Table of Contents
- What Is Cyber Insurance?
- Why Small Businesses Need Cyber Insurance
- Best Cyber Insurance Providers in India
- Cyber Insurance Comparison
- HDFC ERGO Cyber Insurance
- ICICI Lombard Cyber Insurance
- Tata AIG Cyber Insurance
- Bajaj General Cyber Insurance
- SBI General Cyber Insurance
- New India Assurance Cyber Insurance
- United India Cyber Insurance
- What Does Cyber Insurance Cover?
- What Cyber Insurance May Not Cover
- How Much Cyber Insurance Do You Need?
- How Much Does Cyber Insurance Cost?
- How to Choose the Right Cyber Insurance
- How to Reduce Cyber Insurance Premiums
- Cyber Insurance Claim Process
- Frequently Asked Questions
- Final Verdict
What Is Cyber Insurance?
Cyber insurance is designed to protect businesses against certain financial losses arising from cyber incidents.
Modern businesses store significant amounts of information digitally.
This may include:
- Customer names
- Phone numbers
- Email addresses
- Employee records
- Payment information
- Financial records
- Business documents
- Login credentials
- Proprietary data
A cyberattack can potentially disrupt operations, compromise data and create significant recovery costs.
The best cyber insurance for small business in India should therefore be selected according to the company’s actual cyber exposure rather than simply choosing the cheapest premium.
Depending on the policy, cyber insurance may provide protection relating to data breaches, cyber extortion, business interruption, legal expenses, forensic investigation and other covered events.
Why Small Businesses Need Cyber Insurance
Many small businesses assume cybercriminals are interested only in large companies.
That assumption can be expensive.
India continues to face a high volume of cyber incidents. Government information cited by PIB shows that cybersecurity incidents reported to CERT-In rose from 10.29 lakh in 2022 to 22.68 lakh in 2024. (pib.gov.in)
A small business may have fewer resources to recover after a serious attack.
Common Cyber Risks
- Phishing
- Ransomware
- Malware
- Business email compromise
- Data theft
- Credential theft
- Unauthorized access
- Payment fraud
- Website attacks
- Cloud-account compromise
For a small company, even a few days without access to critical systems can cause financial damage.
Best Cyber Insurance for Small Business in India
Businesses can evaluate cyber insurance from several established insurers operating in India.
Seven providers worth researching include:
| Provider | Best For | Key Area |
|---|---|---|
| HDFC ERGO | Businesses & professionals | Cyber liability |
| ICICI Lombard | SMEs & businesses | Cyber risk protection |
| Tata AIG | Commercial businesses | Cyber liability |
| Bajaj General | Businesses & individuals | Cyber risk products |
| SBI General | SMEs | Cyber defence |
| New India Assurance | Commercial organizations | Cyber liability |
| United India Insurance | Businesses | Cyber insurance |
Important: Insurance products, availability, limits and policy wording can change. Always verify the latest commercial product directly with the insurer or an IRDAI-authorized intermediary.
1. HDFC ERGO Cyber Insurance
HDFC ERGO provides cyber-related insurance solutions designed to address risks arising from digital activities.
Cyber insurance can become especially relevant for businesses storing customer information or depending heavily on digital infrastructure.
Businesses That Should Consider It
- E-commerce businesses
- SaaS companies
- IT companies
- Digital agencies
- Financial service firms
- Online businesses
- Professional services
Risks to Evaluate
When comparing a policy, ask whether it addresses:
- Data breach
- Cyber extortion
- Privacy liability
- Business interruption
- Data restoration
- Legal expenses
- Incident response
Do not assume that every cyber incident is automatically covered.
Verdict: Worth evaluating for businesses seeking cyber-risk protection from a major private insurer.
2. ICICI Lombard Cyber Insurance
ICICI Lombard offers cyber-related insurance products and risk-management solutions.
A business should evaluate the specific commercial policy available for its organization rather than relying on consumer cyber-insurance descriptions.
Important Coverage Areas to Compare
- Privacy breach
- Cyber liability
- Data recovery
- Cyber extortion
- Legal costs
- Incident response
- Business interruption
Best For
- SMEs
- Technology businesses
- Professional service companies
- E-commerce companies
- Businesses handling customer information
Verdict: A provider worth including when requesting commercial cyber-insurance quotations.
