Cyber insurance for businesses: reach the insurer prepared and with the right partner

We don't sell insurance: we're the technical team that helps you buy it well. We put you in touch with brokers and insurers specialised in cyber risk that we work with, verify the controls you are about to declare in the questionnaire and help you close the ones missing. You reach underwriting with a better risk profile and with a policy that responds when it matters.

Buying cyber insurance is easy. Getting it to pay out when you need it is not

A cyber insurance policy —also called cyber risk insurance or cybersecurity insurance— covers the first-party losses and third-party liability a cyberattack leaves behind: incident response, data and system recovery, business interruption or claims over a data breach. But it is underwritten on a technical questionnaire: multi-factor authentication, isolated backups, endpoint protection, patching, remote access, training and a response plan. What you declare becomes part of the contract, and under Article 10 of the Spanish Insurance Contract Act, if the declaration was inaccurate the payout is reduced proportionally and, in case of fraud or gross negligence, the insurer is released from paying. Most companies fill that questionnaire in without being able to check their answers, and find out the difference on the day of the claim. We cover the technical side; you buy the policy from the broker or insurer that best fits your company.

What we do and what your insurer does

Introductions to brokers specialised in cyber risk and insurers with a cyber product that we work with, matched to your sector, size and risk
Technical pre-check of the controls underwriting questionnaires ask about: MFA on email, remote access and admin accounts, isolated backups, EDR, patching and Internet exposure
Support answering the underwriting questionnaire with verified data rather than assumptions
A prioritised remediation plan to close in time the gaps that raise the premium or trigger exclusions
Technical evidence for underwriting and renewal: a vulnerability assessment or perimeter penetration test, with a report
An incident playbook aligned with what the policy requires: who to call, when to file the claim and how to preserve evidence
The policy, its price and its terms are offered and managed by the broker or insurer: QuantumSec is not an insurance intermediary and does not collect the premium

How we work

Initial assessment: In a 30-minute call we look at your sector, size, the data you handle, whether you already have a policy and what the insurer or your client has asked for.
Controls review: We technically check what underwriting questionnaires ask. The result is a clear list of what you can declare today with evidence and what you cannot yet.
Closing the gaps: We prioritise what weighs most in underwriting —MFA, backups, EDR, patching and remote access— and, if needed, run a vulnerability assessment or a pentest that serves as evidence.
Introduction to the right partner: We introduce you to the broker or insurer that best fits your profile, with your technical position documented so underwriting moves faster.
Support during the policy term: We refresh the evidence for each renewal and leave the incident procedure ready so the claim is filed on time and with proof.

What you get

A controls report against what insurers ask: what you meet, what you do not and with what evidence
A technical draft of the questionnaire answers, checked against how your systems really are
A remediation plan ordered by impact on underwriting
A vulnerability assessment or penetration test report, when the scope includes it
An introduction to the partner broker or insurer that fits your case
An incident response procedure compatible with the policy obligations

When can we help?

You are buying your first cyber insurance policy and don't know who to ask or what they will ask you
The insurer has sent you a technical questionnaire and you can't answer it with confidence
At renewal your premium went up, cover was cut or exclusions were added
You were declined cover for not meeting the minimum controls
A client, a contract or a public tender requires you to hold cyber insurance
You suffered an incident and want to reach the next renewal with the problem fixed and documented

Cyber insurance FAQ

What is cyber insurance?

It is a policy that covers the financial consequences of a cyberattack or a data breach: the company's own losses and its liability to third parties. Cyber insurance, cyber risk insurance and cybersecurity insurance are different names for the same kind of product. It does not prevent the attack: it complements security measures, it does not replace them.

What does cyber insurance cover?

It depends on the policy, but it usually groups three blocks. First-party losses: incident response and forensics, data and system recovery, business interruption, crisis management and notification of affected people, and in some policies ransomware extortion. Third-party liability: claims from clients or employees over their data and legal defence, sometimes including defence in data protection penalty proceedings. And fraud: CEO fraud or supplier impersonation, often with its own sublimit or as an extension.

What does it usually not cover?

Exclusions vary, but the most common are incidents prior to the policy or already known when buying it, deliberate damage, attacks attributed to a state or in a war context depending on each wording, system upgrades after the incident, and claims where a declared control was not in place. It is worth reading the exclusions before the cover.

How much does cyber insurance cost?

Rates published by insurers and brokers in Spain range from a few hundred euros a year for sole traders and micro-businesses to several thousand for a mid-sized SMB, and go much higher for large companies or regulated sectors. The real figure comes out of the questionnaire: turnover, sector, volume of personal data, limit of indemnity, deductible, claims history and, above all, the security controls you can prove.

What do insurers require before issuing a policy?

Questionnaires repeat themselves a lot: MFA on email, remote access and admin accounts; isolated or immutable backups with tested restores; EDR on endpoints; patching critical vulnerabilities within short timeframes; no remote desktop exposed to the Internet; phishing training and an incident response plan. Without MFA, many insurers will not even quote.

Is cyber insurance mandatory in Spain?

There is no general legal obligation. Neither NIS2, DORA nor the GDPR require you to buy it. In practice it can be mandatory by contract: more and more large clients, public tenders and critical service providers ask their suppliers for it as a condition.

Which is the best cyber insurance for my company?

There is no best one in the abstract: it depends on your risk. When comparing offers, price and total limit matter less than the sublimits (ransomware, fraud, business interruption), the deductible, the waiting period before business interruption pays out, the 24/7 response service and its provider panel, retroactive cover and the exclusions. The comparison and the policy recommendation are made by the broker; we help you arrive with your technical position clear so that comparison is real.

Does insurance pay a ransomware ransom?

Some policies cover extortion, usually with a sublimit and with the insurer’s prior approval. It cannot be paid to people or groups on EU sanctions lists, and in most cases the preferred route is to recover from clean backups. That is why insurers care so much about backups being isolated and restores being tested.

What happens if I declare a control I don't have?

The questionnaire is the basis of the contract. Under Article 10 of the Spanish Insurance Contract Act, if the declaration was inaccurate and a claim arrives before it is corrected, the payout is reduced in proportion to the premium that would have been charged knowing the real risk, and in case of fraud or gross negligence the insurer is released from paying. That is why each answer should be verified before signing.

Do you sell the insurance?

No. QuantumSec is neither an insurer nor an insurance intermediary: we do not sell policies, collect premiums or recommend a specific insurance product. We put you in touch with specialist brokers and insurers we work with, and the purchase and the advice on the policy come from them. Our job is the technical side: making sure what you declare is true and that your company meets what the insurance requires.

Does a pentest or vulnerability assessment lower the premium?

It can improve the terms, because it turns a declaration into evidence and reduces the risk the insurer perceives, but the premium decision is always theirs. What it does guarantee is that what you declare holds up: it is the best insurance for the insurance itself.

What should I do if I suffer a cyberattack and have a policy?

Call the policy's assistance line first, before hiring anyone on your own: many policies work with a provider panel and will not cover an outside provider's costs without authorisation. Isolate the machines without wiping or reinstalling them, keep the logs, file the claim within the policy deadline and, if personal data is affected, remember the notification to the data protection authority is due within 72 hours.

Related resources

Sources

Talk about my cyber insurance