Compare NZ cyber insurance options covering data breaches, ransomware, business interruption from cyber events and third-party liability. See providers, cover sections and indicative pricing side-by-side.
NZ-owned and built for businesses that need specialist cover. Delta has earned a strong reputation for tailored policies and responsive service - get a quote below.
Cyber insurance is a specialist policy designed to help businesses manage the financial impact of cyber events such as data breaches, ransomware attacks, system outages and privacy-related liabilities.
As NZ businesses rely more heavily on digital systems, cloud services and online transactions, the potential cost of a cyber incident has grown significantly. Cyber insurance can help cover incident response, forensic investigation, customer notification, business interruption and third-party liability arising from data breaches or system compromises.
New Zealand's Privacy Act 2020 introduced mandatory breach notification requirements, making incident response support more relevant for businesses that handle personal information. The NCSC (which absorbed CERT NZ in July 2025) has reported increasing cyber threat volumes targeting NZ organisations of all sizes.
Cyber insurance is typically divided into first-party cover (your own losses) and third-party cover (claims from others). Many policies combine both.
Covers the cost of engaging specialist IT forensics, legal counsel and crisis management when a cyber event is detected. Often the most immediately valuable part of a policy.
Covers lost income and extra expenses when a cyber event disrupts business operations, such as a ransomware attack taking systems offline.
Covers third-party claims and regulatory costs arising from a privacy breach, including the cost of notifying affected individuals as required under the Privacy Act 2020.
May cover extortion demands, negotiation costs and - subject to conditions - ransom payments where a threat actor demands payment to restore access or prevent data release.
These providers are commonly considered by NZ businesses for cyber cover, depending on size, industry and whether the policy is arranged direct or through a broker.
Chubb is commonly placed through brokers for cyber insurance covering incident response, privacy liability, business interruption and extortion. It may suit professional firms and mid-size businesses that want a comprehensive cyber policy with access to a specialist response panel.
Well-established in financial lines and cyber liability, often placed for larger or more complex risk profiles.
NZ-based specialist underwriter with a focus on cyber, technology liability and professional risks.
Commonly encountered for broader commercial programs where cyber cover is added alongside liability and property sections.
Specialist cyber underwriter that may suit SMEs looking for tailored cyber-specific cover through a broker.
Start by understanding your digital risk profile - what data you hold, which systems you depend on and what a cyber event would actually cost your business.
Often hold client data and provide advice. Privacy liability, incident response and professional indemnity extensions may be relevant.
Payment card data and customer PII create breach risk. Business interruption from system outages can directly affect revenue.
Third-party liability is often a focus because clients may claim for losses caused by a security failure in your platform or services.
A side-by-side look at providers and channels commonly used to arrange cyber insurance in New Zealand.
| Provider | Best Known For | How Bought | Best For |
|---|---|---|---|
| Chubb | Comprehensive cyber for SME and corporate | Broker / adviser | Professional and corporate firms |
| AIG | Financial lines and cyber liability | Broker / adviser | Larger and complex risks |
| NZI | Commercial cyber as part of broader programs | Broker / adviser | Businesses with existing NZI cover |
| Delta Insurance | Specialist cyber and tech liability | Broker / adviser | Tech and digital businesses |
| Vero | SME and commercial add-on cyber options | Broker / adviser | Broker-led SME placements |
| QBE | Liability and specialist commercial lines | Broker / adviser | Specialist risk placements |
| Emergence (via brokers) | Specialist cyber underwriter | Broker / adviser | SME-focused cyber |
Disclaimer: Features, limits and availability vary by business type, revenue and risk profile. Cyber insurance products change frequently. Always verify current wording and availability directly with the provider or your broker. If you spot something incorrect, please let us know.
Cyber policies typically combine first-party and third-party sections. Understanding the split helps when comparing options.
| Cover Section | Usually Covers | Often Does Not Cover |
|---|---|---|
| Incident Response | Forensic investigation, legal advice, breach counsel, PR crisis support | Costs incurred before insurer notification, pre-existing vulnerabilities |
| Business Interruption | Lost income and extra expense from cyber-caused downtime | Planned outages, slow performance, losses within the waiting period |
| Privacy Liability | Third-party claims, notification costs, regulatory defence | Fines that are not legally insurable, intentional data misuse |
| Cyber Extortion | Ransom negotiation, payment (where permitted), restoration support | Payments without insurer consent, sanctions-blocked payments |
| Data Restoration | Cost to restore or recreate data and systems after an attack | Betterment or upgrades beyond pre-loss state |
| Media Liability | Claims arising from digital content - defamation, IP infringement | Intentional infringement, content known to be false |
Cyber policy exclusions can be nuanced. These are the areas where claims most commonly fail or face coverage disputes.
