Ransomware insurance cover: what businesses need to know

Your accounting software stopped responding at 07:14 on a Wednesday morning. By 07:30 the file server is showing a red lock icon and a text file nobody created. By 08:00 the message inside that file is asking for cryptocurrency, and your IT support person is saying words like "encrypted" and "backup integrity" in a tone suggesting neither is going well. The revenue stopped when the systems stopped, and the cost of getting back in has nothing to do with how good your firewall was last Tuesday. That gap between what the attack costs and what your business can absorb is the problem this cover is designed to address.

What is ransomware insurance cover?

Ransomware insurance cover is the section of a cyber insurance policy responding when criminals lock your digital systems and demand payment to restore access. It typically covers the cost of professional ransom negotiators, the ransom payment where legally permitted, digital forensics, data recovery, and the business income lost while your systems are down. It doesn't replace a cyber security programme, but it funds the recovery when one proves insufficient.

Key Takeaways

• Ransomware attacks encrypt your files and hold your systems hostage; ransomware insurance cover responds to both the recovery costs and the income loss following an attack.
• Cover typically includes ransom negotiation, payment facilitation, forensic investigation, data restoration, and business interruption during the outage.
• South African businesses face measurably elevated cyber attack rates, and the cost of a ransomware event routinely exceeds what most SMEs can absorb without insurance.
• Policy exclusions can void your cover: poor security controls, delayed notification, or attacks attributed to nation-state actors in some wordings can all leave you exposed.
• The cyber insurance questionnaire you complete at inception determines both the premium and whether the policy responds at claim time.
• A broker who reads the wording before you sign is worth more than the cheapest premium on the market.

Why South African businesses face an outsized ransomware threat

South Africa sits near the top of global rankings for cyber attack frequency, and ransomware is the method attackers use most often against business systems here. The South African Insurance Association has documented how the country's financial and commercial sectors are navigating an environment where cyber attack frequency continues to rise, with ransomware incidents capable of reverberating across markets and customer bases in ways individual businesses rarely anticipate until they are inside one.

Part of the reason South African businesses are targeted is structural. Variable power infrastructure, a heavy reliance on remote-access tools adopted rapidly after 2020, and uneven IT security investment across the SME sector create an environment attackers find productive. When the SARB's Prudential Authority reviewed systemic risk after the pandemic, its published analysis identified ransomware attacks alongside data breaches and denial-of-service events as among the most material cyber risks for insurers and their clients to address. The regulator wasn't describing a theoretical exposure.

What this means practically is that your insurer is pricing ransomware risk into your premium whether your policy section on it is comprehensive or not. The question is whether you are getting the cover to match.

What ransomware insurance cover pays for

The coverage under a ransomware-specific section of a cyber policy moves through several distinct phases, each carrying its own cost.

The first phase is containment and forensics. When attackers are confirmed in your systems, a forensic team comes in to establish the scope, identify the entry point, and determine whether data has been exfiltrated as well as encrypted. This work is billed by the hour and runs into tens or hundreds of thousands of rands before any negotiation begins. Most cyber policies with ransomware cover pay this directly through panel providers named in the schedule.

The second phase is negotiation and payment. Ransom demands are almost never paid at face value. Professional negotiators typically reduce demands significantly through structured engagement with the attackers' representatives. Where South African law permits payment and the business and insurer agree it is the most cost-effective path to recovery, the policy covers the payment. Where the attackers are on international sanctions lists, payment is legally prohibited regardless of what the policy says, and a reputable insurer will tell you so before any money moves.

The third phase is restoration. Rebuilding systems from clean backups, or from decryption keys obtained through negotiation, takes time and skilled labour. Suppose your business runs on a manufacturing execution system holding three years of production data, and restoring that system fully takes twelve days. The business interruption loss across those twelve days, measured on the gross profit basis your policy uses, is what the cover pays. As an illustrative figure, a business with a daily gross profit of R80,000 and a twelve-day outage faces an exposure of roughly R960,000 before recovery costs, forensics, or ransom. The actual figures depend on your business and your policy terms.

Indicative ransomware event cost components (illustrative figures only)

Figures are illustrative only and do not represent quoted market rates. Actual costs vary by incident severity, industry, and the specific policy wording in force.

The exclusions leaving businesses exposed

Ransomware insurance cover contains exclusions far more consequential than the headline cover limit, and they tend to surprise businesses at precisely the wrong moment. The ones appearing in most wordings are set out below.

