Cyber insurance for SMEs in Switzerland

Cyber insurance protects companies against the financial consequences of cyber attacks or data breaches (data discontinuity). It covers a wide range of risks, including data loss, business interruption, ransomware extortion and reputational damage, as well as the costs of reporting data breaches and legal representation.

Typically, cyber insurance covers the costs of restoring data, third-party liability claims due to data breaches, loss of earnings and additional costs due to business interruptions, ransom payments in the event of ransomware attacks, as well as public relations and crisis management.

The cost of cyber insurance depends on the size of the company, the industry, the type and scope of the data, the deductible and the scope of cover. The premium can cost anywhere from a few hundred to several thousand Swiss francs per year. The basic version of our cyber insurance, for example, costs CHF 410 per year.

Any company that processes, stores or sends sensitive data such as customer data, payment information, intellectual property or other confidential information is at risk. Just like all companies with business-critical processes that depend on their IT. Cyber attacks and data breaches are on the rise. Cyber insurance can help to cover financial losses and the costs of data recovery, legal liability or reputational damage, and ensure ongoing business operations. This is particularly true for SMEs without their own IT security department or with too few resources, but who need access to specialists around the clock.

The number of cyber attacks is increasing from year to year. A data breach can result in high costs, significant outlay and reputational damage that threatens the company's existence. That's why cyber insurance is a sensible investment in risk management for any company, regardless of its size.

Contact our business insurance specialists or your agent and request a free, customized quote.

You can also take out cyber insurance for companies online. 

As a rule, you must disclose details about your business operations, the type and scope of data stored and processed, IT infrastructure, security policies and processes, as well as previous cyber attacks and security incidents.

• Willful act: If a member of executive management intentionally damages the IT system, this may be considered a willful act, which may not be covered by the insurance. For example, if the employee deliberately deletes or steals sensitive data. If the employee is not a member of executive management, the loss would be covered.
• Breaches of obligations: The breach of contractual insurance obligations can lead to the rejection of benefits. For example, if a company does not take the necessary security measures to protect its computer network.
• Known data breaches: Claims arising from events that occurred before the start of the insurance can be excluded. For example, if cyber insurance is only taken out after an attack.
• Bodily injury and property damage: Cyber insurance covers financial damage and not bodily injury or property damage. For example, there is no insurance coverage if a hacker attack leads to a power failure and production machines are damaged as a result.
• Economic value: The economic value of software and data licenses or a trade secret is not covered if, for example, the data is stolen and published and the company loses its market advantage.
• War and terrorism: Damage caused by acts of war or terrorism is generally not insured. For example, a hacker attack during a war or an attack on the IT system. Cyber terrorism is excluded from this.

The exact exclusions and conditions of cyber insurance can be found in the General Conditions of Insurance (GCI) under "Downloads"

• Phishing emails and malware attacks are one of the biggest threats to SMEs. Hackers can use fake emails or infected attachments to gain access to company networks and data.
• Ransomware attacks are becoming increasingly common. Hackers encrypt data and demand a ransom for its release. This can lead to considerable financial losses and business interruptions.
• Employees can pose a significant risk to a company's IT security and data privacy. Accidentally or intentionally, they can steal sensitive data, sabotage systems or pass on information to outsiders.
• The loss of sensitive data can have serious consequences, whether due to hackers, technical errors or human error. And this can result in legal, financial and reputational damage.
• Social engineering: By manipulating employees, cyber criminals can gain access to systems and data. For example, with techniques such as spear phishing, CEO fraud or identity theft.
• Vulnerabilities and security gaps in software and systems are constantly being discovered. If companies do not regularly update and patch their IT and programs, attackers can exploit these vulnerabilities and security gaps.
• The use of cloud services brings with it new security risks. Insecure configurations, inadequate access controls or data leaks can lead to data loss.

• Up-to-date and patched systems: Make sure that all operating systems, applications and programs are up to date and that patches are installed regularly to close security gaps.
• Strong passwords and access control: Use strong and unique passwords, if possible with two-factor authentication. Restrict access to sensitive data and systems to authorized persons.
• Training: Sensitize all employees to phishing emails, social engineering and other attack techniques. Conduct regular training and awareness campaigns to raise security awareness. Zurich offers such training courses.
• Firewall and antivirus software: Install a firewall and anti-virus software on all devices and networks to block unwanted traffic and malware.
• Data backup with recovery plan: Carry out regular backups of your data and create a well-documented and tested recovery plan.
• Network security: Monitor your network with an intrusion detection or prevention system (IDS/IPS) and other security solutions to detect and ward off attacks.
• External service suppliers: Ensure that your partners have implemented appropriate security measures and comply with contractually agreed security standards.
• IT contingency plan: Create an incident response plan that includes clear responsibilities and steps for containing the attack, recovering data and communicating with those affected.
• Business continuity plan: Create a plan that ensures that the company can maintain its business-critical processes even in an emergency or crisis.
• Cyber insurance: Take out cyber insurance to cover the financial damage and costs of cyber attacks and data privacy breaches.