Cyber insurance cost: what South African businesses pay

Your accountant sends the renewal schedule across, you look at the cyber insurance premium line, and the number is roughly what you expected to spend on the photocopier contract. The difference is that the photocopier contract is negotiable and the cyber risk is not. South African businesses face some of the highest rates of ransomware attack in the world, and the premium an insurer charges reflects their own arithmetic on that exposure: what your industry costs when it goes wrong, how good your controls are, and how much of that risk they're willing to carry for you.

What is cyber insurance cost?

Cyber insurance cost is the annual premium a business pays to transfer the financial consequences of a cyber incident to an insurer. Those consequences include the cost of recovering your systems, the legal liability to third parties whose data was compromised, regulatory fines, and the revenue lost while the business can't trade. The premium isn't a fixed tariff; it is a calculation the insurer runs against your specific risk profile.

Key Takeaways

• Cyber insurance premiums in South Africa aren't standardised. Two businesses with similar turnover can pay very different premiums based on their security posture and industry.
• The factors with the most influence on your premium are annual revenue, the type and volume of data you hold, your industry, and the security controls already in place.
• Businesses with multi-factor authentication, tested backups, and documented incident response plans consistently attract better terms than those without.
• South Africa sits in a market where cyber insurance penetration is low relative to risk exposure, meaning insurers price cautiously on businesses they can't read quickly.
• A cyber insurance questionnaire completed accurately and in detail is the single most effective thing you can do before a quote arrives.

Why South African businesses pay more than the global average suggests

The global cyber insurance market reached approximately $15.3 billion in total premiums in 2024, according to Munich Re market data, growing at a compound annual rate of close to 30 percent. The Middle East and Africa combined account for an estimated $283 million of that total, less than 2 percent of the global cyber insurance market. The premium pool is small. The risk pool is not.

South Africa's exposure is significant and well-documented. The SAIA's own commentary on cybercrime threats identifies cyber incidents as a primary systemic concern for the financial sector, noting the absence of cyber insurance in major breach cases amplifies the damage well beyond the company directly affected. When insurers price a South African risk, they're pricing against a country with high attack frequency and, by international standards, lower baseline security maturity across the SME sector. The result is that your premium often includes a country-risk loading businesses in Germany or Australia don't carry.

This isn't a complaint worth lodging with your broker. It is a fact worth understanding, because the parts of your risk profile you can control are also the parts moving your premium most.

The five factors driving your premium up or down

Every cyber insurer runs a rating model, and most of them look at the same five inputs.

Revenue and company size set the floor. A business turning over R10 million a year represents a smaller potential loss than one turning over R200 million, so the base premium scales with revenue. This is the single figure most insurers use to establish a starting point before they look at anything else.

Industry and data type adjust that floor sharply. A professional services firm holding client financial records attracts different terms than a wholesale distribution business holding supplier invoices. Healthcare businesses, financial services firms, and any business processing payment card data face higher premiums, because the regulatory consequences of a breach in those sectors run to eight-figure territory before litigation begins. The SAIA's 2022 annual review flagged cybercrime as one of the most significant security threats to businesses operating in the Fourth Industrial Revolution, with the financial services sector explicitly named as a priority exposure.

Security controls are where your premium becomes genuinely negotiable. An insurer will rate multi-factor authentication, endpoint detection software, tested offline backups, and a documented incident response plan as premium-reducing factors. A business able to demonstrate all four will pay materially less than an otherwise identical business unable to do so. The reason is blunt: those controls reduce the likelihood of a successful attack and reduce the cost when one gets through anyway.

Claims history travels with you. A business making a cyber claim in the past three years will pay more than a business with a clean record, and some insurers will decline a risk entirely after a second ransomware event without evidence of meaningful remediation.

Indemnity limits and cover structure affect the final number directly. A policy with a R5 million limit costs less than one with a R20 million limit. First-party cover (your own losses) is cheaper than a policy also including third-party liability (claims from customers, partners, or regulators). Most South African SMEs start with a combined first- and third-party policy, because the regulatory and liability exposure is real even for businesses not thinking of themselves as data custodians.

What a typical premium looks like in South Africa

There's no single published tariff for cyber insurance in South Africa, and any broker quoting a number without asking you a cyber insurance questionnaire first is pricing in the dark. The market operates within ranges a well-structured business can expect, however.

