Cyber insurance is becoming a balance-sheet issue for India’s banks, non-bank finance companies and other financial institutions as the cost of losing access to technology systems begins to rival the immediate damage caused by a breach. An Economic Times report shows that large financial services companies are seeking higher cover, not only for ransomware or stolen data, but also for the business interruption, forensic work, legal expenses and customer remediation that follow a serious cyber incident.
One large non-bank financial company plans to increase its cyber insurance policy to ₹2,000 crore next month from ₹1,400 crore last year, according to an insurance industry executive cited in the report. The increase is significant not because it represents a general industry-wide policy limit, but because it reflects how financial institutions are attempting to quantify an operational risk that can spread across payments, lending, customer service, compliance and third-party systems.
The underlying shift is from treating cyberattacks as isolated information-security events to treating them as disruptions to essential financial infrastructure. A bank or NBFC can continue to possess its buildings, branches and servers while being unable to process transactions, authenticate customers or access records. In such cases, the loss is generated by unavailable systems and interrupted operations. For institutions handling large transaction volumes, even a short outage can create costs that extend beyond the original technical failure.
Najm Bilgrami, head of Casualty and Financial Lines Product at Tata AIG, said large banks, NBFCs and financial institutions were showing increasing interest in higher cyber insurance limits. He attributed the change to growing digital dependence and interconnected systems. Amarnath Saxena, chief technical officer, commercial, at Bajaj General Insurance, said cyber risk was now being viewed as a board-level risk, increasing the focus on protecting balance sheets against severe events.
That language matters because it places cyber resilience within the same institutional conversation as capital, liquidity and operational continuity. Insurance does not prevent an attack, restore public confidence or substitute for strong technology controls. It can, however, provide a financial mechanism for absorbing some of the costs once an incident has occurred. The size and structure of that cover therefore offer an indirect view of how companies understand the consequences of digital failure.
The risks identified in the report extend across several layers. Business interruption is a central exposure, particularly when systems remain unavailable after an attack. Ransomware, cyber extortion, data theft, privacy and data breaches, direct theft of money and third-party liabilities are also driving demand for larger limits. These risks are connected: a breach can interrupt operations, expose customer information, trigger legal obligations and require institutions to communicate with and monitor affected customers.
The cost of a cyber incident can also be substantially higher than the value of the data or systems directly compromised. Bilgrami said that in one of the largest cyber insurance claims, valued at about ₹700 crore, forensic and legal expenses accounted for nearly 30% of the total cost. That proportion illustrates the extended chain of activity that follows a breach. Institutions may need forensic investigators to establish what happened, legal advisers to assess liability, technology consultants to restore systems and communication teams to address customers and regulators.
The same chain can include the replacement of compromised debit cards and the costs associated with notifying affected customers. If KYC documents and financial records are exposed, the potential liability can increase further. The incident then becomes not only a technology problem but also a customer-protection, compliance and reputation problem.
Recent cyber incidents involving Bank of Baroda, State Bank of India, Central Bank of India and AU Small Finance Bank have brought the vulnerability of financial institutions into focus, according to the report. Insurers have also reported several attacks on financial services and manufacturing companies over the past three to four months, although investigations into some incidents remain ongoing. The supplied report does not establish that all these incidents had the same cause, scale or financial impact. Their relevance lies in showing the breadth of concern across institutions that depend heavily on connected digital systems.
This interconnectedness creates a distinctive urban infrastructure question. Financial services are increasingly delivered through digital channels rather than only through branches. A technology outage can therefore affect customers across a city or region simultaneously, even when the initiating failure is located within one institution or one supplier. The impact may be experienced as an inability to access an account, make a payment, receive a service or complete a financial transaction rather than as a visible failure of physical infrastructure.
The insurance market is also confronting a fast-changing threat environment. Insurers are increasingly concerned that hackers could use artificial intelligence to identify vulnerabilities and breach IT systems. Yet policy wordings have not changed significantly because of the growing use of AI, the report says. Policies generally cover the financial consequences of an incident regardless of whether it involves AI, a rogue employee or compromised data, subject to the terms and exclusions of the policy.
Only a handful of insurers are currently asking specific questions about clients’ AI exposure, Bilgrami said. This points to a gap between the speed at which attack methods may evolve and the pace at which underwriting frameworks are being adapted. The central issue is not simply whether an attack uses AI. It is whether an institution’s existing controls, exclusions, limits and definitions can accurately capture the resulting operational and financial damage.
Policy wording itself remains a concern. Gaps between different sections of cover can complicate claims, particularly when one incident produces several types of loss. A system outage, for example, may involve business interruption, data compromise, third-party claims and regulatory or legal expenses. Whether each cost is covered, and under which section, can determine how much financial protection is actually available. A higher sum assured does not automatically resolve ambiguity over the scope of coverage.
The report also links the issue to the expected implementation of the Digital Personal Data Protection Act in May 2027. It says the law could increase the financial consequences of data breaches, but has not yet produced a significant rise in cyber insurance purchases. The information supplied does not establish the final implementation framework or quantify the effect of the law on premiums or claims. It does show that regulatory exposure is part of the market’s assessment of cyber risk, even if it has not yet become a decisive purchasing trigger.
The available premium figures present another important part of the picture. Cyber insurance premiums remain at about 0.75% to 1.5% of the sum assured despite rising threats and demand for higher limits. On a ₹2,000 crore policy, that implies an annual premium of approximately ₹15 crore to ₹30 crore, depending on the buyer’s risk profile, claims history and cybersecurity controls. These numbers should not be read as a universal price for every institution. They show how the cost of transferring cyber risk is being assessed against the potential cost of prolonged disruption.
Competition among insurers is keeping premiums under pressure even as customers seek larger limits. This creates a tension within the market. Institutions want more protection because the possible loss is increasing, while insurers must price risks that are difficult to compare and may involve common vulnerabilities across interconnected systems. The balance between higher limits, underwriting discipline, exclusions and premiums will determine how useful cyber insurance is when a major claim occurs.
For cities, the larger issue is the resilience of invisible systems that support everyday economic activity. Financial networks are not traditionally discussed alongside roads, water systems or public transport, but their failure can also interrupt urban life. The disruption may not be physically visible, yet it can affect households, businesses, lenders, merchants and public-facing services at scale. The shift towards board-level cyber risk recognition indicates that institutions are beginning to account for this operational dependency more explicitly.
What the evidence confirms is that Indian financial institutions are increasing their attention to cyber insurance because the financial consequences of downtime, investigations, legal work, data exposure and customer response are becoming harder to contain. What remains uncertain is whether policy language, underwriting practices and institutional controls are evolving quickly enough to match those risks. The next milestones will be the way insurers assess AI-related exposure, how claims involving interconnected losses are handled and whether the implementation of data-protection obligations changes purchasing behaviour.
