overdue maintenance on your IT are for your own account. Loss caused by intent or wilful recklessness of the insured is excluded under Article 7:952 of the Dutch Civil Code.
Nationaal Cyber Security Centrum (the Dutch national cyber security centre)
What does your premium depend on?
- Turnover — the usual basis for calculation
- Sector and type of data — healthcare and web shops weigh more heavily
- Dependence on IT — how quickly your business comes to a standstill
- Security level — two-factor authentication, back-ups, patching policy
- Sum insured and waiting period — a higher limit means a higher premium
- Claims history — earlier incidents and notifications
Insurers weigh these details differently. That is why comparing pays off.
How we arrange it
- You request a quoteWe take stock of your situation, risk and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Frequently asked questions
The questions we are asked most often about this.
Why are more businesses taking out cyber insurance?
Because dependence on IT has increased and incidents are widespread, including at small businesses. Attacks run largely automatically and do not select by size. Clients also require the cover contractually more and more often. The practical argument remains the incident response service: one number, after which specialists take over the incident within a short time.
Have the conditions become stricter?
Yes. Acceptance runs through a questionnaire about security, and those answers become part of the policy. War and state actor clauses have also become more specific, and many policies have a separate limit for failure at suppliers. The cover is not worse for that, but it is more sharply defined than a few years ago.
Is cyber insurance worthwhile for a small business?
Particularly there, because a small business rarely has a security team of its own. Where turnover is limited, a short questionnaire is often enough and acceptance is possible within a few working days. Do make sure the basic measures are in place and can be demonstrated: two-factor authentication, back-ups outside the network and up-to-date software are the entry requirements in practice.
Does insurance replace my security?
No, and that is also the insurers' starting point. The policy only comes into play where the measures fall short, and acceptance requires precisely that those measures are there. If they are missing when a loss occurs, the payout may lapse. See insurance as an addition to security, not a replacement for it.
What if the attack is attributed to a state?
Then the war or state actor clause comes into play. Attacks taking place in the context of an armed conflict or attributed to a state generally fall outside the cover. The wording differs from insurer to insurer, as does the question of who may make that attribution. Have this clause assessed in advance, certainly where you have activities in high-risk areas.
Read more
Similar pages
Want to know what your cyber risk costs?
Request a quote without obligation; we set out the security requirements, the waiting period and the exclusions of each insurer side by side.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was written and checked by an adviser at Finass Verzekert. Last updated on .
The information on this page is general in nature and is not personal advice.