Indicative cyber insurance premium ranges by business profile

These figures reflect indicative South African market positioning in 2024 and 2025. They aren't quotes. A business at the lower end of a revenue band with strong controls may pay below the range; one at the upper end with a prior claim and no multi-factor authentication may pay above it.

The global cyber insurance statistics compiled by Security.org confirm the market is growing rapidly and premiums have moderated from the sharp increases of 2021 and 2022 as more capacity entered the market. South African businesses are beginning to benefit from that moderation, though the country-risk loading means the benefit arrives more slowly here than in more mature markets.

How your security controls change the number

The underwriter's view is straightforward: a business doing the security basics is a better risk, and better risks cost less to insure. This isn't a philosophical position; it is arithmetic.

Multi-factor authentication (MFA) is the control moving premiums most consistently. MFA means logging into your systems requires something you know (a password) and something you have (a code sent to your phone or generated by an app). An attacker who steals your password can't use it without the second factor. Insurers have watched enough ransomware claims to know the majority of successful attacks begin with a compromised credential, so a business with MFA on all remote access and email accounts removes the single most common entry point.

Offline or air-gapped backups are the second significant control. A backup living on the same network as the systems it protects gets encrypted alongside those systems during a ransomware attack, which is why so many ransom demands are paid: there is no clean copy to restore from. A tested, offline backup changes the recovery equation entirely. The word "tested" is important; an untested backup is a folder nobody has opened since 2019, and the middle of an incident is a poor time to discover it contains nothing recoverable.

Documented patch management and endpoint detection software round out the controls most underwriters prioritise. A business able to show it updates software promptly and runs detection tools across its endpoints is demonstrating it takes the basics seriously. That demonstration costs less at renewal than the alternative.

The cost of not having cover

The more useful number than the premium is the cost of an uninsured incident. A ransomware event at a mid-sized South African business typically generates four categories of loss simultaneously: system recovery and forensic investigation costs; business interruption losses while systems are offline; regulatory notification costs if personal data was compromised under the Protection of Personal Information Act (POPIA), the South African law governing how businesses collect, hold, and protect personal information, carrying significant penalties for breaches; and third-party liability if clients or partners suffer losses connected to the incident.

The global cyber insurance market data published by Heimdal Security puts the 2025 market at $20.56 billion worldwide, a figure representing actual premiums collected against actual claims paid. The underlying claims data is more instructive: average ransomware recovery costs for mid-market businesses have run into the millions of dollars globally, and South African businesses aren't insulated from that range. A premium of R80 000 a year against a potential uninsured loss of R8 million isn't a difficult calculation. The difficulty is most businesses don't run it until after the incident.

The DTIC's corporate plan for 2026 and 2027 lists cybersecurity breaches explicitly as a material risk to South African commercial operations, alongside climate risk and exchange rate volatility. Businesses yet to place cyber risk in the same conversation as their insurance programme are carrying the exposure on their own balance sheet.

How to position your business for a better premium

The cyber insurance questionnaire is your pricing document, so the work you do before completing it is the work lowering your premium. Start with the controls most insurers weight most heavily: MFA on all remote access, email, and administrative accounts; a tested offline backup on a schedule documented and evidenced; and a written incident response plan naming who calls whom and in what order if a breach is detected at 2am on a Sunday.

None of these require enterprise budgets. MFA is often free or close to it through existing Microsoft 365 or Google Workspace licences. A tested backup requires discipline more than money. An incident response plan requires an afternoon with the right people in a room, not a consultant. The premium saving across a three-year policy cycle for a R50 million revenue business implementing these three controls consistently runs to five figures. The protection they provide runs to eight.

When you complete the questionnaire, answer every question fully and accurately. An underwriter who can't read your risk will price it conservatively. One who can see a well-controlled, well-documented business will price it accordingly. The questionnaire isn't a compliance exercise; it is a negotiation, and the preparation you do before it determines the terms you walk away with.

A shift in how insurers view South African risk

The cyber insurance market here is still maturing, and insurers are still learning how to price South African exposures with precision. That creates a window. Businesses presenting themselves clearly, demonstrating genuine controls, and engaging through a broker who understands the underwriting criteria are consistently getting better terms than the country-risk loading alone would suggest. Businesses getting the worst terms are those arriving at the market unprepared, with incomplete questionnaires, no documented controls, and a vague sense something called cyber cover is probably a good idea.

