Cyber insurance can limit the financial impact of an attack. However, it will not restore systems, resume customer service or resolve operational issues in the first few hours of a crisis. For technology companies, therefore, an insurance policy remains a tool for transferring part of the risk, rather than a substitute for cyber resilience.
The importance of this distinction grows in line with the costs of incidents. According to an IBM report from 2026, the average global cost of a data breach was $4.99 million. Attacks aided by artificial intelligence cost an average of $6 million, as automation allows attackers to operate more quickly and on a larger scale. For businesses, this means that the time taken to detect and contain an incident is having an increasingly significant impact on the final cost.
A policy may cover the costs of digital forensics, legal assistance, crisis communication, data recovery or business interruption. However, its scope is limited by the terms of the contract, liability limits and exclusions. The benefit is paid out only after a specified loss has occurred. This does not alter the company’s operational situation at the moment when an inaccessible application halts sales, production or the fulfilment of contracts.
Therefore, the value of the insurance cover depends on the condition of the organisation it covers. The same policy may operate quite differently in a company capable of restoring a key service within a few hours than in an organisation which only discovers, during an attack, where data backups are located and who has the authority to decide to shut down the systems.
Cyber resilience is not simply a matter of the number of security products purchased. Its true significance only becomes apparent during a disruption. What matters are the time taken to restore services, the quality of backups, visibility of interdependencies between systems, and the ability of teams to operate without parts of the infrastructure. From a business perspective, these are the factors that determine the duration of downtime, the scale of lost revenue and the risk of failing to meet commitments to customers.
Data from ENISA shows that there is still a gap between the formal level of security measures and their practical effectiveness. Among other things, the agency highlights the fact that it takes several months to address critical vulnerabilities, and that some organisations have not carried out regular cybersecurity assessments. This means that some businesses remain vulnerable not because of a lack of advanced technologies, but due to delays and untested processes.
This gap is also significant in terms of insurance conditions. Information on multi-factor authentication, backups, vulnerability management and incident response influences the insurer’s risk assessment. The insurance policy thus becomes an indirect test of organisational maturity. Any discrepancy between the security measures declared and their actual effectiveness may, however, complicate the claims settlement process.
At the same time, cyber resilience is increasingly extending beyond the relationship between the company and the insurer. The amendment to the Act on the National Cybersecurity System, implementing NIS2, has expanded the group of entities in Poland subject to obligations regarding risk management and information security. By 3 October 2026, entities meeting specific criteria are required to submit an application for inclusion in the KSC register.
For the technology market, this means that evidence that security mechanisms are actually functioning is becoming increasingly important. Simply having a procedure, certificate or policy is increasingly rarely sufficient in dealings with regulators, customers or business partners. Test results, recovery times and documented handling of previous incidents are becoming more valuable.
DORA sets a similar direction in the financial sector. The regulation covers not only financial institutions but also affects their relationships with cloud, software and IT service providers. The EU’s supervisory framework for critical technology providers demonstrates that the risk posed by external partners is now regarded as part of the sector’s overall resilience. For technology companies, the ability to maintain services is therefore becoming a factor in competitiveness and a prerequisite for securing certain contracts.
From this perspective, insurance cover still holds significant value. It can safeguard liquidity, provide access to specialist experts and absorb some of the financial consequences of an incident. However, it will not reduce the downtime resulting from untested backups, unclear interdependencies between systems or the lack of a pre-defined response plan.
The main difference remains straightforward. Cyber insurance affects how a crisis is financed. Cyber resilience affects its scale, duration and consequences for customers. For businesses, these are two complementary layers of protection, but only one of them determines whether the company will remain operational during an attack.
