Why Indian Businesses Need Cyber Insurance
With the DPDP Act in force and breach costs averaging ₹17.6 crore, cyber insurance has moved from "nice to have" to essential risk management for Indian businesses.
₹450 CrIndian cyber insurance market size in 2025 (IRDAI Annual Report)
67%YoY growth in cyber insurance policies in India (Swiss Re 2025)
₹17.6 CrAverage breach cost in India — what insurance can cover (IBM 2025)
12%Of Indian businesses with cyber insurance (vs 47% in the US) (DSCI 2025)
What Does Cyber Insurance Cover?
| Coverage | What's Included | Typical Limit |
|---|---|---|
| First-party costs | ||
| Incident response | Forensic investigation, containment, recovery | ₹50L - ₹5Cr |
| Business interruption | Lost revenue during downtime | ₹25L - ₹3Cr |
| Data restoration | Cost to recover/rebuild data from backups | ₹10L - ₹1Cr |
| Ransom payments | Ransomware payment (controversial but covered) | ₹25L - ₹2Cr |
| Third-party costs | ||
| Legal liability | Lawsuits from affected customers/partners | ₹50L - ₹10Cr |
| Regulatory fines | DPDP Act, CERT-In penalties | ₹25L - ₹5Cr |
| Notification costs | Notifying affected individuals, credit monitoring | ₹10L - ₹50L |
| PR/crisis management | Reputation management, media response | ₹5L - ₹25L |
WARNING
Not all policies are equal. Some exclude ransomware payments, some exclude regulatory fines, and most exclude "acts of war" (which some insurers have stretched to include nation-state attacks). Read the exclusions carefully.
What Insurers Want to See (Before Issuing a Policy)
graph TD
A[Apply for
Cyber Insurance] --> B[Insurer
Risk Assessment] B --> C{Security Controls
in Place?} C -->|Yes| D[Lower Premium
Better Coverage] C -->|Weak| E[Higher Premium
Exclusions Added] C -->|None| F[Application
Denied] style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style E fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Cyber Insurance] --> B[Insurer
Risk Assessment] B --> C{Security Controls
in Place?} C -->|Yes| D[Lower Premium
Better Coverage] C -->|Weak| E[Higher Premium
Exclusions Added] C -->|None| F[Application
Denied] style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style E fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Security requirements that lower your premium
| Control | Premium Impact | Why Insurers Care |
|---|---|---|
| Recent VAPT report | -15 to -25% | Proves you know your vulnerabilities |
| MFA on all systems | -10 to -15% | Prevents majority of account compromises |
| Endpoint detection (EDR) | -10% | Catches malware early |
| Email security (SPF/DKIM/DMARC) | -5 to -10% | Prevents phishing/BEC |
| Employee training | -5% | Reduces human error |
| Incident response plan | -10 to -15% | Shows preparedness |
| Encrypted backups | -10% | Enables recovery without paying ransom |
| Patch management process | -5 to -10% | Prevents known vulnerability exploitation |
TIP
A recent VAPT report is the single most impactful document for reducing your cyber insurance premium. Insurers see it as proof that you're actively managing your security posture. Some insurers won't even quote without one.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanCyber Insurance Cost in India
| Company Size | Annual Revenue | Typical Premium | Coverage Limit |
|---|---|---|---|
| Startup (< 50 employees) | < ₹10 Cr | ₹50K - ₹2L | ₹50L - ₹2Cr |
| Small business (50-200) | ₹10-50 Cr | ₹2L - ₹8L | ₹1Cr - ₹5Cr |
| Mid-market (200-1000) | ₹50-500 Cr | ₹8L - ₹25L | ₹5Cr - ₹25Cr |
| Enterprise (1000+) | > ₹500 Cr | ₹25L - ₹1Cr+ | ₹25Cr - ₹100Cr+ |
Key Insurers in India
| Insurer | Product Name | Notable Features |
|---|---|---|
| HDFC ERGO | Cyber Sachet | Business-focused, accessible |
| ICICI Lombard | Cyber Risk Insurance | Comprehensive, good claims track record |
| Bajaj Allianz | Cyber Insurance | Includes social media liability |
| Tata AIG | Cyber Enterprise Risk | Enterprise-grade coverage |
| New India Assurance | Cyber Insurance | Government-backed, wide network |
Common Exclusions to Watch For
| Exclusion | What It Means | Impact |
|---|---|---|
| Pre-existing vulnerabilities | Vulns known before policy start aren't covered | Run VAPT before buying insurance |
| Unpatched systems | Systems not updated within vendor timelines | Keep patches current |
| War/terrorism | Nation-state attacks may be excluded | Negotiate this clause |
| Criminal/fraudulent acts | Insider theft by owners not covered | Standard exclusion |
| Contractual liability | Breach of SLAs with clients | May need separate coverage |
The VAPT-Insurance Connection
Key Takeaway
VAPT and cyber insurance are complementary, not alternatives. VAPT reduces your risk (prevention), and insurance covers the residual risk (protection). Together, they form a complete risk management strategy. Plus, a clean VAPT report significantly reduces your premium — often paying for itself many times over.
Getting Started
- Run a VAPT scan first — Fix critical vulnerabilities before applying for insurance
- Document your security controls — MFA, encryption, backups, training
- Get multiple quotes — Compare at least 3 insurers
- Read exclusions carefully — Understand what's NOT covered
- Review annually — Update coverage as your business grows
INFO
Start with a free VAPT scan to understand your risk posture before shopping for cyber insurance. Visit bachao.ai — the report helps insurers assess your security maturity and can directly lower your premium.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Contact: ceo@bachao.ai. Follow me on LinkedIn for cybersecurity and risk management insights.
