Cyber insurance is selling like umbrellas in the rain. A foreign customer asks for proof, the broker calls, the board decides "everyone has one". The problem: a policy bought "just for the paperwork" won't defend you against an attack, and may pay out nothing when something does happen.
We've had a dozen of these conversations in the last year. The company gets a six-page questionnaire from the insurer — MFA, backups, EDR, network segmentation, incident response plan. Somebody fills it in over half an hour, ticking "yes" where the honest answer is "partially" or "we're planning to". The policy is issued. A year later ransomware hits, the loss adjuster asks for evidence, and the trouble starts.
Cyber insurance isn't bad. It's just badly understood. It's not a shield. It's the financial safety net under a shield that has to exist already.
What insurers actually demand
The Polish market followed the German and British ones. A standard questionnaire for a 10–50 person company now includes at least:
- MFA on every remote access path — VPN, Microsoft 365, webmail, ERP admin panel. Not "MFA on the admin account", but MFA on every account that logs in from outside the office.
- EDR (not just antivirus) on all workstations and servers. The list of accepted products can be narrow.
- Offline or immutable backups, with a documented restore test at least once per quarter.
- Network segmentation — at the very least, separating production/machinery from the office and from guests.
- An incident response plan — a single A4 page is fine, but it must exist and someone must be named in it.
- System patching within a defined window (typically: critical patches within 14 days).
If you tick "yes" where the honest answer is "not quite", and an incident does happen, the insurer has a clean argument: misrepresentation at policy inception. No payout. That mechanism — the warranty — is in nearly every cyber policy sold in Poland today.
What the policy covers, and what it doesn't
A typical SME cyber policy at PLN 6–20k a year usually covers:
- incident response costs (digital forensics, ransomware negotiators, lawyers);
- business interruption (lost profit) after several days of downtime;
- third-party liability towards customers whose data leaked;
- notification costs (GDPR, customers, partners);
- sometimes — the ransom itself, though that's increasingly a separate rider, and many insurers no longer sell it.
What it typically does not cover:
- damage from misconfigurations that existed before the policy was signed (e.g. an open RDP port someone knew about);
- attacks through systems unpatched for more than 30 days when a fix was available;
- losses from "CEO fraud" wire transfers (that's BEC — usually a separate product);
- regulatory fines — in Poland, practically never.
Read the exclusions, not the sum insured. The reasons four in ten claims end in reduced or rejected payouts are hiding in the exclusions.
A real example from one of our clients
A 22-person accounting firm near Poznań was considering a cyber policy at PLN 9,800 a year after a major client (a law firm) asked in a vendor questionnaire whether they had "insurance against hacker attacks". The broker put the quote together quickly. The insurer required: MFA on every account with remote access, EDR on 25 workstations, offline backups with a quarterly restore test, an incident response plan, and a password policy matching their template.
When we looked closer, 2 out of 5 conditions were met. MFA was only on the main mailbox, not on the Comarch Optima Cloud admin panel. There was an antivirus (Bitdefender Business), but no EDR. Backups went to a NAS on the same network as the accounting server. There was no incident response plan.
The client faced a choice: sign the policy with "yes" answers (and pray nobody ever checked), or delay it by four months and sort the basics out. They chose the second route. The total cost of raising the security baseline: PLN 18,200 one-off (EDR deployment across 25 endpoints, a second backup target in a different location, MFA configuration on four systems, documentation) plus PLN 3,600 a year in EDR licences.
A year later the policy cost them PLN 8,400 instead of PLN 9,800 — the insurer dropped the premium given the better risk profile. But more importantly: in the meantime one employee clicked a phishing link, EDR blocked the payload, and the offline backup passed its restore test at the last internal audit. The policy never had to pay anything out — because there was nothing to pay out.
When it makes sense, when it's theatre
The policy makes sense if:
- you have customers (domestic or foreign) starting to require proof of cover in contracts — typically automotive, pharma, financial services, German manufacturers;
- five days of business interruption would mean a loss you couldn't cover from operating cash;
- you process sensitive personal data and GDPR notifications are a real risk (accountants, law firms, clinics);
- you already have most of the controls from the questionnaire in place — then a PLN 8–15k policy is a sensible add-on.
The policy is theatre if:
- you're buying it instead of MFA, backups and EDR, treating it as "now I have a policy, I don't have to bother";
- none of your customers require it and you're buying under media pressure;
- you're under 10 people, on a simple stack (M365 plus one cloud ERP), and your worst case is two days of downtime that you'd survive without a policy.
What to do before you sign
Before you tick "yes" on the questionnaire, run a short audit with someone who understands these requirements in practice. Two or three days of work are usually enough to show: which answers match reality, where the gaps are, what it costs to close them, and whether the policy gets cheaper after that. Sometimes the basics alone yield a better return than the policy itself — they reduce the probability of an incident, not just its financial impact.
If a foreign customer wants a policy "by yesterday" and you know you don't meet all the conditions, tell the broker. A more expensive policy with an honest questionnaire beats a cheap one that won't pay. Brokers who know this market know how to set it up.
A cyber policy is a financial safety net under a shield that has to exist already. It's not the shield.