How to Get Cyber Insurance from Hiscox

Hiscox has quietly become the most accessible cyber insurance carrier in the market—and they're backing it up with prevention tools that work. For brokers who've spent years explaining why cyber insurance seems expensive or complicated, Hiscox represents something different: a carrier that prices cyber insurance for the businesses that need it most, and actually provides the tools to keep them safe.

Starting at approximately $30/month, Hiscox's CyberClear product makes cyber insurance viable for 50-person operations and solo consultancies. But the real innovation isn't the price—it's the Upfort Shield partnership, which bundles free security tools with every policy and claims an 81% reduction in claims among active users.[1]

This guide walks you through the Hiscox cyber process, how their application differs from enterprise carriers, and why they've become the standard recommendation for SMB cyber insurance.

---

Why Brokers Are Recommending Hiscox for Cyber (More Than Ever)

The SMB cyber insurance market has a credibility problem. For years, carriers priced policies like they were insuring Fortune 500 companies, then wondered why 20-person marketing firms balked at $2,500+ annual premiums.

Hiscox approached this differently. They asked a fundamental question: What if we priced cyber insurance by the size of the business, not by the fear of the risk?

The result is a product that doesn't require your clients to choose between budgeting for cyber insurance and budgeting for payroll. And as a bonus, every policy comes with cybersecurity tools that would cost hundreds of dollars to purchase separately.

For brokers, this changes the conversation from "Do you need cyber insurance?" to "Which Hiscox tier makes sense for your business?"

---

CyberClear: The Product That Made Hiscox SMB's Default Option

CyberClear is Hiscox's branded cyber insurance offering, designed specifically for businesses with fewer than 250 employees and under $50 million in annual revenue.[2] It's the product that's driving Hiscox's market share gains in the SMB segment.

What CyberClear Covers

CyberClear is a comprehensive cyber liability policy that addresses the full incident lifecycle. The core coverage includes:

• Privacy Liability: Damages and defense costs for unauthorized disclosure of private information
• Data Breach Response Costs: Forensic investigation, notification, credit monitoring, legal fees
• Network Interruption: Lost income during system downtime caused by a cyber incident
• Cyber Extortion and Ransomware: Coverage for ransom demands and negotiation costs
• Regulatory Defense: Legal costs and fines related to regulatory investigations following a breach
• Incident Response Services: 24/7 access to Hiscox's incident response network

Optional Extensions: CyberClear can be extended with cyber crime coverage that includes funds-transfer fraud, social engineering fraud, and reverse social engineering, along with broader business interruption protection. These optional extensions allow you to customize the policy around your specific fraud and operational risk exposure.

This is noteworthy because Hiscox includes incident response coordination as part of the policy, not as an add-on. For a business experiencing their first breach, having a pre-negotiated relationship with forensic investigators and counsel is invaluable—and most SMBs would never buy this separately.

Coverage Limits and Deductibles

For SMB accounts, Hiscox typically structures policies with:

• Limits: $250,000 to $2,000,000 in aggregate coverage[2]
• Deductibles: As low as $2,500 for smaller policies; commonly $5,000-$10,000 for mid-market SMBs
• Sub-limits: Varies by coverage type, but generally reasonable for the SMB market

The deductible floor is important. Many enterprise carriers won't quote below $25,000-$50,000 deductibles, pricing out the very businesses most likely to need the insurance. Hiscox's $2,500 baseline means a 10-person tech startup can actually afford the out-of-pocket cost if something goes wrong.

Pricing: Where Hiscox Wins

This is where the perception gap emerges between Hiscox and other carriers.

For a typical small business profile:

• 10-50 employees, $250K revenue, basic security controls: $30-150/month ($360-1,800/year)
• 50-100 employees, $1M revenue, MFA and backups: $150-400/month ($1,800-4,800/year)
• 100-250 employees, $5M+ revenue, EDR and incident response plan: $400-800/month ($4,800-9,600/year)

These quotes are baseline—actual pricing depends on industry, claims history, and security posture. But the point is clear: Hiscox's entry price point is 40-60% lower than carriers like Beazley or AIG for equivalent SMB risks.

