The Australian cyber insurance market
The Australian cyber insurance market is one of the fastest-growing in the Asia-Pacific region. The market has expanded significantly over the past five years, driven by increasing regulatory scrutiny, growing awareness of cyber risk, and stronger breach notification requirements.
The Australian market is characterised by participation from both domestic carriers (QBE, IAG, Allianz Australia) and international carriers (Chubb, AIG, Beazley through Lloyd's). Lloyd's of London has a strong presence in the Australian market, particularly for larger or more complex risks.
The regulatory environment is centred on APRA (Australian Prudential Regulation Authority), which regulates banks, insurers, and superannuation funds. APRA's Information Security Management standards require strong cyber governance. The Notifiable Data Breaches scheme under the Privacy Act requires notification within 30 days if there's likely risk of serious harm.
A distinctive feature of the Australian market is the influence of the Australian Signals Directorate's Essential Eight framework, which sets baseline security controls. Many insurers now incentivise or require Essential Eight compliance, particularly for SMBs.
Australian market characteristics and what they mean for you
APRA regulation and financial institution requirements
If you're a bank, insurer, or superannuation fund, APRA's Information Security Management standards apply. These require a cyber security strategy, board-level governance, regular risk assessments, and incident reporting. Cyber insurance underwriters are acutely aware of APRA requirements and will assess your compliance.
Notifiable Data Breaches scheme
Australia's Privacy Act requires notification of eligible data breaches within 30 days if there's a likely risk of serious harm to an affected individual. This is a strict timeline and drives significant compliance costs. Cyber policies must address notification costs and legal obligations.
Essential Eight framework influence
The Australian Signals Directorate's Essential Eight is the benchmark for baseline security controls. It includes application whitelisting, patch management, disabling administrative privileges, MFA, regular backups, education and training, and secure configuration. Organisations with Essential Eight compliance often receive better insurance rates and terms.
Lloyd's of London presence
Lloyd's plays a significant role in the Australian market, particularly for larger or complex risks. Lloyd's syndicate participation provides flexibility and capacity. Access is through brokers, usually with minimum premium thresholds.
Smaller market with rapid growth
Australia's cyber insurance market is smaller than the US or UK, but growing rapidly. This means fewer carriers than other markets, but also innovation and competitive pricing as new entrants launch and expand.
Cross-border risk considerations
Many Australian organisations operate internationally or are subsidiaries of global companies. Policies often need to address cross-border risk, including US regulatory exposure (SEC disclosure, state breach laws) and international operations.
Leading Australian cyber insurance carriers
Below is an overview of major carriers operating in the Australian market. This is not a ranking — the right carrier depends on your specific risk profile, industry, and circumstances. Always work with a specialist broker.
QBE Insurance
QBE is one of the largest carriers globally and has significant operations in Australia. Offers cyber coverage across all market segments (SMB, mid-market, enterprise). Known for strong financial position, broad underwriting capacity, and international reach.
Strengths: Large capacity; global presence; strong financial position; all market segments.
Considerations: May be less specialist than pure-play cyber carriers; larger minimum premiums.
IAG Limited (CGU brand)
IAG is Australia's largest general insurer. The CGU brand (within IAG) offers cyber insurance products for SMBs and mid-market. Known for strong Australian presence, good brand recognition, and integration with other business insurance products.
Strengths: Large Australian carrier; good SMB/mid-market offering; brand recognition; bundling options.
Considerations: Less specialist than pure-play cyber carriers; limited enterprise capacity.
Allianz Australia
Allianz is a global insurance major with strong Australian operations. Offers cyber coverage for SMBs and mid-market. Known for reliable service, good financial backing, and competitive SMB and mid-market pricing.
Strengths: Strong financial position; competitive SMB/mid-market pricing; reliable service; Australian presence.
Considerations: Less specialist than pure-play carriers; limited enterprise focus.
Chubb Australia
Chubb is a global insurance major with dedicated Australian operations. Competitive across mid-market and upper mid-market segments. Known for good financial strength, customer service, and claims capability.
Strengths: Excellent financial strength; competitive mid-market pricing; strong claims service; customer focus.
Considerations: Less specialist than pure cyber carriers; higher minimum premiums.
Bharat Serena (BHSI)
BHSI operates in the Australian market offering cyber coverage. Known for competitive pricing in SMB segment and specialist expertise.
Strengths: Competitive SMB pricing; specialist expertise; flexible underwriting.
Considerations: Smaller presence than major carriers; limited enterprise capacity.
