Most small businesses do not buy cyber insurance because they enjoy thinking about exclusions and policy limits. They consider it because they imagine the morning when a key system is unavailable, a supplier account has been compromised or customers need an urgent explanation. The better question is not simply 'How much cover should we buy?' It is 'What would we actually need to recover?'

Running a distributed group of service and software businesses has made that distinction especially important to me. Risk is not contained in one laptop. A CRM, payment platform, shared inbox, third-party integration and remote contractor may all be part of the same customer journey. If a critical connection fails, several teams can be affected, even when no one has physically entered an office.

Start by mapping the interruption, not shopping for a headline limit

Take a simple hypothetical example: a business loses access to its customer-support inbox for three days after an account takeover. The direct cost of restoring access may be modest. But staff time, diverted enquiries, potential data exposure, delayed client work and the expense of communicating accurately with customers could be considerably larger. It is those operational dependencies that an owner should identify before asking an insurance adviser about suitable cover.

I would begin with three questions. Which systems could stop us serving customers? Who owns each of those systems and the integrations connected to it? How would we communicate and keep a minimum service running if access disappeared tomorrow? The answers help the business understand its exposure, and they give a broker a more useful conversation than 'We are a small company with a few laptops.'

Understand the two different types of losses

Cyber policies may provide first-party protection for an organisation's own response and recovery costs, and third-party liability protection for certain claims made against it. Those distinctions sound technical, but the underlying business question is straightforward: whose loss is being addressed? A company may need help investigating an incident, restoring systems, obtaining legal guidance and handling interruption. Separately, customers or other parties might make claims following an incident. Whether any particular item is covered depends on the exact policy.

The UK's National Cyber Security Centre recommends checking what existing policies already cover, identifying the systems and information that matter most, and understanding both the support offered during an incident and the limits of a proposed policy. The UK's Association of British Insurers likewise emphasises that exclusions and territorial restrictions vary. There is no substitute for asking an insurer or qualified broker to explain a real wording, including how its definitions operate in a realistic scenario.

Read exclusions as carefully as the headline benefit

An owner might assume any online fraud is automatically insured. That is a dangerous assumption. Business-email-compromise losses, for example, may require specific cover. A policy might also have conditions relating to the use of multifactor authentication, backups, access management, notification timing or the accuracy of information provided at application. An international operation should also examine jurisdiction and territorial limits rather than assume that a UK-purchased policy answers every overseas exposure.

I would ask an adviser to walk through a worked scenario, not just hand over a product sheet: 'An employee's mailbox is taken over, a supplier is impersonated, a customer pays the wrong account and our team discovers the problem two days later. What happens next, and which parts might be excluded?' Then repeat the exercise for a ransomware outage, a cloud-service failure and a privacy complaint. Specific examples expose misunderstandings early.

Insurance is not an alternative to basic controls

Cover does not stop a compromised login or give an organisation a clean backup. Small businesses still need sensible security measures, with clear ownership. For an operator, that often means multifactor authentication, the ability to revoke access quickly, reasonably scoped permissions, reliable backups, patching and a rehearsed incident contact process. The important point is not to perform compliance theatre for an insurance application. It is to be able to say what genuinely exists, who maintains it and when it was last checked.

Third-party access deserves particular attention. A service that was installed for a short-lived campaign may retain broad permissions long after the campaign ends. A freelancer who has finished an assignment may still have access to customer information. Those are manageable operational risks, provided somebody is actually accountable for reviewing and removing access.

Plan the first 24 hours

One of the most useful questions I would put to a prospective insurer is what practical help the business receives when something happens. Is there a response hotline? Who appoints technical investigators, legal advisers and communications support? Must a particular provider be used? What needs to be reported, and how quickly? Who within the company is authorised to make that call outside normal office hours? Those answers belong in a short incident plan accessible without the affected system. An insurance policy filed only in the compromised inbox is not a particularly useful recovery tool.

Treat the purchase as a governance decision

The right level and form of cover depend on what the business does, the information it holds, its contractual obligations, where it operates and its ability to absorb an interruption. A founder should bring those facts to a qualified adviser and ask for clear explanations of limits, excesses, exclusions and conditions. This is not about claiming to be a cyber-security practitioner or an insurance expert. It is about taking responsibility for an operating business.

My view is that cyber insurance earns its place when it sits beside good controls and a practiced recovery plan. Buy it to support a business that understands its risks, not to avoid understanding them.

Deepak Shukla is the founder of Pearl Lemon Group, a UK-founded group of digital services and software businesses. He writes about the operational decisions involved in managing distributed teams, customer systems and technology.