Cyber cover for a business that runs on its systems.

Attacks on small businesses are mostly automated and untargeted — a phishing email, a reused password, an unpatched system — so size isn't the protection people assume. Small NZ firms are hit regularly, and because they rarely have an IT team on standby, the downtime hurts more. Cyber cover isn't only about the big breach; it's about having someone to call on a Friday night when the invoices won't open.

The most useful part is the response. Most cyber policies include a 24/7 incident response line with IT forensics, legal and communications specialists who take over from the first call — working out what happened, containing it, restoring systems and advising on notifications. The policy then pays for the recovery work, the income you lose while you're down, and any claims or regulatory costs that come after.

Often as an optional extension, and it's one worth asking about. Business email compromise — where a criminal poses as a supplier or a director and gets a payment redirected — is one of the most common losses NZ businesses report. Funds transfer fraud and social engineering covers respond to it, usually with their own sub-limit. Tell your broker how you process payments and we'll make sure the extension is included.

If a breach is likely to cause serious harm to the people whose information was involved, you must notify the Office of the Privacy Commissioner and, in most cases, the affected people — as soon as practicable. A cyber policy helps here: the response team advises on whether a breach is notifiable, and the policy covers the legal, notification and credit-monitoring costs that follow. It's one of the reasons to call the insurer first rather than trying to handle it alone.

Most want to see the basics: multi-factor authentication on email and remote access, backups that are tested and kept separate from the main network, regular patching and some staff awareness training. Businesses without them may face higher premiums, restricted cover or a decline. If you're not sure where you stand, your broker can tell you what the market is asking for before you apply.

Usually not in any meaningful way. Some business packages include a small cyber extension, but the limits are low and the incident response service is generally absent. A standalone cyber policy, or a proper cyber section added to your programme, is what responds when something serious happens. Your broker can check what your existing policy includes and where the gaps are.