For most of the past decade, boards asked their technology leaders a single question about cyber risk: Are we secure? The reality is that there is no definitive answer, because no organisation can ever be entirely secure.
Today, a more pertinent question is finding its way into boardrooms, audit committees and risk discussions: If we are attacked tomorrow, who pays, how much and how quickly? For generations, boards have addressed these questions for risks such as fire, flood and cargo losses through their general insurance programmes. Yet when it comes to cyber risk, many organisations are confronting this challenge for the first time
What a breach costs today
The average cost of a data breach in India has risen to ₹25.5 crore, according to IBM’s Cost of a Data Breach Report 2026 released in August. This is the highest average breach cost ever observed in the country, representing a 15.9% increase over last year’s ₹22 crore.
The impact is even more pronounced in financial services, where the average cost of a breach reached ₹40.9 crore, nearly 60% higher than the national average. The report also highlights the financial value of AI and automation in cybersecurity; organisations with no AI or automation in their security operations incurred average breach costs of ₹31.6 crore, compared with ₹21.3 crore for those with extensive deployment.
Importantly, these figures represent averages, not worst-case scenarios. A board that plans only for the average loss remains exposed to the financial consequences of a severe cyber event.
Most of that loss is uninsured
Most cyber losses are borne by the organisations that suffer them, not by insurers. Munich Re estimates global cyber insurance premiums at nearly USD 15 billion in 2025, while its Cyber Insurance: Risks and Trends 2026 report states that the majority of cyber risk remains uninsured. By contrast, 48% of global natural catastrophe losses in 2025 were insured.
Fire, marine and motor insurance are routinely purchased, often because lenders or statutory requirements make them necessary. Cyber insurance, however, is rarely subject to such requirements, leaving the decision with the board.
Existing policies rarely respond
A common boardroom assumption is that existing insurance policies will respond to a cyber event. In many cases, they will not, because each line of insurance is designed to address a different category of risk.
Property insurance is built around physical damage, meaning data loss or business interruption without tangible damage is often excluded. Crime policies may respond to fraudulent fund transfers, although social engineering losses frequently require a specific extension. Directors’ and officers’ liability insurance may respond to claims of poor cyber oversight but does not cover the organisation’s own breach-related costs.
As policy wordings vary, boards should assess how different cyber loss scenarios align with their existing insurance programme and identify any gaps in protection.
What a cyber policy pays for, and where it stops
A cyber policy has two components. First-party cover addresses the insured’s own costs, including forensic investigation, data restoration, business interruption and extortion response. Third-party cover responds to liabilities owed to others, including privacy claims and the cost of defending regulatory proceedings.
First-party losses account for 62% of the cyber claims, with business interruption among the principal drivers. As a result, the business interruption section deserves as much scrutiny as the headline policy limit.
Directors should also understand the policy’s boundaries. Ransomware and supplier outages often carry sub-limits, business interruption cover applies only after a waiting period, and war or state-backed cyber-attacks are commonly excluded. The Digital Personal Data Protection Act provides for penalties of up to ₹250 crore for failing to maintain reasonable security safeguards. Whether such penalties are insurable depends on the law and the specific policy wording, and boards should not assume that cover will be available.
Underwriting as an early warning
Buying cyber insurance is itself a test of preparedness. Underwriters typically assess controls such as multi-factor authentication, offline backups, patch management, and the effectiveness of incident response planning. These are also the controls that help reduce losses: IBM’s study found that offensive security testing reduced the average cost of a breach in India by ₹2.47 crore.
Boards can view the insurer’s proposal form as a low-cost external benchmark of cyber resilience. Decisions on policy limits should be driven by modelled loss scenarios rather than last year’s renewal. Insurance is designed to absorb severe losses and works best when complemented by the controls that help prevent more frequent incidents.
Board Checklist: Cyber Insurance Readiness Boards can use the following checklist to assess whether their insurance programme is aligned with the organisation’s cyber risk exposure:
- Quantify the risk: Have we estimated the financial impact of our three most severe cyber scenarios, and what proportion of those losses is insured?
- Review existing coverage: Which of our current insurance policies would respond to a cyber event, and where do coverage gaps or cyber exclusions exist?
- Check policy limits: Was our cyber insurance limit set based on a structured loss assessment, or did we roll it over from the prior renewal?
- Understand key restrictions: What sub-limits, waiting periods, deductibles/retentions, and exclusions apply to ransomware or business interruption losses?
- Test incident readiness: Have we conducted a cyber incident exercise involving our insurer, response partners and key internal stakeholders?
From security to solvency
Cyber risk cannot be eliminated, but it can be measured, priced and financed like any other insurable peril. The real test of resilience is not whether an organisation can avoid every attack, but whether it can absorb the financial impact when one succeeds.
A board that asks whether it is financially prepared should expect an answer in rupees, backed by quantified loss estimates and an insurance programme designed to respond when it matters most.
