Cyber insurance: is it really worth it for SMEs?

Cyber insurance is a topic that has been gaining more and more attention in recent years, including among small and medium-sized enterprises (SMEs) in Switzerland. Digitalisation has opened up enormous opportunities for Swiss SMEs, but at the same time it has increased the risks linked to information security. Ransomware attacks, data theft, phishing and breaches of IT systems are everyday occurrences, and they affect local businesses as well as large multinationals. Against this backdrop, cyber insurance is coming up more and more often, referring to insurance policies that cover damage arising from cyber incidents. But is it really worth it for Swiss SMEs to take out one of these policies?

Why cyber insurance has become a central topic

In recent years, Switzerland has seen a significant increase in cyberattacks against businesses. According to reports from MELANI (now the NCSC), the number of reported incidents is growing year on year, and more and more businesses find themselves dealing with operational disruption or financial losses caused by digital attacks.

At the same time, the introduction of the new Federal Act on Data Protection (nFADP), which came into force in 2023, and the European GDPR make businesses responsible for how they manage customer data. The penalties for failing to meet these obligations can be heavy, even for an SME.

Against this backdrop, cyber insurance is put forward as a form of financial protection to reduce the economic impact of a cyberattack.

What a cyber insurance policy covers

A cyber insurance policy can include various types of cover, including:

• Direct damage: costs to restore IT systems, recover data, and cover business interruption.
• Indirect damage: loss of revenue due to downtime or operational problems.
• Third-party liability: compensation owed to customers or partners for the loss or unauthorised disclosure of their data.
• Legal costs: legal assistance in the event of disputes.
• Crisis management: support with communication, PR and restoring the company's reputation.

Not all policies are the same: it's essential to carefully assess what is included and which exclusions might reduce the cover.

The limits of cyber insurance

Relying on a policy alone is not enough. Many contracts require the business to adopt minimum IT security measures, such as up-to-date firewalls, regular backups and staff training. Without these requirements in place, there's a risk that the insurance won't cover the damage suffered.

In addition, some policies don't cover attacks of a "state-sponsored" nature or those caused by gross negligence. This means that cyber insurance is in no way a substitute for a solid internal cybersecurity plan.

Checklist: is your business ready for cyber insurance?

Before considering a policy, check whether your SME has already put these measures in place:

• Basic protection in place: firewall, antivirus and regular updates.
• Secure, tested backups: data saved in multiple copies, including off-site or in the cloud.
• Access management: multi-factor authentication and differentiated permissions.
• Staff training: regular courses on phishing, strong passwords and good digital practices.
• Emergency procedures: a plan to react quickly in the event of an attack.
• IT risk assessment: an internal review or one carried out with the support of a partner such as easy4you.
• Regulatory compliance: compliance with the nFADP and GDPR for data protection.

If most of these boxes are unchecked, the priority is to invest in prevention. Only afterwards does it make sense to consider taking out cyber insurance

Is it worth it for Swiss SMEs?

The answer depends on several factors:

• Sector of activity: an e-commerce business handling thousands of pieces of sensitive data has greater exposure than a small local business.
• Budget: policies have a cost that varies depending on the size of the business and the level of cover required.
• Digital maturity: the more digitalised a business is, the greater its need for protection.

For many SMEs, cyber insurance can be a financial safety net, but it shouldn't be seen as the main solution. Prevention comes first: staff training, implementing secure software, backups and ongoing monitoring.

The role of the nFADP

In Switzerland, with the new Federal Act on Data Protection (nFADP) coming into force in 2023, businesses have specific obligations regarding the management and protection of personal data. Breaches can result in fines of up to CHF 250,000. This makes the importance of prevention, and in some cases a policy that also covers legal costs, even clearer.

easy4you: prevention comes first

At easy4you, we believe that true protection for SMEs starts with a digital culture. There's no point paying for a policy if staff don't know how to spot a phishing email or if data isn't properly protected.

That's why we support businesses in implementing cybersecurity solutions, from choosing secure tools through to training staff, including through our online awareness courses. Only after building a solid foundation does it make sense to consider an insurance policy as an additional tool.

Conclusion

Cyber insurance can be an important ally for Swiss SMEs, but on its own it isn't enough. It's truly effective only when it's part of a complete information security strategy that includes staff training, up-to-date technology and well-structured, secure business processes.

Investing in prevention first, with the support of specialist partners such as easy4you, significantly reduces risk and puts you in a stronger position when dealing with insurance companies too. A well-chosen policy then becomes the final piece of a complete protection plan, added after everything else.

If you'd like to assess your business's security or learn more about the solutions available, get in touch for a personalised consultation, or visit our page dedicated to data protection to find out how to effectively safeguard your digital infrastructure.