Business Insurance 2026: The Cybersecurity Act
Business Insurance 2026: The Cybersecurity Act Reshapes the Landscape of Risk Management
Business insurance has traditionally been seen as a tool for managing property, business interruption and liability risks. In recent years, however, a new and rapidly growing focus has emerged: cyber risks and the regulations governing them. The Finnish Cybersecurity Act, which implemented the EU’s NIS 2 Directive, has introduced new risk management and reporting obligations for thousands of Finnish companies. At the same time, the cyber insurance market is undergoing a period of transition, with prices having fallen but the claims trend remaining uncertain. This article outlines what company management and those responsible for risk management need to know about the current situation.
The Cybersecurity Act Has Extended Obligations to New Sectors
The Cybersecurity Act entered into force on 8 April 2025, implementing the EU’s cybersecurity directive (the NIS 2 Directive) at national level. As a general act, it extended cybersecurity obligations to a considerably wider group of companies than before. The aim of the Directive is to strengthen the level of cybersecurity in the European Union and its Member States in those sectors and among those entities considered critical to the functioning of society.
The Act requires entities within its scope to, among other things, draw up a risk management framework and report significant incidents to the supervisory authority. Entities have had to register in the entity list maintained by the supervisory authority for their own sector, and the risk management framework had to be drawn up by 8 July 2025 at the latest. Failure to comply may result in substantial administrative sanctions: a fine of up to EUR 10 million or 2 per cent of the company’s worldwide turnover, whichever is higher.
It is also essential to note that the obligation applies personally to company management: management must satisfy itself that information security risks are under control and that sufficient resources have been allocated to managing them.
What Does This Mean for Business Insurance?
The tightening of regulations is directly reflected in companies’ insurance needs. As management’s personal responsibility for cybersecurity is emphasised and the risk of sanctions increases, many companies are reassessing the cover provided by both their cyber insurance and their directors’ and officers’ liability insurance. Cyber insurance can cover, for example, the costs of investigating a data breach, losses arising from business interruption, and legal costs. Concepts commonly found in insurance terms and conditions include cyber extortion and cyber warfare, the latter of which is often excluded from cover when the attack is carried out by a foreign state.
It is important to remember, however, that insurance never covers inadequate cybersecurity as such. Insurance policies usually include security guidelines; failure to comply with these, for example failing to install software updates or having inadequate access control, may limit or completely prevent insurance compensation, particularly if the failure is deemed to constitute gross negligence. Compliance with the obligations under the Cybersecurity Act and taking out cyber insurance are therefore not mutually exclusive but complementary risk management measures: a risk management approach that complies with the law also improves compliance with the terms of the insurance policy in the event of a loss.
Recent Observations: Attacks Have Increased and Become More Severe
The threat landscape has also evolved rapidly over the past year, and the latest findings provide concrete evidence as to why it is worth assessing the adequacy of insurance cover right now, rather than waiting until after the next incident.
According to the National Cyber Security Centre Finland, which is part of the Finnish Transport and Communications Agency (Traficom), the number of serious malware incidents and cybercrime-related frauds increased in 2025, and vulnerabilities are being exploited more rapidly than ever. According to the report The State of Finnish Cybersecurity 2025, commissioned by Elisa, 75 per cent of organisations stated that they intended to increase their cybersecurity budgets, but only 28 per cent of IT and information security managers believed that these investments were sufficient. There is therefore a significant gap between plans and perceived adequacy.
The National Cyber Security Centre Finland assessed that Finland’s national cyber threat level would remain elevated during the first half of 2026. Key trends identified included the growing use of artificial intelligence in attacks, the automation of attacks, and increasingly sophisticated phishing methods. In June 2026, the so-called FortiBleed campaign came to light, which targeted Fortinet’s firewalls and SSL-VPN devices through leaked login credentials. Around the same time, a critical vulnerability (CVE-2026-50751) was discovered in Check Point’s remote access products. Both are examples of how quickly a single software vulnerability can escalate into a widespread incident affecting multiple organisations.
These findings highlight several key aspects for companies’ risk management and insurance. Firstly, ransomware attacks are increasingly targeting small and medium-sized enterprises (SMEs) as well, as improved defences at large corporations drive criminals to seek out easier targets. SMEs often hold valuable data, but have limited resources to protect it, which is why cyberattacks do not target large corporations alone.
Secondly, supply chain attacks, that is, attacks carried out through the networks, services, products or open-source projects used by a company, have emerged as a key risk. This development also has a direct impact on insurance cover, as some cyber insurance policies do not cover damage caused by external service providers. By breaching a supplier’s system, cybercriminals can gain access to hundreds or even thousands of companies.
Thirdly, insider threats represent a significant weakness in corporate security, whether deliberate or accidental. The normalisation of remote working, increased staff turnover, and inadequate monitoring of remote working tools and their users all exacerbate this risk. For example, the possibility of bypassing two-factor authentication on a company’s external network, or security vulnerabilities in home networks, such as default passwords or out-of-date device firmware, can allow malware to gain access from company devices to other systems.
Fourthly, as companies increasingly migrate to cloud services, incorrect or insecure configurations in cloud environments can lead to the exposure of sensitive data. The complexity of multi-cloud and hybrid cloud environments further increases this risk. Cloud security requires tools that monitor configurations, manage cloud security and handle the tasks for which the organisation is responsible within the shared responsibility model with cloud service providers.
Fifthly, the World Economic Forum’s Global Risks Report 2026 ranked cyber insecurity as the sixth most significant global risk over a two-year review period. This reflects the fact that cybersecurity is no longer just a matter for the IT department, but a business risk for the entire organisation, which is growing both quantitatively and qualitatively alongside other developments in digitalisation.