Inadequate security controls. If your policy questionnaire indicated multi-factor authentication (MFA) was in place across remote access points, and the forensic report shows the attacker entered through an RDP port with no MFA enabled, the insurer has grounds to decline the claim. MFA, or multi-factor authentication, is the system requiring two forms of verification before a login is approved: something you know and something you have, like a password and a phone prompt. Representing your controls as stronger than they were at inception is a material non-disclosure, and insurers in South Africa and internationally are applying that ground for repudiation with increasing frequency.

Nation-state attribution. Some cyber insurance wordings exclude attacks attributed to nation-state actors or their proxies. This exclusion, sometimes called a war exclusion, has been contested in international courts, and its enforceability under South African law is still developing. The FIA has noted how growing challenges around cyber insurability have prompted both product innovation and tighter exclusion drafting, particularly around the attribution question. Read the clause before you assume it doesn't apply to your policy.

Delayed notification. Most cyber policies require you to notify your insurer within a specific period after discovering an incident, often 24 to 72 hours. A business spending three days attempting its own recovery before informing the insurer may find the notification clause used against it.

Pre-existing vulnerabilities. Where a forensic review shows the attackers had been inside the network for weeks before triggering the encryption, using a vulnerability the business should have patched, some insurers argue the event originated before the policy inception or outside the scope of covered incidents.

How SASRIA and ransomware cover interact

SASRIA is the state-owned special-risk insurer providing cover for losses caused by politically motivated violence, riots, strikes, and social unrest. Its statutory cover is a separate policy riding alongside your main commercial cover, responding to a different class of peril. SASRIA's published cover doesn't extend to ransomware or cyber events, and there is no SASRIA endorsement for digital attacks.

Where ransomware is mentioned in the context of politically motivated actors or state-sponsored disruption, a business might wonder whether SASRIA becomes relevant. In almost all practical scenarios, it doesn't. Ransomware is a criminal or commercial attack, not a political-violence event as SASRIA defines it, and the two covers exist in separate lanes. Your cyber insurance handles ransomware; your SASRIA-endorsed policy handles a different class of event. Making sure both are in place, and checking neither has gaps the other was assumed to fill, is the kind of detail surfacing during a proper broker review rather than during a claim.

Ask your broker to confirm in writing how each policy treats a cyber event, so that there is no uncertainty about which one responds.

What the cyber insurance questionnaire decides about your ransomware cover

The questionnaire you complete when applying for cyber insurance is not a formality. It is the document your insurer uses to set your premium, draw your coverage boundaries, and decide whether a future claim responds. Because ransomware insurance cover sits within the broader cyber liability insurance policy, the controls you declare at inception travel with every section of the policy, including the ransomware section.

The controls insurers look at most closely in the ransomware context include: whether MFA is applied to all remote access and email systems; whether backups are stored offline or in an air-gapped environment an encryption event cannot reach; whether you run endpoint detection software capable of identifying ransomware behaviour before full encryption completes; and whether staff receive regular phishing-simulation training, since most ransomware events begin with a clicked link or an opened attachment.

Outdated or inaccurate disclosures create coverage problems emerging only at claim time, and cyber and ransomware disclosures are no exception. If your controls have changed since inception, notify your broker. The cost of an endorsement is considerably lower than the cost of a declined claim.

Choosing ransomware cover that responds under pressure

Not all cyber policies treat ransomware equally. Some name it explicitly throughout the cover schedule; others bury it inside a broader "cyber extortion" definition a loss adjuster might read narrowly. The differences most consequential when comparing policies include the sublimit applied to ransomware specifically, whether the policy covers both negotiation costs and the payment, whether business interruption is measured from the moment of the attack or only from the moment the attacker makes a formal demand, and whether forensic costs are included or capped separately.

South Africa's cyber insurance market is maturing, but it hasn't yet standardised ransomware cover in the way motor or fire cover has been standardised over decades. Wording variation between policies from different insurers is wide enough to produce meaningfully different outcomes at claim time. A cyber insurance exclusions review before you sign isn't a luxury; it is the minimum a business with meaningful digital exposure owes itself. The SAIA's industry guidance on cyber attack resilience underlines how trust and uptime are the central assets a ransomware event attacks. Cover reviewed and understood before a claim is the only kind worth paying for.

The cost of getting this wrong before the event

The lock icon on your file server is a surprisingly fast teacher. Businesses going through a ransomware event without adequate cover tend to learn the same lessons in the same order: the ransom was less than the recovery, the recovery was less than the lost business, and the lost business was the number nobody had modelled. Getting ransomware insurance cover right before an attack means knowing what your daily gross profit looks like if the systems go down, knowing how long your most critical systems take to restore from clean backups, and knowing whether your policy's indemnity period for cyber business interruption matches that recovery timeline. If it doesn't, the gap is yours to carry from the moment the clock runs out. That isn't a problem the insurer creates at claim time. It is a structure problem you can fix at renewal.