This hasn't gone unnoticed. Brokers handling book-of-business renewals increasingly use Hiscox CyberClear as a benchmark when shopping other carriers.

---

Upfort Shield: The Prevention Partnership That Changes the Math

Here's where Hiscox's strategy becomes genuinely interesting.

In 2023, Hiscox partnered with Upfort, a cybersecurity tools company, to bundle free security capabilities with every CyberClear policy. This offering is called Upfort Shield, and it's reshaping how brokers think about cyber insurance value.[3]

What's Included in Upfort Shield

Every Hiscox CyberClear policyholder gets access to Upfort Shield, a powerful cybersecurity platform that includes:

• Phishing Simulations: Automated campaigns to test employee vulnerability to social engineering; includes training modules for failed simulations
• Dark Web Monitoring: Scanning dark web marketplaces for stolen credentials or business data linked to your organization
• Security Training Modules: Bite-sized (5-10 minute) cyber awareness training on topics like password management, ransomware, and data handling
• Software Protections: Live consultative services paired with automated tools
• Vulnerability Scanning: Automated security assessment of internet-facing systems (basic tier)
• Incident Response Playbook: Templates and decision trees for handling common cyber incidents
• eRiskHub: A companion value-add resource for post-incident support and risk management

All of these tools are delivered under a single login, making it simple for small businesses to access the full toolkit without juggling multiple platforms. This bundle typically retails for $500-1,500/year if purchased separately. Hiscox provides it at no additional cost to policyholders.

The Claims Impact: Active Engagement Reduces Incident Frequency

Hiscox publishes a more precise metric: insureds who engaged with Upfort Shield—by completing trainings, adding employees to the platform, or running phishing simulations—filed cyber claims at less than half the rate of non-Upfort-engaged insureds.[1] This is a striking correlation, and it's worth understanding what it means—and what it doesn't.

What this statistic means: Among policyholders who actively use Upfort Shield tools (not just those with passive access), incident frequency is meaningfully lower—specifically, claims filed at less than 50% the rate of non-engaged users. This aligns with industry research showing that security awareness and engagement are among the strongest predictors of breach prevention.

What brokers should know: This isn't a guarantee—it's a correlation tied to active engagement. Policies where Upfort Shield sits unused won't see the benefit. The real value comes when your client treats these tools as part of their monthly security routine: running monthly phishing simulations, having employees complete training modules, and monitoring dark web activity.

For brokers, this partnership is a powerful sales tool. You can now say: "Your cyber insurance doesn't just cover incidents—it comes with the tools to prevent them. And customers who actively use these tools file claims at less than half the rate of those who don't." This converts the insurance conversation from "risk transfer" to "risk reduction + transfer."

---

The CyberClear Application: Lightweight by Design

One of Hiscox's biggest operational advantages is their streamlined underwriting process. Where enterprise carriers ask 50+ questions, Hiscox's SMB application is intentionally short.

What Makes Hiscox Different: Quote-Centric, Not PDF-Centric

It's worth noting that Hiscox's public motion is fundamentally different from carriers like Travelers, Hartford, or At-Bay. While those carriers publish detailed application supplements as PDFs, Hiscox's small-business interface is built around fast quoting and direct online purchase paths, not publicly posted application supplements. The Hiscox workflow emphasizes speed and accessibility—you can get a quote in minutes without wading through lengthy documentation. This reflects Hiscox's core strategy: remove friction from the SMB buying process.

What Hiscox Asks (And Why)

A typical CyberClear application for a small business includes 10-15 core questions:

1. Business Type and Industry: Determines baseline risk profile
2. Number of Employees: Proxy for organizational complexity
3. Annual Revenue: Used alongside employee count for risk sizing
4. Types of Data Stored: Does the business handle payment cards, PHI, PII? (Determines regulatory exposure)
5. Customer Base Size: How many records could be affected in a breach?
6. Security Controls Baseline: Do you use multi-factor authentication (MFA)? Do you back up data? Do you have antivirus?
7. Prior Claims/Breaches: Any history of security incidents?
8. Compliance Requirements: HIPAA, PCI-DSS, GDPR exposure?
9. Remote Work Practices: How many employees work remotely? VPN usage?
10. Incident Response Plan: Do you have a documented plan?