The State of the Insurance Market: Prices Have Fallen, but the Risk Remains
Demand for cyber insurance has grown significantly in recent years, and the market has gradually stabilised as a result. According to industry monitoring, cyber insurance premiums have fallen steadily since the peak during the COVID-19 years, partly due to improved basic cybersecurity standards among companies, the implementation of critical controls, and competition among insurers.
However, the risk environment has not stabilised at the same pace as prices have fallen. Cyber risks have topped international corporate risk barometers for several years running, and the development of artificial intelligence is seen in the sector as a double-edged sword: it enhances both defensive and offensive techniques, such as impersonation scams and targeted phishing messages that are increasingly difficult to detect. Data breaches and ransomware remain the most common and costliest types of cyber loss faced by businesses. Falling insurance premiums, coupled with an evolving and growing threat landscape, make it particularly important to carefully review insurance terms and coverage limits when renewing or tendering for insurance policies.
Practical Recommendations for Company Management
Tightening regulation, an intensifying threat landscape, and structural change in the insurance market translate into concrete measures that should be incorporated into the normal annual risk management cycle.
(i) Assess the applicability of different regulations.
Determine whether the company falls within the scope of, for example, the Cybersecurity Act based on its size, sector or criticality, and whether a risk management framework has been drawn up and is up to date. Even for companies falling below the regulatory threshold, the Act serves in practice as a good basic checklist, as many of the measures it requires, such as risk management, detection of anomalies and supply chain security, are also regarded by insurers as prudent practice.
(ii) Go through the cyber insurance cover in detail.
In particular, check whether the insurance covers business interruption caused by ransomware, cyber extortion and any associated ransom payments, disruptions caused by third parties (such as cloud service or software providers), fraudulent payments, and the costs of legal assistance and communications following an incident. As supply chain attacks have become a key risk, it is worth checking specifically whether the insurance cover also extends to disruptions occurring in a subcontractor’s or service provider’s systems. This is often a separate extension that must be agreed upon.
(iii) Carefully assess and document your level of cybersecurity.
Identify what is genuinely critical. Cybersecurity begins with a company distinguishing the essential from the non-essential, as not all data and services are equally critical to the company, and not everything needs to be protected to the same standard. If all data is defined as critical, protection quickly becomes cumbersome and expensive. At its worst, an excessive focus on security can become an obstacle to business development. Protecting critical systems is a multi-layered process, but simply securing systems and data is not enough if you do not know who has access to them and what their access rights are. Document where critical information is located, who uses it, what rights users have, and how to respond to anomalies.
Under Section 34 of the Insurance Contracts Act, the insurer may reduce the compensation on the grounds of a breach of security guidelines if the breach was causally linked to the loss and the negligence cannot be regarded as minor. The burden of proof regarding the breach lies with the insurer. In the established case practice of FINE, the Finnish Insurance Complaints Board under the Finnish Financial Ombudsman Bureau, this burden of proof has been interpreted strictly: a general or unspecified allegation of a breach is not sufficient to justify a reduction in compensation. From a business perspective, this means that up-to-date documentation of cybersecurity measures (such as software updates, backups and access control) is valuable not only for regulatory compliance but also in terms of the company’s own position regarding compensation. A lack of documentation may leave a company in a weaker negotiating position following a loss, even though the ultimate burden of proof lies with the insurer.
(iv) Draw up and test an incident response plan.
Many insurance policies require a rapid response and the minimisation of loss once an insured event has occurred. A regularly tested incident response plan, including testing the restore capability of backups and a clear division of communication responsibilities, speeds up recovery while supporting the smooth processing of insurance claims. In addition to the location of the data, protecting the data itself requires that identities, access control, backups and application lifecycle management are in order. Note that backups may not necessarily be sufficient to restore services; in such cases, a key factor in mitigating damage is whether the IT infrastructure can be made operational if the current operating environment is compromised or lost. Lifecycle management is therefore an essential part of protecting critical infrastructure. A critical environment must remain up to date and resilient.
(v) Re-evaluate directors’ and officers’ liability insurance (D&O).
As the Cybersecurity Act imposes obligations on company management and the risk of sanctions is significant, it is advisable to review the scope and limits of directors’ and officers’ liability insurance at the same time as cyber insurance. If taken out separately, they may leave gaps in cover, for example, in the event of sanctions by the authorities or claims by shareholders.
(vi) Address the supply chain in your contracts as well, not just in your insurance.
As a significant proportion of current attacks are carried out via third parties, it is also worth ensuring through contractual agreements that key subcontractors and software suppliers maintain an adequate level of cybersecurity, and that the division of responsibility in the event of a disruption is clear. At present, the IT market is dominated by a number of large global players, whose contract terms and service models can change rapidly. A company should identify where it is overly dependent on a single service provider, operating environment or technology. Insurance should not be regarded as a substitute for contractual risk management, but rather as a company’s last line of defence.
(vii) Review and renew your insurance policies regularly.
The cost of cyber insurance has fallen, making it worthwhile to shop around. However, comparing the terms and conditions, particularly those relating to cyber extortion, cyber warfare and underinsurance, is at least as important as comparing prices, as the terms vary between insurers.
Conclusion
A company’s overall insurance programme must always be tailored to its own operations, sector and risk profile, and this article is not a substitute for a case-by-case legal or insurance assessment. The rapidly changing regulatory environment makes it advisable to review business insurance and the associated risk management at regular intervals. In particular, insurance and risk management should be assessed whenever there are significant changes to the operating environment or legislation, not just when insurance policies are renewed.
Read more about our Insurance and Tort Law services