CFC Underwriting (Australia)
The London-based specialist operates in Australia through brokers. Known for specialist expertise, customer-centric service, and quality claims handling. Growing presence in Australian market.
Strengths: Specialist cyber expertise; excellent claims service; customer-focused; quality underwriting.
Considerations: Smaller Australian presence; minimum premiums often higher; broker-only.
Emergence Insurance
Emergence is an Australian InsurTech providing cyber insurance for SMBs. Offers streamlined underwriting and competitive pricing with a focus on digital-first approach.
Strengths: Australian tech-enabled; competitive SMB pricing; streamlined process; innovation-focused.
Considerations: Newer entrant; SMB focus; limited mid-market/enterprise capacity.
Dual Australia
Dual Australia is a specialty insurer offering cyber coverage. Known for flexible underwriting and competitive pricing in niche segments.
Strengths: Specialist expertise; flexible underwriting; competitive niche pricing.
Considerations: Smaller carrier; limited enterprise capacity.
Lloyd's of London Syndicates (Australia)
Lloyd's syndicates write cyber coverage in Australia, accessed through brokers. Provides capacity, flexibility, and bespoke coverage design. Typical minimum premiums are higher (AUD $50,000+).
Strengths: Unlimited capacity; highly flexible; expert underwriters; bespoke coverage.
Considerations: Broker-only; high minimums; longer underwriting; less standardised products.
How to evaluate Australian cyber insurance providers
APRA-regulated status
Check whether the carrier is APRA-regulated (applies to authorised deposit-taking institutions and general insurers holding an Australian Financial Services Licence). APRA regulation provides strong capital requirements and supervision.
Financial strength ratings
Check financial strength from S&P, Moody's, or A.M. Best. Ratings of A or higher (A.M. Best) or equivalent from other rating agencies are strong. Ensure the carrier can meet claims obligations.
Australian claims capability
Can you reach an Australian-based claims representative 24/7? Is there a local hotline? Claims expertise in Australian privacy law, APRA requirements, and regulatory environment is critical. Ask for Australian references.
Incident response panel — local availability
Your policy should include access to forensic investigators, legal counsel, and PR specialists. Are these Australian-based? Can they respond quickly in Australia? Ask for panel composition and Australian provider details.
Coverage breadth and Australian-specific provisions
Does the policy cover ransomware, social engineering, business interruption, and third-party liability? Does it address the Notifiable Data Breaches scheme, Privacy Act requirements, and Australian-specific regulatory obligations? Ensure the policy is endorsed for Australia.
Essential Eight alignment
Many Australian insurers now incentivise or require Essential Eight compliance. If you're seeking to achieve compliance, ask whether the insurer offers discounts. If you're already compliant, you should receive better rates.
Sub-limits and exclusions
Understand any sub-limits on ransomware, business interruption, or third-party liability. Check for exclusions on known vulnerabilities, prior incidents, or regulatory non-compliance. These can be problematic — flag them with your broker.
Industry-specific expertise
If you're in a regulated industry (healthcare, financial services, energy), ensure the carrier understands Australian sector-specific requirements. A healthcare provider, for example, should verify the carrier understands AHPRA registration and privacy obligations.
Specialist broker vs. direct purchase
Most Australian cyber insurance is arranged through brokers. Here's why a specialist broker is important.
Brokers understand Australian regulation
A good Australian broker understands APRA requirements, Privacy Act obligations, the Notifiable Data Breaches scheme, and industry-specific regulations. They'll ensure your policy addresses Australian compliance.
Brokers access multiple carriers
A specialist broker has relationships with domestic carriers (IAG, Allianz, QBE), international carriers (Chubb, AIG), and Lloyd's syndicates. They'll shop your risk and find competitive quotes.
Brokers understand Essential Eight
A good broker understands the Essential Eight framework and can help you understand what controls insurers expect. They can also advise on certification and discounts available.
Brokers navigate Lloyd's access
If your risk requires Lloyd's capacity, your broker will handle the placement, understand minimum thresholds, and manage the underwriting process.
Brokers help with claims
In the event of a breach, your broker will advocate for you, explain Australian regulatory obligations, and push back on unfair claim denials.
Finding a good Australian broker
Look for brokers that specialise in cyber insurance, understand Australian regulatory requirements, have strong relationships with domestic carriers and Lloyd's, and have positive industry reviews. Check whether they have experience with your industry and business size.
Key questions to ask your Australian broker
Once you've been matched with a broker, ask these questions before committing to a policy.