Some policies condition cover on maintaining declared security standards such as MFA, patching or endpoint protection.
Events the business was aware of before policy inception are typically excluded under claims-made wording.
War exclusions in cyber policies have become a focus area. Some wordings are now clearer about what constitutes a state-backed attack.
Physical damage from a cyber event (e.g. infrastructure failure) may fall outside the cyber policy and into other cover.
Loss of data from unencrypted laptops, USBs or mobile devices may be excluded if encryption was a policy condition.
Liquidated damages or SLA penalties in commercial contracts may not be covered by cyber liability sections.
Underwriters assess a range of factors when pricing cyber cover. Businesses with stronger controls and lower data exposure typically see more competitive terms.
Revenue is a common rating factor as it indicates business scale and potential claim cost.
Businesses holding health records, financial data or large volumes of PII typically face higher premiums.
Healthcare, financial services and tech companies are often rated differently from lower-risk sectors.
Multi-factor authentication, endpoint detection, patching cadence and backup practices all matter to underwriters.
Higher indemnity limits and lower excesses increase premium. Sub-limits on key sections also affect pricing.
Previous cyber incidents, near misses or claims can affect both pricing and insurer appetite.
Businesses with US customers or data may face higher premiums due to the US litigation environment.
Heavy reliance on cloud providers, SaaS platforms or outsourced IT can influence underwriting.
Documented incident response plans, staff training and board-level oversight may support better terms.
Indicative NZ ranges vary by industry, revenue, data exposure and security posture. Pricing has evolved as the NZ market matures.
Disclaimer: These figures are indicative ranges only, not quotes. Actual pricing depends on your business revenue, data profile, security controls, industry, claims history, limits, excess and underwriting conditions. Always obtain a tailored quote from the provider or broker.
Lower premium should not come at the cost of gaps in critical cover, but businesses with stronger controls often see more competitive pricing.
MFA is one of the most impactful controls. Many underwriters now require it as a condition of cover.
A documented patching cadence for operating systems and applications may support better underwriting terms.
EDR tools can detect and contain threats faster, which underwriters often view favourably.
A written plan that is tested regularly shows cyber maturity and may help with both pricing and claims.
Human error remains a leading cause of breaches. Regular training can reduce risk and may influence pricing.
Choosing limits that match your actual exposure - and accepting a higher excess where manageable - can help manage premium.
Cyber insurance renewals often involve updated security questionnaires. Preparation can help avoid gaps or coverage disputes.
Check limits, sub-limits, retroactive dates, waiting periods and any conditions around security controls before seeking alternatives.
Document any new controls, certifications or improvements since the last placement. This may support better terms.
The quality and speed of the insurer's breach response panel can matter more than a small premium difference.
If switching providers, make sure the new policy's retroactive date covers the period of your previous policy to avoid gaps.
Speed matters with cyber claims. Most policies require immediate notification and use of the insurer's incident response panel.
Isolate affected systems where possible and preserve evidence. Do not wipe or rebuild before the forensic team is engaged.
Most cyber policies have 24/7 incident hotlines. Early notification triggers access to the response panel and may be a policy condition.
Use the insurer's approved forensic, legal and PR resources. Costs incurred outside the panel may not be covered.
Under the Privacy Act 2020, notifiable breaches must be reported to the Office of the Privacy Commissioner and affected individuals.
Keep a timeline, preserve communications and track all costs. This supports both the insurance claim and any regulatory response.
New Zealand has several legal and market features that shape how cyber insurance works for local businesses.
Cyber insurance wording can be complex. These are the key areas to review when comparing policies.
Check who provides forensic, legal and PR services. Panel quality and response speed can be critical during an active breach.
This sets the earliest date from which the policy will respond. Events before this date may not be covered, even if discovered during the policy period.
Most policies have a waiting period (e.g. 8 - 24 hours) before business interruption cover applies. Shorter waiting periods usually cost more.
Key sections like extortion, notification costs or regulatory defence may have separate sub-limits that are lower than the main policy limit.
Answers to common questions NZ businesses ask when comparing cyber cover.
Key cyber insurance terms explained in plain language.
See which cyber insurance options may suit your business size, data profile and risk exposure. Compare providers, cover sections and wording before you buy.