3. Tata AIG Cyber Insurance
Tata AIG offers commercial insurance products covering a broad range of business risks.
Cyber liability insurance is relevant to companies facing financial exposure from privacy breaches, network-security incidents and related cyber events.
Businesses That May Benefit
- IT companies
- Software developers
- E-commerce businesses
- Financial companies
- Healthcare businesses
- Professional firms
What to Check
Compare:
- Coverage limits
- Deductible
- Data breach response
- Forensic costs
- Legal defence
- Business interruption
- Cyber extortion
- Third-party liability
Verdict: Particularly worth considering for companies that need cyber insurance as part of a broader commercial-insurance program.
4. Bajaj General Cyber Insurance
Bajaj General Insurance offers cyber-related protection products in India.
For a business, the important issue is whether the selected commercial policy matches the company’s specific risks.
A digital agency, for example, may have very different cyber exposure from a manufacturing company.
Digital Businesses Should Evaluate
- Client data
- Payment systems
- Cloud accounts
- Employee devices
- Email systems
- Website security
- Third-party SaaS providers
Verdict: Compare the commercial policy wording carefully, particularly around data breaches, ransomware and business interruption.
5. SBI General Cyber Insurance
SBI General has offered cyber-risk insurance solutions aimed at businesses, including SMEs.
Small and medium businesses increasingly depend on digital payments, email, cloud systems and online banking.
This creates financial exposure even for companies that do not consider themselves “technology companies.”
Example
Imagine a distributor whose employees receive a fraudulent email appearing to come from a vendor.
The email contains changed bank details.
The company sends a large payment to the wrong account.
Whether a cyber policy would cover such a scenario depends entirely on the policy terms and the nature of the event.
Verdict: An option SMEs can evaluate when comparing cyber insurance from established Indian insurers.
6. New India Assurance Cyber Insurance
New India Assurance offers commercial insurance products for businesses and organizations.
Cyber-related insurance can form part of a broader corporate risk-management strategy.
Businesses That May Need Cyber Coverage
- Financial services
- IT companies
- Healthcare
- Education
- E-commerce
- Manufacturing
- Professional services
Important Questions
Before purchasing, ask:
Does the policy cover first-party losses?
Does it cover third-party claims?
Is ransomware included?
What business interruption waiting period applies?
Are cloud-service incidents covered?
Are forensic investigation costs covered?
Verdict: Worth evaluating alongside private-sector insurers when comparing commercial cyber-risk coverage.
7. United India Cyber Insurance
United India Insurance also provides commercial insurance solutions for businesses.
Cyber-risk products should be evaluated based on policy wording rather than insurer name alone.
Check for
- Network security liability
- Privacy liability
- Data restoration
- Cyber extortion
- Business interruption
- Legal expenses
- Incident response
Verdict: Include it when obtaining multiple quotations for business cyber insurance.
Cyber Insurance Comparison
| Coverage Area | Why It Matters |
| Data Breach | Helps address costs after covered data exposure |
| Cyber Extortion | Can address certain ransomware/extortion events |
| Business Interruption | May cover eligible income losses after a covered cyber event |
| Data Restoration | Helps with covered data-recovery expenses |
| Privacy Liability | Helps address certain third-party privacy claims |
| Legal Expenses | May cover eligible defence/legal costs |
| Forensic Investigation | Helps determine what happened |
| Notification Costs | May cover certain customer-notification expenses |
| Incident Response | Provides access to specialists after an incident |
Actual coverage differs significantly by insurer and policy.
What Does Cyber Insurance Cover?
Understanding coverage is essential when choosing the best cyber insurance for small business in India.
Cyber policies can generally contain two broad types of protection.
First-Party Coverage
First-party coverage deals with losses suffered directly by your business.
Examples can include:
Data Restoration
Costs associated with recovering or restoring covered data.
Cyber Extortion
Certain expenses related to a covered ransomware or extortion incident.
Business Interruption
Certain income losses caused by covered cyber disruption.
