SherpaTech blog

Cyber Incident at 7am? What Happens Next

SherpaTech — Mon, 19 Oct 2026 05:45:50 GMT

What does a cyber incident look like for a tech business?

Your phone buzzes at 6:52am. It’s a client. Their systems are down, and when you log in, so are yours.

You know your systems inside out, and it still happened. Building and running technology for a living doesn’t make you immune, and when you look after other people’s systems, a bad morning rarely stays yours alone.

What happens in the first 30 minutes of a cyber incident?

If you hold cyber insurance, your first call is to your insurer’s incident line, the number on your policy. Your second call is to us. While the response team works on your systems, we’re there to walk you through what comes next.

What happens next is the part most people don’t realise they’ve paid for. A notified incident sets a specialist response team in motion, often within 30 minutes: lawyers, forensic IT specialists, ransomware negotiators, and communications and regulatory experts. People who handle this every week, working for you, while the clock is ticking.

What does a cyber incident cost without insurance?

One of our customers decided against cyber cover. The premium was around $42,000. When an incident hit, bringing in incident response on day one cost them $100,000. That’s more than two years of premium, gone in a single day, before anything else had unfolded.

They hadn’t done anything wrong. They were hiring the same specialists the policy would have provided, at full rate, in a hurry, on the worst morning of their year.

What happens in the days after a cyber incident?

An incident rarely stays in one place. You look after other people’s systems, so one bad morning can reach your clients, your contracts and more than one policy at once.

That’s where we come in. We know your business and your policy, so we can tell you what happens next. We walk you through it step by step, chase the claim, and stay with you until you’re out the other side.

One tip while the phones are ringing: be careful what you promise your clients in those first calls. Talk to us before you accept any blame.

It's the kind of thinking that comes from working with managed service providers, systems integrators, managed security providers, data centres and vendors every day. Tech and IT businesses are the only ones we work with.

Who does what in a cyber claim?

You, the customer

What they own: The risk

What they do: Run the business, know the contracts and the exposures, and say when something changes

Your SherpaTech broker

What they own: The advice

What they do: Understand the business, shape the program, build the submission, negotiate with insurers, manage the changes, and run the claim

The insurer

What they own: The money

What they do: Assess the risk, set the terms and the price, issue the policy, and pay covered claims

Three things tech and IT businesses should check this week

Do your contracts match your cover? It’s easy for a contract to promise more than your policy will pay, and the gap usually shows up when a client makes a claim. Check that the liability you’ve agreed to lines up with the limit on your professional indemnity policy.

Do your clients hold their own cyber cover? If they do, their policy can be the first line of response. It’s Hannah’s golden question, and you can read more about it in Meet the Sherpas: Hannah.

Do you know your incident number? Does your team know who to call, and can they find the number if your systems are down? Keep a copy somewhere offline.

The bottom line

A cyber policy gets the right people on the phone fast. A broker who knows tech and IT knows your business, knows your policy, and stays with you until it’s sorted.

Already insured? Good. The question is whether your cover was set up by someone who knows how your business really works. Send us your standard client contract and we’ll check it against your cover, with a clear written outcome you can act on. Or just have a chat with Tim or Andrew.

Frequently asked questions

What's the difference between cyber insurance and professional indemnity insurance for IT businesses?

Cyber insurance covers incidents involving your own systems and data, such as a data breach or ransomware attack, and can include response costs and liability to others. Professional indemnity insurance responds when a client claims your advice or services caused them a financial loss. For IT businesses, one incident can trigger both policies. Wordings vary, so check yours with your broker.

How much does cyber insurance cost for an IT business?

The cost of cyber insurance for an IT business depends on the business itself. Insurers look at revenue, the services you provide, the clients and data you handle, your security controls and your claims history. A SherpaTech broker builds a submission that shows insurers how your business works, which helps you get terms that fit.

What do insurers look at before offering cyber insurance to a tech and IT business?

Insurers want to see how well a techology business protects its own systems and its clients' systems. Expect questions on multi-factor authentication, backups, patching, access controls and whether you have an incident response plan. They'll also ask about the services you deliver and any past incidents. Clear, accurate answers shape the terms you're offered.

How much cyber cover does a tech business need?

The right amount of cyber cover depends on what your business could be responsible for after an incident. Start with your client contracts, the size of your clients, the data you hold and how long you could operate with systems down. Your SherpaTech broker can map those exposures and recommend limits that match them.

Can I get cyber insurance after an incident has happened?

You can usually still get cyber insurance after an incident. A new policy is unlikely to cover an incident you already know about. Insurers will ask about past incidents and what you've changed since, so be upfront. Showing the steps you've taken to strengthen your systems helps your application.

What should I tell my broker when my business changes?

Tell your broker about any change that affects your risk. That includes a new service line, a large new client, an acquisition, new locations or a jump in revenue. Changes like these can affect whether your cover still fits. At SherpaTech, managing those changes is part of the job, and a quick call keeps your program up to date.

How often should a tech business review its insurance?

Review your insurance at least once a year at renewal, and any time your business changes. Tech and IT businesses grow and shift quickly, so cover set up two years ago may no longer match your contracts, clients or services. A regular review with your broker keeps the gaps small.

Does my business need an incident response plan?

Yes. An incident response plan tells your team who to call, what to do and where to find key details when systems are down. Include your insurer's incident number, your broker's details and your key client contacts, and keep a copy offline. Insurers often ask whether you have one.

Who is SherpaTech?

