FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Insurance explained
Cyber insurance incident response is the service in a cyber policy that puts a hotline, breach coach, forensic investigators and communications specialists at your disposal when an attack happens. It matters because how you use it in the first hours shapes both the recovery and whether costs are covered.
Part of: Commercial insurance
In short
Most cyber policies include an incident response service reached through a hotline, often 24/7. Calling it usually brings in a breach coach, commonly a law firm, who coordinates forensic IT, data recovery, notification and PR specialists from the insurer's panel. Policies commonly require you to use the panel or get consent before appointing your own vendors, and some waive the excess for early response costs. Ransom negotiation, where included, is subject to consent and sanctions checks. Keep logs, a timeline and invoices: insurers need them, and the UK GDPR requires every personal data breach to be documented.
Most cyber policies have two halves: money for losses and liabilities, and a service that helps you deal with the incident itself. The service part is what people mean by incident response. It usually starts with a hotline, often available around the clock, that you call as soon as you suspect an attack.
A typical sequence runs like this:
For the business side of those same hours, see what to do after a cyber breach in the first 72 hours, and for how the specialists coordinate, cyber breach response coordination.
| Service | Usually covered | Commonly limited or excluded |
|---|---|---|
| 24/7 hotline and triage | Usually, as part of the policy | Advice outside the scope of an actual incident |
| Breach coach (legal) | Legal coordination and regulatory advice | Defence of unrelated disputes |
| Forensic investigation | Finding cause and scope | Fixing old weaknesses or upgrading systems |
| Data restoration | Restoring or recreating data | Improving systems beyond their former state |
| Notification and credit monitoring | Costs of telling affected people | Sub-limits may apply |
| PR and crisis communications | Advice to limit reputational harm | Long term marketing to win back trade |
| Ransomware negotiation | Specialist negotiators, if extortion cover is included | Payments without insurer consent or sanctions checks |
Regulatory fines are a separate question; some may not be insurable at all. Our breakdown of what cyber insurance actually pays for sets out the main cost heads, and GDPR fines versus civil claims looks at insurability.
Most insurers maintain a panel of pre-approved breach coaches, forensic firms and PR advisers. Policies commonly say you must use the panel, or get the insurer's written consent before appointing your own vendor or incurring costs. If you go it alone, the insurer may refuse those fees or cap them at panel rates. Some policies allow named vendors you already use if agreed in advance, so it is worth asking at renewal.
Many policies waive or reduce the excess for the early hours of response, or treat hotline and triage costs separately from the main deductible, to encourage you to call early. This varies widely and is subject to the policy terms; some apply the full excess from the first pound.
Consent is also central to ransomware. Insurers usually require that any payment is discussed with them first and screened against sanctions. OFSI's financial sanctions guidance for ransomware says making funds available to a designated person through a ransom is a serious criminal offence, and that the government does not encourage or condone ransom payments. See ransomware across cyber, property and BI.
Breach coaches are often instructed so that forensic findings are commissioned for the purpose of legal advice. That may help protect sensitive reports under legal professional privilege, but privilege is never guaranteed and depends on how the work is set up and used. Your breach coach can advise on keeping the right separation.
Insurers and their responders usually ask for:
These records also support your own legal duties. Article 33 of the UK GDPR requires a controller to document every personal data breach, its effects and the remedial action taken, whether or not it is reported. The regulator expects a report within 72 hours of discovery where a breach is reportable, and allows further detail to follow.
The examples below are illustrative only and are not real cases.
Many businesses treat the hotline as something to ring once the problem is understood. In practice it is designed for the moment of suspicion. Calling early can unlock panel support, keep the policy's conditions satisfied and help meet reporting deadlines. Ringing a day late, after your own IT firm has rebuilt servers, can lose evidence and leave costs outside cover.
The other misunderstanding is that response costs and the cyber limit are separate pots. Under many policies they share one aggregate limit, so a large forensic bill reduces what remains for business interruption or claims.
The NCSC small business response and recovery guide is a useful starting point for an incident plan, and our commercial cyber insurance broker guide covers placement. Apex arranges cyber insurance for UK businesses; a broker reads every enquiry.
A breach coach is usually a specialist lawyer appointed through your cyber insurer when you report an incident. They coordinate forensic, IT, notification and PR specialists, advise on legal duties such as reporting personal data breaches, and help structure the investigation so that, where possible, sensitive findings are covered by legal privilege.
Often only with the insurer's consent. Many cyber policies require you to use panel responders, or to get written agreement before appointing your own vendor, and may otherwise refuse or cap those costs. Some insurers will pre-approve an existing provider if you ask before an incident. Check your policy conditions.
It depends on the policy. Many cyber wordings waive or reduce the excess for the early hours of response, or for hotline and triage costs, to encourage early reporting. Others apply the full excess. The schedule and wording will say which applies, so it is worth confirming at renewal.
Some cyber policies include extortion cover, but payment is usually subject to insurer consent, legal advice and sanctions screening. OFSI says breaches of financial sanctions, including paying a ransom to a designated person, are a serious criminal offence, and the government does not encourage or condone payments. Many incidents are resolved by restoring from backups instead.
As soon as you suspect an incident. Policies commonly require prompt notification, and the panel can help preserve evidence and meet the UK GDPR expectation to report reportable personal data breaches within 72 hours of discovery. Waiting until the problem is understood can put cover at risk.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