Start by finding out how long your business could keep working if its systems were locked, and how long a full restore would take with your current backups. Then compare those figures with the indemnity period and limits on your cyber policy, and close any gap at renewal.

Preparing for an attack before it happens

The businesses recovering cleanest from ransomware events share one characteristic: they had a plan someone had read before the attack arrived. The policy was reviewed. The controls were accurate. The notification number was saved somewhere the locked computer couldn't reach. Most businesses keep the plan in the same place as the backup, and the backup on the same network as the encrypted files. Anyone who has spent a Wednesday morning staring at a red lock icon will tell you the irony isn't subtle.

You shouldn't have to figure out mid-attack whether your cover responds to this. With Mont Blanc Financial Services you won't.

Contact Mont Blanc Financial Services to have your current cyber policy reviewed against what a real ransomware event would cost your business, before the question is no longer theoretical.

South African businesses ask several consistent questions when they begin looking at ransomware cover seriously. The answers below address the most common ones.

Frequently Asked Questions

What does ransomware insurance cover pay for in South Africa?

Ransomware insurance cover in South Africa typically pays for four categories of cost following an attack. The first is incident response: the forensic team identifying the entry point, mapping the scope of the breach, and preserving evidence for the insurer. The second is ransom negotiation and, where legally permitted and agreed with the insurer, the ransom payment. The third is data restoration: the labour and technology costs of rebuilding encrypted systems from clean backups or from decryption keys. The fourth is business interruption: the gross profit your business loses while systems are offline, measured from the point of the attack to the point of restoration, up to the indemnity period your policy names.

Some policies also cover the cost of notifying affected customers or partners where data was exfiltrated alongside the encryption event, and public relations fees if the incident becomes public. The specific scope depends on the wording in your policy. Standard wordings vary materially between insurers in South Africa, which is why a broker review of what your cyber insurance exclusions say is worth completing before you need the cover. Reading the schedule isn't sufficient; the wording governs.

How much revenue could my business lose if ransomware locks my systems for a week?

The straightforward way to estimate your ransomware revenue exposure is to take your annual gross profit (the revenue your business keeps after paying for the direct costs of sales) and divide it by 52. That produces a weekly gross profit figure. If that number is R200,000 a week, a seven-day outage carries a direct business interruption exposure of R200,000, before recovery costs, forensic fees, ransom negotiation, or data restoration. For a business generating R10 million in annual gross profit, the weekly exposure sits at roughly R192,000. These are illustrative calculations, not guaranteed claim outcomes; the actual figure depends on how your policy defines and measures business interruption loss.

What most businesses underestimate is how long full restoration takes. Forensic containment, system rebuilding, and data validation can stretch well beyond a week for businesses with complex or poorly documented environments. The indemnity period on your cyber policy (the number of days it will pay the business interruption loss) should be set against your realistic worst-case recovery timeline, not an optimistic one. If your IT team has never run a full restoration exercise from offline backups, the timeline is probably longer than anyone has written down. Ask your broker to confirm your indemnity period reflects the realistic scenario, not the best case.

Can my ransomware insurance cover be voided by poor security controls?

Yes. Ransomware insurance cover can be declined at claim time if the forensic investigation reveals the security controls you declared on your questionnaire at inception weren't in place when the attack occurred. The most common grounds in the current market are: multi-factor authentication declared as active but not applied to all remote access points; offline backups declared as maintained but found to be on the same network segment as the encrypted systems; and endpoint detection software declared as current but running on an outdated or unmonitored configuration. These aren't edge cases. Insurers, and the loss adjusters reviewing cyber claims, are applying the material non-disclosure ground with increasing regularity in markets where ransomware claims are frequent. The answer isn't to under-declare your controls; it is to ensure what you declare matches what is running. If your controls have changed since you last renewed, tell your broker before the renewal completes. A mid-term endorsement to update your declared controls costs far less than a declined claim. Your broker can request the endorsement on your behalf, and most insurers process it without a premium adjustment if the change is minor.

What should a business do in the first hours after a ransomware attack?

Contact your insurer's incident response line or your broker immediately, before paying any ransom or engaging outside help, because most cyber policies require you to use approved specialists and to notify the insurer promptly. Disconnect affected devices from the network to limit the spread, but avoid wiping or rebuilding systems until the specialists have preserved the evidence they need. Record what happened, when it was discovered and what actions were taken. If personal information may have been accessed, you may need to notify the Information Regulator and the people affected under the Protection of Personal Information Act, and your incident response team can help with this. Keep staff informed with clear instructions, and restore from offline backups only once the specialists confirm they are safe. Acting quickly and in the right order protects both your business and your claim. Your broker can explain the steps your policy requires.