Do You Need Cyber Insurance? What It Covers, Costs and Demands for Singapore SMEs

Cyber insurance is fire insurance for your data and systems: it pays for the bad week — forensics, recovery, legal advice, customer notification, sometimes lost income — after an incident. For a Singapore SME, published 2026 rates put a typical policy at roughly S$900–3,000 a year for S$500K–2M of cover, and small-firm premiums have roughly halved since 2022 as more insurers compete; finance, healthcare and anyone holding sensitive data pay more. The catch owners miss: insurers now inspect your locks before they pay. No MFA, no endpoint protection, no tested backups — and the claim that looked covered gets denied. Here's what it covers, what it costs, what it demands, and whether you need it.

What it actually pays for

Think of the morning after a ransomware incident. A good policy covers the bills that arrive that week:

• Incident response and forensics — specialists who work out what happened and get you running again. The single most valuable item: the insurer's panel knows who to call at 2am; you don't.
• Data recovery and system rebuild — the IT hours and replacement costs of restoring systems.
• Legal, regulatory and notification costs — PDPA breach assessment, lawyer's fees, contacting affected customers. The part SMEs underestimate most.
• Business interruption — lost income while you're down, usually after a waiting period and up to a cap.
• Third-party liability — claims from clients whose data you lost.

Ransom payments themselves are covered by some policies and excluded by others — and increasingly conditional. Read that clause specifically; don't assume.

What it won't pay for (the clauses that bite)

• Claims where the controls you declared weren't actually in place. If the proposal form says "MFA on all email accounts" and the breach came through the one director's mailbox without it, expect a fight. In one documented US case, an insurer refused a ransomware claim and went to court to void the policy after forensics showed the MFA the company had declared was missing on the server where the attack began.
• Social-engineering transfers, often capped low. The deepfake-CFO wire transfer we wrote about may sit under a separate "funds transfer fraud" sub-limit — commonly in the S$25,000–100,000 range for smaller firms, broker guides suggest — not the headline cover.
• Betterment. They restore you to how you were, not to how you should have been. The security upgrade after the incident is on you.
• Reputation. No policy returns the client who quietly left.

What insurers now demand before they'll cover you

The proposal form has become a security audit. Across 2026 renewals the standard asks are: MFA on email, remote access and admin accounts; EDR on endpoints (antivirus alone increasingly fails the question); backups that are separated from production and actually tested; a written incident response plan; and staff phishing training. Insurers are also moving from "tick the box" to "show us" — evidence of MFA enforcement, the date of your last restore test. If you've worked through our 15-point checklist, you've already done the form.

This is the part most owners get backwards: insurance isn't an alternative to the security basics. It's the reward for having done them — priced accordingly.

What it costs a 30-person Singapore company

Published 2026 rates for a bank-distributed SME policy run roughly S$900–3,000 a year — call it S$75–250 a month — for S$500K–2M of cover at a 30-person company's typical revenue, with broker guides quoting up to S$8,000 for larger or higher-risk firms and sensitive-data industries paying 20–40% more. Premiums move with your controls: the same company with MFA, EDR and tested backups pays less than its careless twin, and may be the only one of the two that gets offered a policy at all. Set the premium against your downtime number: at S$1,700 an hour, a policy that funds a fast professional response pays for itself if it shortens one incident by a single day. Treat these ranges as a starting point for a broker conversation, not a quote.

Do you need it? An honest filter

Probably yes if you hold customer personal data at scale, depend on systems to earn revenue daily, have clients who could sue you over their data, or couldn't absorb a S$100,000+ bad month from cash. Probably not yet if you're a handful of people with little stored data and the premium would starve the basics — in that case, spend the money on MFA, EDR and backups first; you'll get a better policy later anyway.

Self-check: if ransomware hit tonight, do you know who you'd call at 7am tomorrow, and could you fund a S$50,000 recovery from cash without touching payroll? Two no's is the answer.

Frequently asked questions

Does my general business insurance already cover this?

Usually not — most general liability and property policies exclude cyber events or cap them trivially. Ask your broker to show you the clause rather than reassure you.

Will insurance pay the ransom?

Depends on the policy and increasingly on conditions. Plan on the assumption that it won't, and that paying is a last resort even when it would — tested backups are what make the question irrelevant.

Can I get cover without MFA or EDR?

Increasingly no — or only with exclusions that remove the point. Fix the controls first; it's cheaper than the premium difference.

Does Cyber Essentials help?

Yes. The Cyber Essentials mark covers the same five control areas the proposal form asks about, and a current certificate is clean evidence instead of a self-declaration.

Send this to your broker — and this to your IT provider

Two messages, because the two conversations depend on each other. To your broker:

Hi — I'd like indicative cyber insurance terms for a [number]-person company in [industry] holding roughly [number] customer records. Please include: what the policy covers for incident response, data recovery, PDPA notification and business interruption; whether and how ransom payments are treated; the sub-limit for funds-transfer fraud; and the exact security controls you require us to confirm. Please send the proposal form so I can have our IT provider complete the technical section accurately.

To your IT provider, with the proposal form attached:

Hi — please complete the technical section of this cyber insurance form truthfully and tell me which answers are currently "no". For each gap (MFA coverage, EDR, backup separation and last restore test, incident plan), give me a cost and timeline to close it before we submit. I'd rather fix it now than discover it during a claim.

Our approach

We don't sell insurance, and we're not brokers. What we do is make the proposal form easy: for managed IT clients the controls insurers ask for are already running, and we complete the technical section with the evidence attached. Not sure what you'd be able to truthfully tick today? Book a discovery call and we'll walk the form with you — before an insurer does.