Cyber insurance comparison UK: six options for small firms

Type “cyber insurance comparison” into Google from a British postcode and you mostly get brokers ranking their own panels. This page goes the other way: six names a small UK firm is likely to meet, each taken from what that insurer publishes itself, so you can put any two side by side.

One figure from the government’s survey sets the tone: 22 per cent of UK businesses don’t know whether they’re insured against cyber risk at all. And if client data is what keeps you up, the ways it leaks through AI tools are where policy wordings stay quietest.

Hiscox vs CFC vs AXA: six UK cyber insurance options head to head

Hiscox vs CFC is the pairing people search for most, and the two are bought in different ways. Hiscox CyberClear has an online quote it says takes five minutes. CFC’s product page tells a business to contact its broker, and the UK application form is a single page.

Hiscox vs AXA is less of a contest than it sounds. AXA’s own cyber page says it does not directly offer cyber insurance and points you to InSync Insurance, a broker. So you’d be comparing Hiscox with whatever that broker finds: brokers are part of this market.

Zurich’s UK cyber page wouldn’t load for us on 7 November 2026, so it stays out of the table rather than going in on guesswork. Pick any pairing below and the other four rows disappear.

There’s no star rating here, and the reason is British. The FCA’s perimeter guidance treats advising a customer to take out a particular policy as advice on its merits, a regulated activity. This page reads published documents for you; it doesn’t tell you which policy suits your business.

Cyber insurance under £500: what UK insurers publish on price

People search for cyber insurance under £500, and I understand why: it’s a number a sole trader or a five-person practice can say yes to. But none of the six publishes a premium for cyber cover, so any figure you see quoted is somebody else’s price for somebody else’s business.

Hiscox comes closest, and its number needs its footnote. “Business insurance quotes start from £7.20” a month, says the page, based on an average of all business insurance policies sold to at least 10% of its customers between August 2025 and August 2026. That isn’t a cyber price.

Your own figure comes out of your answers. Turnover, sector and the data you hold drive it, which is why the cyber insurance questionnaire deserves more care than the quote button.

Is cyber insurance worth it for a small business? What UK firms do

The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found 47 per cent of businesses insured against cyber risk in some way. Most of that is cover inside a wider policy, 37 per cent; only 10 per cent hold a specific cyber policy.

Small firms do better than micro ones: 15 per cent of small businesses have a dedicated policy, against 8 per cent of micro businesses. Firms with no cyber cover of any kind were asked why, and here’s what organisations like yours said.

Price comes fourth. Most uninsured firms seem never to have got as far as a quote, which tells me the decision is being skipped, not weighed. Before deciding it isn’t worth it, put rough numbers on one bad week.

Standalone cyber policy or cyber cover inside your business insurance?

That 37 per cent inside a wider policy deserves a closer look. Direct Line’s Cyber Risks is an optional section of its Office and Professionals policy, and its claims are administered by HSB Engineering Insurance Limited, not by Direct Line. Hiscox CyberClear and CFC’s product are cyber policies in their own right.

Neither shape is wrong. For a two-person office holding little client data, an add-on section can be enough. Once client files are the business, I’d want a standalone policy with its own wording and incident line. More on handling those files sits in our guides.

What cyber insurance covers in the UK, and the exclusions to find first

Hiscox’s policy summary splits CyberClear into six parts: your own losses, cyber business interruption, claims and investigations against you, crime, bricking and additional covers. Direct Line’s Cyber Risks runs through similar ground, including a ransom payment “if we agree”.

The exclusions are where two policies with the same limit stop being the same. Hiscox won’t pay for losses due to “the use of any outdated or unsupported computer system”. Check that one first, against a written list of what you run, the same inventory an AI policy for staff starts from.

Money sent to a fraudster is the other gap. The NCSC warns that “some insurance policies will not cover monies lost through business email compromise fraud”. Hiscox’s crime section covers transfers made in response to a social engineering communication; ask for the equivalent line in any quote you get.

