Frequently Asked Questions (FAQ)
The following are the questions readers ask most often. The answers are general insurance information explanations and not product recommendations; the actual coverage of an individual policy should be based on the original wording.
About This Site
Is this website the official website of an insurance company?
No. This site is established by HK.Insure and is an information and education platform focused on Hong Kong cyber security insurance and artificial intelligence risk; it is not the official website of any insurance company.
Can I take out cover or obtain a quotation through this site?
No. This site does not sell insurance products, provide quotations, or arrange cover, nor does it constitute any offer or solicitation. If you need cover or wish to understand premiums, please contact an insurer or your licensed insurance intermediary directly.
Can this site's content be used as a basis for a cover decision?
No. This site's content is general explanation and cannot replace the original wording of an individual policy. Whether a particular situation is covered, and how much will be paid, is always determined by the insurer's underwriting and claims decision for that specific case. See Sources and Disclaimer for details.
How often is the content updated?
We publish AI and cyber risk developments every working day, and revise existing articles as the market and regulation change. Every article shows its last updated date at the foot of the page.
May articles be reposted?
Citation is welcome with attribution and a link. Please do not reproduce in full, adapt for profit, or use misleadingly.
Basic Concepts of Cyber Insurance
What is cyber security insurance?
Cyber Security Insurance covers losses a business incurs from cyber incidents — such as ransomware, data breaches and business email compromise. It covers both the business's own losses (first-party) and its liability to third parties (third-party), and typically includes incident response services.
What is the difference between first-party coverage and third-party liability?
- First-party coverage: Compensates the business's own losses, such as incident response costs, business interruption losses, and data restoration and system repair.
- Third-party liability: Compensates the business's liability to clients, business partners or regulators, such as notification costs, legal liability and compensation following a client data breach.
Does cyber insurance cover ransomware and ransom payments?
Most cyber policies cover losses caused by ransomware, including system restoration and business interruption. But whether the ransom itself (payment to the attacker) is covered, and whether a sub-limit applies, varies by policy; some carriers also require forensic and compliance review before payment. The actual arrangement should be based on the wording.
How is the premium determined?
The cyber insurance premium mainly depends on the outcome of a risk assessment, and is generally related to the following factors: the industry and degree of regulation, the volume of personal data held, the security controls deployed (multi-factor authentication, endpoint detection and response, offline backups, etc.), past cyber incident history, and the chosen coverage limit and deductible. For the same coverage, different carriers can differ markedly because of their risk pools and pricing strategies.
What are sub-limits and deductibles?
- Sub-limit: A separate compensation cap set under the overall limit for a specific coverage item (such as incident response, business interruption, ransom), usually non-fungible.
- Deductible / Excess (also called the bottom-line retention): The amount the insured must bear for each claim, with the insurer paying only the portion above it. The higher the deductible, the lower the premium usually is.
What should a business prepare before taking out cover?
Carriers usually require an underwriting questionnaire covering: a security controls checklist (multi-factor authentication, backup strategy, staff training), past incident history, and the type and volume of data. Strengthening controls before applying helps both with underwriting approval and with lowering the premium.
Incidents and Claims
After a cyber incident, what response costs does insurance cover?
Typical incident response costs include: digital forensics, legal advice, public relations and crisis management, notification and credit monitoring for affected customers, and system and data restoration. These are mostly first-party coverage, carried out by a specialist team arranged under the policy.
Is business interruption loss covered?
Yes, Business Interruption is one of the core first-party covers in cyber insurance, covering lost profits or fixed expenses during the period systems are down due to an insured incident. But there is generally a waiting period and a sub-limit, and the loss must be proven to be directly caused by the insured incident.
Is third-party liability for a client data breach covered?
Yes. Third-party liability covers the compensation, notification and compliance costs a business must bear towards clients or regulators following a data breach. Hong Kong's Personal Data (Privacy) Ordinance (PDPO) requires data users to take practicable steps to safeguard personal data; breach may trigger penalties, and the related costs may be shared by third-party liability coverage.
How long does a claim generally take?
It depends on the complexity of the case, the time needed for forensics and liability determination, and whether documents are complete. Cyber incidents usually involve digital forensics and third-party liability investigation, so they take longer than ordinary property claims; cases with complete documents and clear facts are usually completed faster.
Are AI-related losses covered?
It depends on whether the policy contains an AI exclusion clause. Some carriers exclude "legal liability arising from the use or deployment of artificial intelligence"; other carriers (such as some local virtual insurers) proactively include AI-related cyber risk within coverage. Standalone AI liability insurance is currently found mainly in the US and Lloyd's markets. The AI-related wording in the policy should be checked carefully before taking out cover.
Business and Regulation
Do small and medium enterprises need cyber insurance?
Yes. Cyber attacks do not target only large enterprises; SMEs are often targeted precisely because they have fewer security resources. Several carriers have launched SME solutions with relatively lower thresholds and premiums. For businesses relying on digital systems or holding customer data, cyber insurance is an important part of risk transfer.
What does the Protection of Critical Infrastructures (Computer Systems) Ordinance mean for businesses?
The Ordinance came into effect on 1 January 2026, imposing three categories of statutory duty — governance structure, prevention, and incident notification and response — on designated critical infrastructure operators, covering sectors such as energy, information technology, banking and financial services, transport, healthcare, and communications and broadcasting. Regulated entities face higher requirements for cyber resilience, which also indirectly raises their demand for cyber insurance and incident response capability. See Hong Kong Implementation (Guide) for details.
Couldn't Find Your Answer?
- Browse the Insurance Glossary or the Cyber Security and AI Insurance Section
- Read the Daily AI and Cyber Risk News
- Submit your question via the Contact Us page