SherpaTech is an Australian insurance broker that works only with tech and IT businesses, including managed service providers, systems integrators, managed security providers, data centres and technology vendors. That specialist focus means SherpaTech understands how tech businesses run, how their client contracts work and where their risks sit.

Meet the SherpaTech Team: Hannah, the underwriter who switched sides

SherpaTech — Mon, 19 Oct 2026 03:58:27 GMT

A confession from an insurance broker. A Sherpa is humble, hard working, and gets you to the top. It's why we're called SherpaTech, and it's how we look after Australia's tech and IT businesses.

Base camp: the bounce-back that started it all

Hannah's career at SherpaTech began with an out of office reply.

For five years she was a cyber underwriter for an insurance company, and plenty of SherpaTech renewals landed on her desk. She became the underwriter Tim, Andy and the team trusted. So when Tim emailed her one day and got an auto reply, he did what any good networker would do. He reached out on LinkedIn to ask where she had landed.

One coffee became a job offer.

"I'd got to know the team really well from the underwriting side," Hannah says. "They knew their stuff and they could explain the risks. That was really refreshing."

She was also ready to see more of the mountain. Underwriting had kept her deep in cyber. With SherpaTech, she works across the full range of cover a technology business needs, from IT liability to cyber, providing cover all the way from the base of the mountain to the summit.

Fluent in underwriter

Ask Hannah what an underwriting background brings to broking and she'll tell you it's a loop.

"To be a great broker, you have to understand underwriting. To be a great underwriter, you have to understand broking. We build trust and help each other."

For our customers, the benefit is twofold.

First, Hannah builds every submission for the reader she used to be. Clear, complete, and free of any hurdles usually encountered by underwriters.

Second, she translates in the other direction. Hannah can take the complexity from an insurer’s side, whether that is risk pricing or fine print clauses, make sense of it, and explain what it means for your tech and IT business. She can take a policy wording apart line by line when it matters. She also knows that most of the time, a client wants a clear answer in plain English, and Hannah is a polyglot. "Brokers go wide. Underwriters go deep. I get to do both."

Insights: Field notes from the renewal desk

A soft market is a chance to look around, not a reason to jump.

More insurers are chasing business, so Hannah's testing the market on plenty of renewals. But she doesn't move clients just because she can. Every change comes after a proper look at the whole picture, and the question is always "what's the best fit for this business?", not "who's cheapest this year?". Sometimes the answer is to stay put, sometimes it is to make a move. The key is that each decision has your best interests in mind.

Your renewal is about you, not the market.

Every renewal starts with what matters most to you. If it's price, Hannah goes after price. If you're happy with last year's premium, she'll look at how to make it work harder: a higher limit, a cover you've been going without, a product that suits how you actually work. And a soft market doesn't mean everyone pays less. Your policy is built around you, not the market average.

Disputes are on the rise.

We are seeing more professional indemnity claims and contract disputes, with a few landing on Hannah’s desk each week. "When you buy insurance, you're buying a commitment. We are seeing those commitments tested, and my job is to make sure yours is honoured." That's why she spends so much time getting your cover right before you ever need it, so if something does go wrong, you land well.

Hannah's summit tip: the golden question

Do your customers have their own cyber insurance?

For tech and IT businesses, a customer's cyber cover is one of the best protections for your own professional indemnity. When something goes wrong in a customer's environment, a claim can still come your way, along with the cost of defending it, whoever was at fault. Their cyber policy can be the first line of response. That’s what makes it the golden question: the answer tells you whether you’re facing an incident on your own or with a first line of defence behind you.

Hannah's advice is to keep track of who has cover. A simple register of which customers hold cover is a great start. A requirement in your contracts is even better.

It's also worth remembering that insurance is just one way to manage risk. Transferring it to an insurer is Hannah's job, but it sits alongside your master services agreement, your company policies and the way you offboard clients. Insurance is there for when things go wrong, and so is the team behind it.

Once you’ve asked the golden question about your customers, turn it around and ask why you hold the insurance you have. "A lot of customers see insurance as a contractual requirement," she says. "I want them to understand what they value and what their key risk is, because we can structure the insurance around that." A combined IT liability and cyber policy suits some businesses. Others need a different setup. As Hannah puts it, "There's no one size fits all."

The trust beyond the contract

For a lot of insurers, claims departments are a separate team from underwriters. This is not Hannah’s experience; she was part of a team that worked in close proximity with each other, during a phase where the market was hardening.

This equipped her with all the right tools to now pick up your first phone call.

When a technology business faces a cyber incident or a professional indemnity notification for the first time, it can feel like uncharted territory, and the pressure is on. They build and run technology for a living, so many never expected it to happen to them. Hannah walks them through it, step by step.

"When we come out the other side, they trust us," she says. "Insurance is a piece of paper at the end of the day. It's a contract. The trust is what sits beyond it, and that's what we're building."

Off the mountain

Remember when we called Hannah a polyglot earlier in this piece? That is because Hannah is also fluent in Japanese! She lived in Japan during high school.

Here are some more cool facts about Hannah:

She is currently very busy planning her wedding alongside her fiancé, Taisei, and together they rescue and foster stray cats, taking care of the wider community by supporting desexing programs. This year, she rescued two kittens when they were just three weeks old (pictured below).

Her interests are not just cats, however! She loves a nature walk (hot tip: Oatley Park), and has a plan to do a sommelier course next year.

That's the SherpaTech Way

Underwriter, broker, translator, cat rescuer. Whatever the hat, the job is the same: be the person you can trust when it counts. That's Hannah, and that's what it means to be in the SherpaTech team.