Does cyber insurance cover ICO fines? And the 72-hour breach report

The Direct Line page and the Hiscox wording put the same condition in front of fines. Neither tells you whether a UK data protection penalty meets it, and I wouldn’t record a fine as covered in a risk register until the insurer has answered that in writing.

The 72 hours causes a different muddle. UK GDPR gives you up to 72 hours, where feasible, to tell the Information Commission, which replaced the ICO on 30 September 2026. Hiscox runs its own clock: report within 72 hours of first noticing an actual or suspected breach and it waives the excess.

Two deadlines, two recipients. Which clock you’re on depends on whether a breach happened at all, and a paste of client data into ChatGPT may or may not be one.

MFA, backups and fair presentation: what insurers ask before they cover you

CFC’s UK application asks three security questions and nothing else about controls. Direct Line sets its own conditions in the cover itself, and its backup interval tightens as you grow past £250,000 of turnover. A business can breach that by having a good year.

Every answer lands under the Insurance Act 2015. Section 3 says you must make “a fair presentation of the risk” before the contract, including “every material circumstance which the insured knows or ought to know”. Direct Line’s summary puts it in plain English: you need to make a fair presentation of your business.

If a broker fills in the form for you, the answers are still yours. It’s fair to ask how the broking office handles your client files with AI while you’re at it. What happens when an answer is wrong is graded, not all or nothing:

Cyber insurance and AI: what UK policy wordings say

On 7 November 2026 we searched the full text of seven documents for artificial intelligence, AI, machine learning and generative. None treats AI as a risk, a cover or an exclusion. Hiscox’s cyber page names it only in its list of trades, as a software developer and a hardware provider.

Silence isn’t cover. Hiscox defines a breach as including the “unauthorised acquisition, access, use or disclosure” of personal data. Whether a member of staff pasting a client file into a chatbot fits that is the insurer’s call, so ask the question at renewal, not after a claim.

What you can control is your own record of which AI tools staff use and how each is set up. If the underwriter ever asks, that record is your answer, and it costs nothing to keep.

Before your cyber insurance renewal: three documents and one leak

Renewal week deserves an hour with three papers side by side: the schedule for limits and excesses, the wording for exclusions and fines, and the application form for every yes you’re promising. Do it before the broker’s call, not during it.

The leak no wording prices yet is client text pasted into AI tools. Nonimo for UK firms takes client names and identifiers out of that text on your own computer before it goes anywhere, so the AI question at renewal gets a short, true answer.

I’d rather you check than take my word for it: how Nonimo treats your data is set out on our security page.

Sources

• Hiscox, Cyber and data insurance: £25,000 crisis containment as standard, five-minute online quote, the £7.20 figure and its footnote, AI only in the trades list.
• Hiscox, CyberClear policy summary PS-PIP-UK-CCLEAR(6) (PDF): six sections of cover, exclusions, the 72-hour excess waiver.
• CFC, Cyber insurance: businesses go through their broker, £0 to £250m revenues, nil-deductible incident response, price varies by size and industry.
• CFC, Cyber Proactive Response application form, UK (PDF): the three security questions.
• Direct Line for Business, Cyber insurance: limits, £500 excess, antivirus and backup intervals, Retail and Office & Professional only, fines where insurable by law.
• Direct Line for Business, Office and Professionals cover summary DL4BKF (PDF): HSB claims administration, Cyber Risks exclusions, fair presentation.
• AXA UK, Cyber insurance: does not directly offer cyber insurance; refers to InSync Insurance.
• Aviva, Business insurance: no cyber product listed on the page, direct or through a broker.
• DSIT, Cyber Security Breaches Survey 2025/2026: insurance take-up and reasons for going without.
• NCSC, Cyber insurance guidance: the business email compromise warning; no mention of AI.
• NCSC, Cyber Essentials overview: insurance entitlement under £20m turnover, the five controls.
• Insurance Act 2015, section 3: the duty of fair presentation.
• UK GDPR, Article 33: 72-hour notification to the Information Commission, the wording in force since 30 September 2026.
• FCA Handbook, PERG 5.15: advising on a particular policy is regulated advice.

Accessed 7 November 2026.