UK startups usually need cyber insurance when an outside deadline hits: an enterprise or MSA cyber clause, a marketplace listing, a government tender, an investor or security questionnaire, or customer data going into production — not on day one “for fun.” Buy it before that deadline, so you are not scrambling mid-deal for a £1 million or £2 million certificate.
This page is that timing job. What cyber pays for (ransomware, response, downtime) lives on Cyber Insurance UK. The wider tech pack — PI, cyber, employers’ liability, D&O — sits on Startup Insurance UK. After a raise, the full post-funding checklist is on Startup insurance after seed round.
Meshed is an FCA-regulated UK broker. Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248. We place commercial covers for UK limited companies, partnerships, and sole traders, from a panel of insurers. Broker fee is a flat 10%, with no admin add-ons. We do not invent “from £X a month” cyber prices.
The five real triggers
Founders rarely open a broker conversation because they finished a risk workshop. In practice the clock starts when someone outside the company names cover — or when your own systems start holding other people’s data at scale:
Enterprise / MSA cyber clause — a liability or insurance schedule that names cyber (often next to professional indemnity), with a certificate date before go-live
Marketplace or cloud listing — partner programmes and some app marketplaces (for example AWS-style listings) want a certificate on file before you publish
Government or framework tender — supply-chain questionnaires that treat cyber as a condition of bidding
Investor DD / security questionnaire — procurement or investor packs that ask for cyber evidence before you are on the approved list
Customer data in production — design partners, live SaaS tenants, or any scale where a mailbox takeover or ransomware would stop you trading
If none of those have landed yet, you may still want cyber for your own outage risk — but the commercial urgency almost always arrives with a deadline attached. A near-miss (phishing that almost worked, a lost laptop, a vendor breach next door) is also a fair reason to bring the date forward.
Why PI is not cyber
Professional indemnity answers a different question: a client says your product, advice, or delivery cost them money. Cyber answers what happens when your systems or data are hit — ransomware, incident response, forensics, notification, and your own downtime.
Some PI wordings pick up a sliver of third-party data risk. That will not pay for the 2am response team, restoring backups after ransomware, or keeping the product online while you investigate. Enterprise and government schedules increasingly pair both. Size PI on Professional Indemnity Insurance UK; size cyber on Cyber Insurance UK.
Typical certificate asks
Early-stage UK software and SaaS deals commonly ask for £1 million to £2 million of cyber, often on the same schedule as PI. Match the certificate to the clause; do not invent a higher number “to look serious” unless the contract or real exposure needs it.
We will not publish a fake “from £X a month” cyber pack. Premium follows the company: what you build, where data sits, turnover, security controls, claims, and the limit named in the deal.
What to send a broker before the deadline
Gather these before legal sends the final schedule:
What you build and who the customer is (plain English, not only the SIC code)
Where customer data lives and how you back it up
MFA / patching / Cyber Essentials status if you have it
The contract or questionnaire clause naming cyber (and PI) limits
Current schedules if you already hold anything labelled “tech package”
Turnover, headcount (Ltd, partnership, or sole trader), and any claims or near-misses
Clean, explainable risks can often move same-week. Vague files and weak control answers take longer — exactly when deal pressure is highest.
Fintech / payments exception
If you move money, issue e-money, need a payments licence, or are building toward PSD2-style permissions, this timing piece is not enough. Those programmes sit on Fintech Insurance UK (and PSD2 Insurance UK where the certificate ask is PSD2-shaped). Say the regulatory shape up front; do not stretch a generic startup cyber pack across a regulated payments risk.
How Meshed helps
We place cyber for UK tech and SaaS companies — limited companies, partnerships, and sole traders — usually alongside PI when a contract or questionnaire names both. We will not invent a priced “startup cyber pack” with a fake monthly figure.
What to send: company structure, product description, where data sits, the clause that named cyber, and any current schedules.
Product depth: Cyber Insurance UK. Full early-stage pack: Startup Insurance UK. Then speak to us with the company, the product, and the deadline — ideally before the first enterprise deal is waiting on a certificate.
Mesh'd Limited t/a Meshed / Meshed Cover · FCA FRN 1033248 · flat 10% broker fee · Ltd, partnerships, and sole traders · no fake prices · Speak to us
FAQs
When do UK startups need cyber insurance?
Usually when a contract, marketplace, tender, investor or security questionnaire, or production customer data creates a deadline — and ideally before the first enterprise deal, so you are not binding under a certificate date. It is not a blanket legal duty.
Do I need cyber before my first enterprise customer?
If you are pursuing mid-market or enterprise accounts, or putting customer data into a design-partner production environment, yes in practice. Buying after the MSA names a limit is how deals stall.
Is professional indemnity enough instead of cyber?
No. PI is client delivery and advice risk. Cyber is systems, data, response, and outage. Most software and SaaS deals need both on the schedule.
How much cyber cover do startups usually need?
Match the contract. Early-stage UK tech asks commonly sit around £1 million to £2 million, often paired with professional indemnity. Higher is not automatically better.
Is cyber optional if nobody has asked yet?
Optional as a statute — not optional as cashflow risk if ransomware or a mailbox takeover would stop you trading. Commercially, “nobody asked yet” often flips the week a serious buyer opens vendor DD.
I am a sole trader selling to enterprises — does this apply?
Yes for the trigger. Large buyers still name cyber and PI in schedules. We place for Ltd, partnerships, and sole traders — speak to us about placement for your structure.
We are a payments / EMI startup — is this the right page?
No. Use Fintech Insurance UK. This page is the timing job for non-payments tech and SaaS.
Are you an insurer?
No. Meshed is a broker. Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248.
Vincent Liu
Co-founder & CTO