The market will tighten. It does after a run of significant claims, and the South African claims environment is producing those claims regularly. Businesses investing in their security posture and their insurance presentation now are buying into a market before it reprices sharply. That window doesn't stay open indefinitely.

What the premium is telling you

Most business owners postpone the cyber insurance conversation until someone asks them about it, usually a bank, a lease negotiation, or an IT manager who has read something alarming. The conversation isn't complicated, and the premium for most South African SMEs with reasonable controls isn't prohibitive. What is prohibitive is the cost of the incident arriving before the conversation happens.

The premium is a number. The controls reduce it. The cover limits the damage when the controls aren't enough. None of those three things work in the right direction if the policy doesn't exist.

You shouldn't have to face a ransomware event, a regulatory investigation, or a client claim with nothing but your own balance sheet between you and the loss. With Mont Blanc Financial Services you won't.

Contact Mont Blanc Financial Services to get your cyber risk assessed, your security controls documented, and your cover placed before the next incident makes the conversation urgent.

Cyber insurance premiums raise questions going beyond the annual figure, and the two most common ones are about what drives the number and what information you need to get a quote. The answers are below.

Frequently Asked Questions

How much does cyber insurance cost?

Cyber insurance cost in South Africa depends on your revenue, your industry, your data profile, and the security controls you have in place. A professional services business turning over R10 million to R20 million with multi-factor authentication and tested backups might pay R8 000 to R25 000 per year. A healthcare or financial services business in the R20 million to R100 million revenue range typically pays R60 000 to R200 000 or more, because the regulatory consequences of a breach in those sectors are substantially higher. Manufacturing and logistics businesses with prior claims or weak controls can pay well above those ranges.

The premium isn't a tariff; it is a rating exercise. Two businesses in the same industry with the same revenue can pay very different premiums based on the quality of their controls and the completeness of their cyber insurance questionnaire. The most effective way to understand your own cost is to complete a detailed questionnaire through a broker placing cyber risk regularly, because the quality of the submission determines the quality of the terms you receive. A well-prepared submission can shift your premium band downward by a meaningful margin, particularly for businesses implementing MFA and tested offline backups before the questionnaire is completed.

How much does cyber liability insurance cost?

Cyber liability insurance cost refers specifically to the third-party component of a cyber policy: the cover responding when a breach at your business causes losses to your customers, your partners, or triggers regulatory penalties under legislation such as the Protection of Personal Information Act. This cover sits within a broader cyber policy and isn't typically priced separately for SMEs, though the limit you choose for third-party liability affects the overall premium.

For businesses holding significant volumes of personal data, medical records, payment card information, or client financial records, the third-party liability limit is the part of the policy most needing to reflect the real exposure. A retailer holding transaction records for tens of thousands of customers faces a notification and remediation cost running to millions of rands before any litigation is considered. The cyber liability component of your policy is what absorbs that cost. Choosing a limit based on what the premium looks like rather than what a realistic breach would cost is the underinsurance problem in a different format. Your broker should model at least one breach scenario against your actual customer data volumes to give you a defensible starting point for the limit you choose.

What information is needed to get coverage?

Getting cyber insurance coverage requires completing a questionnaire covering your technical environment and your security controls in detail. Insurers typically ask for your annual revenue, the industries you operate in, the type and volume of personal data you hold, whether you process payment cards, and the jurisdictions you operate in.

On the security side, they want to know whether you have multi-factor authentication on remote access and email, how you manage and test backups, what endpoint protection software you run, whether you have a documented incident response plan, and whether you conduct staff phishing awareness training. They will also ask about your claims history and any known vulnerabilities or incidents in the past three to five years.

The more completely and accurately you answer, the better the terms you receive. An underwriter reading a thorough, evidenced submission is pricing a known risk. One reading a thin or incomplete questionnaire is pricing an unknown one, and unknown risks carry a premium loading accurate disclosure removes. Businesses supplying evidence rather than assertions, such as screenshots of MFA settings or a signed backup test log, consistently get better initial terms than those answering yes without supporting documentation.