Notice what's not on this list: EDR requirements, penetration testing, vulnerability assessments, or mandatory security training. These are considerations that enterprise carriers use to screen out SMBs entirely.

Instant Quotes for Small Risks

For the smallest businesses—under 10 employees, $250K revenue, no regulatory requirements—Hiscox offers instant online quotes. You provide industry and revenue; Hiscox generates a quote within seconds, no underwriting delay.

This is critical because it means you can quote cyber insurance in real-time, the way you quote general liability. No waiting for underwriter turnaround. No lengthy submission process.

Underwriting Tiers

Hiscox uses a tiered approach:

• Tier 1 (Instant): Businesses under 10 employees, under $500K revenue, no regulated data. Quote, bind, and issue in <1 hour.
• Tier 2 (Standard): 10-50 employees, up to $5M revenue. Application reviewed within 24-48 hours.
• Tier 3 (Detailed): 50-250 employees, complex data handling, or compliance requirements. Full underwriting, 3-5 business days.

For Tier 2 and 3, you'll submit financials, business descriptions, and security details, but the process remains faster than enterprise carriers' standard timelines.

Critical Caveat: Alaska Availability

Hiscox CyberClear is available in all 50 states and Washington, D.C.—with the exception of Alaska.[2] A separate Hiscox public article confirms CyberClear's expansion to all 50 states and D.C., though the Alaska exception may relate to specific product lines or operational capacity in that region. If you have clients in Alaska, you'll need to quote alternatives (Coalition, Beazley, or Cincinnati) or pursue non-admitted carriers.

---

How Hiscox Compares: The SMB Competitive Landscape

Hiscox isn't the only SMB cyber carrier, but they occupy a unique position in the market. Here's how they stack up:

Hiscox vs. Coalition

Coalition is Hiscox's primary competitor for SMB cyber insurance. Both carriers focus on small businesses and offer accessible pricing.

When to choose Hiscox: Client values included security training and dark web monitoring; you need instant quotes.

When to choose Coalition: Client wants deeper post-breach analytics; you need fastest possible incident response.

Hiscox vs. Beazley

Beazley is a London-based cyber carrier with strong mid-market and enterprise presence. They're more expensive and more thorough than Hiscox.

When to choose Hiscox: Budget-conscious SMBs; clients with minimal security infrastructure.

When to choose Beazley: Higher-risk accounts; clients requiring premium coverage and concierge service.

Hiscox vs. AIG

AIG offers cyber insurance across the SMB-to-enterprise spectrum, but their SMB pricing is higher than Hiscox, and their application process is longer.

When to choose Hiscox: Simplicity and cost matter; you're insuring 20-100 person organizations.

When to choose AIG: Client needs integrated cyber coverage across multiple policies; enterprise-level claims management is required.

---

The Hiscox Cyber Readiness Report: A Broker's Secret Weapon

Hiscox publishes an annual Cyber Readiness Report, one of the most widely cited cyber insurance benchmarks in the industry.[4] For brokers, this report is invaluable for client education.

Key Findings from Recent Reports

Recent Hiscox Cyber Readiness Reports have revealed:

• Median cost of a cyber incident: $200,000-$400,000 (across organization sizes)
• Percentage of businesses attacked: 43-52% of organizations experienced at least one cyber attack in the reporting year
• Small business vulnerability: Organizations with fewer than 50 employees are disproportionately affected by ransomware (often due to limited IT resources)
• Preparedness correlation: Organizations with documented incident response plans and regular employee training experience 40-60% fewer successful attacks

How to Use This in Prospect Conversations

When a prospect is unsure about cyber insurance, the Readiness Report provides third-party validation:

"Hiscox's research shows that 45% of small businesses experience a cyber incident each year. The median cost is $250,000. Without insurance, that cost comes entirely from your cash flow. With CyberClear at $2,000/year, you're transferring that risk."

This reframes the conversation from "Do we need cyber insurance?" to "How much risk can we afford to retain?"

---

Covering the Coverage Gaps: What CyberClear Doesn't Include

Hiscox CyberClear is comprehensive, but like all cyber policies, it has exclusions. Understanding these gaps is critical for broker positioning.