Incident Response
Costs of cybersecurity professionals investigating an incident.
Notification Costs
Costs associated with notifying affected customers where applicable.
Third-Party Coverage
Third-party coverage deals with claims made against your business.
For example, a customer may claim that your failure to protect their data caused financial harm.
Coverage can potentially include:
- Privacy liability
- Network security liability
- Legal defence
- Regulatory-related costs where insurable
- Settlements subject to policy terms
What Cyber Insurance May Not Cover
Cyber insurance does not mean every cyber-related loss is covered.
Policies contain exclusions.
Possible exclusions can include:
- Known incidents before policy inception
- Intentional acts
- Certain infrastructure failures
- Unapproved security practices
- Contractual liabilities
- Certain regulatory penalties
- War-related exclusions
- Failure to maintain required cybersecurity controls
The exact exclusions depend on the policy.
Important
If an insurer requires:
- Multi-factor authentication
- Regular backups
- Endpoint security
- Employee training
- Security updates
and the company does not maintain those controls, it could potentially affect coverage depending on the policy terms and representations made during underwriting.
Always answer insurance application questions accurately.
How Much Cyber Insurance Does a Small Business Need?
There is no universal amount.
A ₹50 lakh limit may be adequate for one business and completely inadequate for another.
Consider:
Revenue
How much income could you lose if operations stopped?
Customer Data
How many customer records do you store?
Type of Data
Financial and sensitive information may create higher exposure than basic contact information.
Business Dependence on Technology
Could your company operate without:
- Email?
- CRM?
- Website?
- Cloud storage?
- Accounting software?
- Payment system?
Contract Requirements
Some enterprise clients require vendors to maintain minimum cyber-insurance limits.
Maximum Possible Loss
Think beyond the cost of replacing a laptop.
A serious incident can involve:
Forensics + legal + recovery + lost revenue + customer response + liability.
How Much Does Cyber Insurance Cost in India?
There is no single fixed price for cyber insurance.
Premiums can depend on:
- Annual revenue
- Industry
- Number of employees
- Coverage limit
- Deductible
- Type of data
- Security controls
- Previous cyber incidents
- Claims history
- Geographic exposure
- Third-party vendors
A small professional-services company may pay significantly less than a financial-technology company storing large amounts of sensitive information.
Example
Company A:
- 10 employees
- Limited customer information
- ₹1 crore revenue
- MFA enabled
- Regular backups
Company B:
- 100 employees
- Large customer database
- Online payments
- ₹50 crore revenue
- International customers
Company B will generally present a more complex cyber-risk profile.
Actual premiums require underwriting and a quotation from an insurer.
How to Choose the Right Cyber Insurance
1. Identify Your Cyber Risks
Ask:
- What data do we store?
- Where is it stored?
- Who can access it?
- What happens if our systems go offline?
- What is our largest possible cyber loss?
2. Compare Coverage, Not Just Premium
The cheapest policy may exclude an important risk.
Compare:
- Coverage limits
- Sublimits
- Deductibles
- Waiting periods
- Exclusions
- Incident-response services
3. Check Ransomware Coverage
Do not assume ransomware is automatically covered.
Review:
- Extortion coverage
- Recovery costs
- Business interruption
- Forensic costs
- Applicable sublimits
4. Check Cloud Coverage
Most businesses use third-party cloud services.
Ask how the policy treats incidents involving:
- AWS
- Microsoft Azure
- Google Cloud
- SaaS providers
- Hosting companies
- CRM platforms
5. Check Business Interruption
Understand:
- Waiting period
- Coverage period
- Calculation of lost income
- Third-party service interruption
How to Reduce Cyber Insurance Premiums
Insurers may evaluate the strength of your cybersecurity program.
Improving security can reduce risk and may improve insurability.
Enable Multi-Factor Authentication
MFA should be enabled on critical systems.
Maintain Offline or Protected Backups
Backups can reduce the impact of ransomware.
Install Endpoint Protection
Protect employee computers and servers.
Update Software
Patch known vulnerabilities quickly.
Train Employees
Phishing remains a major attack method.
Employees should know how to identify suspicious emails and links.
Control Administrator Accounts
Not every employee should have administrator privileges.
