A mid-sized pharmaceutical company in Thane. A garment exporter in Surat. A logistics firm in Mumbai’s western suburbs. Three very different businesses. All three hit by ransomware attacks in 2024. All three without cyber insurance.

The financial fallout was significant in each case not just from the ransom demands, but from the weeks of business interruption, the cost of forensic recovery, the legal exposure under India’s Digital Personal Data Protection Act, and the reputational damage that’s harder to put a number on. None of them had planned for it. None of them expected it would happen to them.

That thinking is becoming increasingly expensive.

India’s Cyber Risk Landscape Has Changed – Fast

India now ranks among the top three countries globally by number of internet users, with over 850 million people online. The digital payments infrastructure, e-commerce growth, and enterprise digitisation that followed the pandemic have created a vastly larger attack surface for cybercriminals. The results are visible in the numbers: India saw over 2 million cybersecurity incidents recorded in a recent year, and that figure is rising.

Ransomware attacks where criminals encrypt your data and demand payment to restore access have become the dominant threat. But phishing, business email compromise, cloud misconfigurations, and supply chain attacks are all on the rise. The 2025 data from Munich Re shows that the majority of cyber claims come not from large enterprises but from SMEs. Small and mid-sized businesses are, in many ways, the preferred target: they hold valuable data, they’re increasingly connected, and they typically lack the security infrastructure of larger organisations.

Which is exactly where cyber insurance fills the gap.

What Cyber Insurance Actually Covers

The misconception is that cyber insurance is just about paying the ransom. It isn’t. A well-structured cyber policy covers a range of first-party and third-party exposures, including:

• Forensic investigation costs to identify how the breach occurred
• Legal fees and regulatory fines, including those triggered by India’s DPDP Act 2023
• Customer notification and credit monitoring expenses
• Business interruption losses during the period your systems are down
• Public relations and crisis management support

The DPDP Act, which came into force in 2023, has added a layer of regulatory risk that many businesses haven’t fully absorbed. Under the Act, organisations are required to report significant data breaches and face penalties for non-compliance. Cyber insurance doesn’t eliminate that obligation but it covers the costs of managing it.

The SME Blind Spot

Here’s the uncomfortable truth: most Indian SMEs still don’t have cyber insurance. A survey cited in the market research found that only 25% of Indian SMEs understood the importance of cyber cover leaving three in four businesses operating without financial protection against a risk that’s growing every quarter.

The reasoning is usually one of three things: the business doesn’t think it’s a significant target, it doesn’t believe a cyber event will cause that much damage, or it simply hasn’t looked into the cost. On all three counts, the reality is different. Cybercriminals aren’t selective they automate attacks at scale, and the businesses that fall through the gaps are often those with the least protection. A significant breach at an SME can cause damages running into tens of lakhs or more, factoring in downtime, recovery, and regulatory exposure.

The cost of a basic cyber insurance policy, by contrast, is often far lower than businesses expect.

IRDAI and the Regulatory Push

India’s insurance regulator, IRDAI, introduced a cybersecurity framework in 2021 and has continued to strengthen requirements since. In April 2026, new IRDAI guidelines mandated continuous vulnerability assessment and board-level governance for insurers a signal of the direction regulation is moving across the broader economy.

Companies that handle significant customer data, process digital payments, or operate connected systems are increasingly expected to demonstrate cyber resilience. Insurance is increasingly part of that conversation not just as a financial backstop, but as evidence of risk governance.

How to Choose the Right Cyber Policy

Not all cyber policies are equal. Coverage limits, exclusions, incident response provisions, and the quality of the insurer’s claims handling vary considerably. A policy that looks comprehensive at first glance may contain carve-outs for certain types of attack, or cap costs at levels that don’t reflect actual exposure.

Getting the right cyber cover requires understanding your actual digital footprint what data you hold, how you process it, where your key vulnerabilities are. That’s a conversation worth having with an independent broker before you select a policy.

The India cyber insurance market is projected to grow from USD 752 million in 2025 to nearly USD 7 billion by 2034. The businesses that get this right early will be better positioned operationally and reputationally than those who wait for a claim to prompt the conversation.