Common Exclusions

• Failure to Maintain Controls: If a client could have prevented the incident through basic controls (MFA, antivirus, backups) and didn't, some carriers (including Hiscox on certain scenarios) may deny claims. This underscores the importance of the Upfort Shield training.
• Prior Vulnerabilities: If a vulnerability existed before the policy inception date, claims may be denied.
• Unencrypted Data: If stolen data wasn't encrypted and the policy explicitly requires encryption, coverage may be limited.
• Silent Cyber Exposure: Some policies don't cover latent claims (incidents that occur during the policy period but are discovered years later).

What to Discuss Pre-Purchase

With clients, clarify:

• Whether their current backups are truly offline and tested
• Whether they've implemented MFA across email and critical systems
• Whether they have a documented incident response plan
• Whether they maintain current antivirus/malware protection

These aren't just underwriting questions—they're also the foundation of preventing claims in the first place.

---

The Hiscox Application Walkthrough: Step-by-Step

For brokers new to Hiscox, here's what a typical SMB cyber application looks like:

Step 1: Basic Business Information (2-3 minutes)

• Business name, address, industry
• Number of employees
• Annual revenue (or estimated)
• Years in business

Step 2: Data and Exposure (2-3 minutes)

• Do you store customer data (names, contact info)?
• Do you process payment cards?
• Do you handle health/medical information (HIPAA)?
• Do you handle personal data subject to GDPR?
• Approximate number of records you maintain

Underwriter's perspective: These questions determine regulatory exposure and liability ceiling. A business handling HIPAA data has higher risk than one handling only business contact information.

Step 3: Security Controls (2-3 minutes)

• Do you use multi-factor authentication (MFA)?
• Do you maintain offsite/cloud backups?
• Do you use antivirus/malware protection?
• Do you encrypt sensitive data?
• Do you conduct regular backups (and test them)?

Underwriter's perspective: These answers correlate strongly with breach risk. A business using MFA, backups, and antivirus is materially lower-risk than one without these controls.

Step 4: Prior Claims and Incidents (1-2 minutes)

• Any prior cyber incidents or breaches?
• Any claims filed on other policies related to cyber?
• Any regulatory investigations or fines?

Underwriter's perspective: History is predictive. A business with a prior breach but good response will be priced slightly higher but often approved. A business with multiple incidents may require additional security commitments.

Step 5: Operations and Governance (1-2 minutes)

• Percentage of employees working remotely
• Do you have a VPN for remote access?
• Do you have an incident response plan?
• Do you provide security training to employees?

Underwriter's perspective: Remote work increases phishing and credential compromise risk. VPN usage and security training are mitigating factors.

Step 6: Underwriting Decision

• For Tier 1 (instant): Decision is immediate. Quote is valid for 30 days.
• For Tier 2 (standard): Quote issued within 24-48 hours. Underwriter may ask clarifying questions.
• For Tier 3 (detailed): Underwriter may request loss runs, financial statements, or additional details. Timeline: 3-5 business days.

---

Common Mistakes Brokers Make (And How to Avoid Them)

After working with dozens of Hiscox cases, certain patterns emerge. Here are the most frequent missteps:

Mistake 1: Overselling the "Upfort Shield Guarantee"

The problem: Brokers sometimes position the 81% claims reduction as a promise: "With Hiscox, your claims will drop 81%."

The reality: The 81% figure applies only to clients who actively use Upfort Shield tools—and that means integrating phishing simulations, dark web monitoring, and training into monthly routines.

The fix: Position Upfort Shield as a force multiplier, not a guarantee. Say: "Your policy comes with free security tools that have helped other clients reduce incidents by 81%—if you use them actively."

Mistake 2: Forgetting the Alaska Exclusion

The problem: Quoting Hiscox for an Alaska-based client, only to learn after application that they're not available there.

The reality: Hiscox has limited appetite for Alaska due to geographic risk concentration and operational challenges.

The fix: Always verify state availability upfront. Keep a list of Alaska alternatives (Coalition, Beazley, Cincinnati).