Create an Incident Response Plan
Know who to contact if an attack occurs.
CERT-In publishes cybersecurity advisories and incident-response information that businesses can use as part of their security planning. (cert-in.org.in)
Cyber Insurance Claim Process
The exact claim process depends on the insurer.
A typical process may look like this:
Step 1: Detect the Incident
Your security system or employee identifies suspicious activity.
Step 2: Contact the Insurer
Notify the insurer according to the policy requirements.
Do this quickly.
Step 3: Activate Incident Response
The insurer may provide or approve specialists such as:
- Cybersecurity experts
- Forensic investigators
- Lawyers
- Data-recovery specialists
- Crisis-management professionals
Step 4: Investigate
Determine:
- What happened?
- When did it happen?
- What systems were affected?
- What data was compromised?
Step 5: Contain the Incident
Security professionals work to stop further damage.
Step 6: Document the Loss
Maintain records of expenses and business impact.
Step 7: Submit the Claim
Provide the required documentation.
Cyber Insurance vs Cybersecurity
Cyber insurance and cybersecurity are not substitutes for each other.
Think of it this way:
Cybersecurity tries to prevent an incident.
Cyber insurance helps manage certain financial consequences when a covered incident occurs.
A company should ideally have both.
| Cybersecurity | Cyber Insurance |
| MFA | Financial protection |
| Firewall | Incident-response costs |
| Backups | Business interruption coverage |
| Endpoint security | Liability protection |
| Employee training | Legal-cost coverage |
| Monitoring | Recovery-cost coverage |
Buying insurance without maintaining cybersecurity is not a good risk-management strategy.
Frequently Asked Questions
What is the best cyber insurance for small business in India?
There is no single best insurer for every business. HDFC ERGO, ICICI Lombard, Tata AIG, Bajaj General, SBI General, New India Assurance and United India are among providers worth researching. The right policy depends on coverage, limits, exclusions, deductible and the company’s cyber-risk profile.
Does cyber insurance cover ransomware?
Some cyber policies provide coverage relating to cyber extortion or ransomware, but the exact protection, conditions and sublimits vary. Check the policy wording carefully.
Does cyber insurance cover data breaches?
Many commercial cyber policies are designed to address certain data-breach costs and liabilities. The exact scope depends on the policy.
Is cyber insurance mandatory in India?
Cyber insurance is not universally mandatory for every Indian business. However, certain contracts, clients, industries or risk-management requirements may make it necessary or commercially important.
Does a small business really need cyber insurance?
A business that stores customer information, accepts online payments, depends on cloud systems or could suffer significant losses from a cyber incident should at least evaluate its cyber-insurance requirements.
How much cyber insurance should I buy?
The appropriate limit depends on your revenue, data exposure, business-interruption risk, contractual obligations and potential liability.
Does cyber insurance cover employee mistakes?
Some policies may cover certain incidents arising from employee errors, while others may contain relevant conditions or exclusions. Check the policy wording.
Does cyber insurance cover phishing?
Some policies may cover losses arising from certain phishing or social-engineering incidents, but this is not universal. Social-engineering coverage may have separate limits or exclusions.
Final Verdict
The best cyber insurance for small business in India is the policy that protects against the cyber events most capable of causing serious financial damage to your specific business.
A small offline retailer may need relatively simple protection.
An e-commerce business processing thousands of customer transactions has a very different risk profile.
A SaaS company storing customer information may need:
- Cyber liability
- Privacy coverage
- Business interruption
- Data restoration
- Cyber extortion
- Incident response
A financial-services company may require even more comprehensive protection.
When comparing policies from HDFC ERGO, ICICI Lombard, Tata AIG, Bajaj General, SBI General, New India Assurance and United India, focus on the actual wording rather than the insurer name alone.
Compare:
Coverage + limits + sublimits + deductible + exclusions + incident response + premium.
Most importantly, cyber insurance should complement—not replace—strong cybersecurity.
Use MFA, maintain reliable backups, train employees, patch software and create an incident-response plan.
A strong cybersecurity program combined with appropriate insurance can give a small business much better protection against the financial consequences of modern cyber threats.