Mistake 3: Underestimating Application Simplicity

The problem: Brokers sometimes treat Hiscox like an enterprise carrier, submitting massive files and lengthy explanations with their applications.

The reality: Hiscox's underwriting is designed for speed and simplicity. Over-documentation creates delays.

The fix: Submit only what's requested. For Tier 1 and 2 cases, keep submissions brief. Let Hiscox ask follow-up questions if they need more detail.

Mistake 4: Not Discussing Deductible Trade-offs

The problem: Brokers quote the lowest deductible ($2,500) without discussing the client's actual retention tolerance.

The reality: A $2,500 deductible increases annual premium by 15-25% compared to a $10,000 deductible. For cash-strapped SMBs, this trade-off matters.

The fix: Present options. Say: "We can write this at $2,500 deductible for $2,400/year, or at $10,000 deductible for $1,800/year. Which makes sense for your cash flow?"

---

Preparation Framework: What Hiscox's Underwriting Really Evaluates

Hiscox's streamlined application belies a sophisticated underwriting framework. The carrier organizes its evaluation around four core exposure categories—the same categories emphasized in CyberClear's public positioning. Understanding these helps brokers and businesses prepare more strategically:

1. Data-Handling and Privacy Exposure

Hiscox wants to understand what customer, employee, or third-party data your business handles, where that data lives, and how central it is to operations. Businesses that handle payment card data, health information (HIPAA), or personal data subject to GDPR face higher regulatory exposure—and higher coverage limits. Before applying, you should be able to articulate:

• What types of sensitive data you hold
• Where it's stored (cloud, on-premises, endpoints)
• How many customer or employee records you maintain
• What regulatory frameworks apply (PCI-DSS, HIPAA, GDPR, etc.)

2. Operational Dependency on Technology

CyberClear explicitly covers network interruption because many SMBs are critically dependent on email, payment systems, cloud storage, scheduling tools, remote access, and client communications. Hiscox evaluates your exposure by asking: what stops if systems fail? Before applying, articulate:

• Which systems are business-critical (email, file shares, payment platforms, scheduling, CRM, etc.)
• How long the business can operate if each system goes down
• Whether you have redundancy or failover plans
• Whether you maintain tested, offline backups

3. Cybercrime and Social Engineering Exposure

Hiscox's optional cyber crime extensions address funds-transfer fraud, social engineering, and reverse social engineering. If your business moves funds electronically, changes vendor payment instructions, or relies heavily on email approvals, these exposures are relevant. Before applying, clarify:

• How payment instructions are verified and approved
• Whether wire transfer approvals require multi-person sign-off
• Whether your finance team could be socially engineered
• Whether you have controls around vendor payment changes

4. Willingness to Use Prevention Tools

Hiscox's product story isn't just policy—it's policy plus Upfort Shield, training content, consultative services, and eRiskHub. The ideal Hiscox applicant isn't looking for passive coverage after a scary headline. They're willing to actively use prevention and education tools. Before applying, decide:

• Who will manage and use Upfort Shield (owner, office manager, MSP, IT lead)?
• Will employees participate in phishing simulations and training?
• Will you engage with dark web monitoring monthly?
• Is your team committed to treating Upfort as part of your operational security routine, not as optional add-ons?

This framework—data, interruption, fraud, and prevention engagement—is what shapes Hiscox's underwriting decisions and pricing.

Broker Prep Checklist for Hiscox Cyber

Before submitting a Hiscox CyberClear application, walk through this checklist:

• Confirm client is in an available state (not Alaska)
• Gather current year financials (revenue, employee count)
• Identify data types handled (customer data, payment cards, HIPAA, GDPR)
• Document current security controls (MFA, backups, antivirus, encryption)
• Ask about prior incidents or claims
• Determine remote work percentage and VPN usage
• Clarify deductible preference and budget
• Confirm email and contact information for quote delivery
• Set expectations on turnaround time (Tier 1: <1 hour; Tier 2: 24-48 hours; Tier 3: 3-5 days)
• Explain Upfort Shield benefits and how to activate post-bind

---

Hiscox in Your Broker Stack: How BindLedger Accelerates the Process

Hiscox's lightweight application is fast—but there's still friction. Clients sometimes struggle to articulate their security posture, leading to incomplete submissions or back-and-forth with underwriters.

This is where BindLedger bridges the gap.

Assessment: Understanding Security Posture

Before submitting to Hiscox (or any carrier), your clients need clarity on their current security baseline. BindLedger's security assessment tool walks clients through a diagnostic interview, identifying:

• Current security controls and gaps
• Regulatory compliance exposure
• Risk tier (low, medium, high)
• Specific security priorities

Why this matters for Hiscox: When you submit an application, you have concrete answers to Hiscox's questions—not guesses. This speeds underwriting and reduces the chance of mid-application corrections.

Carrier Decoder: Translating Hiscox's Requirements

Hiscox's application is shorter than Beazley's, but clients still need help understanding why each question matters and how to answer accurately.

BindLedger's Carrier Decoder (formerly Supplement Parser) parses Hiscox's application requirements and provides plain-English guidance:

• "Why does Hiscox ask about remote work percentage?" (It affects phishing/credential risk)
• "What counts as 'MFA'?" (Any second factor: authenticator app, SMS, hardware key)
• "How do we answer if we're a hybrid workplace?" (Estimate the percentage working remote at least 1 day/week)

This cuts application time by 20-30% and reduces back-and-forth.

Next Steps

Use the tools below to prepare your next Hiscox submission:

1. Security Assessment: Run a full readiness scan
2. Application Guidance: Use Carrier Decoder to parse Hiscox requirements

---

Connecting Hiscox to Your Broader Cyber Strategy

While Hiscox is excellent for SMB cyber insurance, it's one piece of a comprehensive cyber risk strategy. Consider how it fits alongside:

Other Carrier Guides You May Find Helpful

• How CFC Underwrites Cyber Insurance: Understand how another specialized carrier approaches underwriting (higher limits, more complex risks)
• How to Answer the Beazley Cyber Insurance Application: For clients outgrowing Hiscox's SMB sweet spot

---

Frequently Asked Questions About Hiscox Cyber Insurance

Q: Can a startup with zero employees get Hiscox cyber insurance?

A: Yes, if they're solopreneurs or contractors handling customer data. Hiscox will quote single-person operations at the Tier 1 level with instant quotes. Premium might be $30-60/month depending on data handled and compliance exposure.

Q: What's the fastest way to get a Hiscox quote?

A: For businesses under 10 employees with no regulatory requirements, use Hiscox's online instant quote tool. You'll get a quote in <5 minutes. For larger or more complex businesses, submit through your broker; Hiscox will provide a quote within 24-48 hours.

Q: Does Hiscox cover crypto losses?

A: CyberClear covers losses from social engineering fraud (including wire fraud), but crypto theft is typically not covered unless it results from direct system compromise (malware that stole private keys). Coverage for crypto is a gray area across the industry; clarify with your Hiscox underwriter if crypto is relevant to your client.

Q: What if our business is in Alaska?

A: Hiscox is not available in Alaska. Alternative carriers include Coalition, Beazley, Cincinnati Insurance, or non-admitted carriers like Underwriters at Lloyd's (UaL). Coalition and Beazley are the strongest Alaska options.

Q: Can we get quotes on Hiscox while shopping other carriers?

A: Absolutely. Hiscox's application is designed for comparison shopping. Get quotes from Hiscox, Coalition, and Beazley simultaneously—then compare coverage, limits, and deductibles side-by-side.

---

Why Hiscox Matters Now

The SMB cyber insurance market is rapidly consolidating. Carriers are either going upmarket (focusing on complex, high-limit risks) or downmarket (racing to insure the smallest businesses). Hiscox has chosen downmarket—and it's a smart bet.

As cyber insurance becomes table-stakes for business operations, Hiscox's accessible pricing, bundled prevention tools, and streamlined underwriting make cyber coverage viable for the businesses that need it most: the 50-person tech firms, the marketing consultancies, the e-commerce shops that can't absorb a $200,000 breach on their own.

For brokers, this means Hiscox has become the default recommendation for SMB cyber—not because it's perfect for every risk, but because it's the first call for 80% of SMB cyber placements.

---