AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Cyber insurance usually pays for incident response (IT forensics, legal and PR help), restoring systems and data, business interruption and claims from people whose data was exposed. The NCSC warns that standard policies may exclude some incidents, giving business email compromise fraud as an example, and insurers may refuse claims if security controls you declared were not in place. For work with Nigerian clients, check territorial cover and breach-notice support under Nigeria's data law.
Freelancers who handle client data, run client websites or send and receive invoices by email are exposed to cyber incidents whether or not they think of themselves as a target. A compromised laptop or a hijacked email account can leak a Nigerian client's customer list, or send an altered invoice to a client in Lagos. Cyber insurance is designed for those events, but what a policy pays depends on its wording.
What cyber insurance typically covers
The UK National Cyber Security Centre's guidance on cyber insurance (published 6 August 2020) lists the usual areas:
- Immediate response services: IT forensics, legal help, PR support and access to incident response firms or the insurer's own team.
- Restoring network systems and data, and limiting business interruption losses.
- Defence and settlement of legal claims from customers or others affected by a data breach.
- In some policies, other incidents such as computer-enabled fraud.
- In some cases, security consultancy and risk management support.
The NCSC is blunt that cyber insurance "will not prevent a cyber breach/attack". It pays for the aftermath.
Exclusions that matter for this kind of work
Payment-redirection fraud
The NCSC gives business email compromise fraud as an example of an incident standard policies may not cover. For a freelancer billing Nigerian clients, this is the scenario to check first: a criminal takes over your email or spoofs it, tells a client your bank details have changed, and the client pays the criminal. Ask whether the policy covers your loss, the client's loss, or neither.
Security conditions
Insurers ask about your technical and procedural controls, and policies are usually reassessed every 12 months. The NCSC warns that if you say measures are in place when they are not, the insurer may not be obliged to pay. Only declare multi-factor authentication, backups or encryption if you actually use them.
Territory and jurisdiction
Check where the policy applies and in which courts claims against you are covered. A claim brought by a Nigerian client, or a regulatory process in Nigeria, may fall outside a policy written for UK claims only. Ask the broker in writing.
Overlap with other cover
The NCSC notes that business interruption or property policies may already cover some cyber losses, or exclude them. Professional indemnity insurance covers claims that your work was negligent, which can overlap with a data breach claim; see professional indemnity for Nigerian client work.
Nigerian data law and the cost of a breach
If you process personal data for a Nigerian client, the Nigeria Data Protection Act 2023 expects the controller to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach likely to risk people's rights, and the processor must notify the controller (Udo Udoma & Belo-Osagie summary). Legal advice in Nigeria, forensic work to establish what was exposed and notifying affected people all cost money in a short window. Ask whether the policy's incident response cover extends to advice on non-UK notification duties.
A one-page incident plan
Insurers and clients both respond better to a freelancer who has a plan. Keep one page, printed and in the cloud, with:
- The insurer's incident line and your policy number.
- The contact at each client who must be told about a breach, and the time you have promised to tell them within.
- How to lock your email, cloud storage and banking from a second device.
- Where your backups are and how to restore them.
- A note to tell every client, by phone, that you will never change bank details by email alone.
Test it once a year. The NCSC notes that policies are usually reassessed every 12 months, so the review fits naturally around renewal.
Questions to ask before you buy
- What is covered and what is excluded, in particular social engineering and invoice-redirection fraud?
- Would a new type of attack be covered?
- Are third-party claims and personal data breaches covered, including claims from clients abroad?
- Are the limits suitable for the contracts you sign? Some clients, including banks, set minimums.
- What immediate response services are included, and how fast?
- What must you do to make a claim or renew?
- Is there a discount for a recognised scheme such as Cyber Essentials?
These questions follow the NCSC's own list. The NCSC recommends having fundamental safeguards, such as those certified by Cyber Essentials or Cyber Essentials Plus, before taking out cover, and notes that some Cyber Essentials holders receive cyber liability insurance through the IASME Consortium, which may not suit every business.
Where Pryme fits
Insurance is the backstop; controls come first. Pryme security uses an authenticator app rather than SMS codes and a transaction PIN for payments. If a client receives a message saying your bank details have changed, a verifiable statement through VerifyDoc.ai lets them check the account details you actually hold (receipts and statements). For data handling terms, see data processing agreements with Nigerian clients.
Questions people ask
Do freelancers need cyber insurance?
It is not a legal requirement, but freelancers who handle client data or invoices by email face real costs from a breach, and some clients require cover.
Does cyber insurance cover invoice fraud?
Not always. The NCSC gives business email compromise fraud as an example of something standard policies may exclude.
Will my policy cover claims from Nigerian clients?
Check the territorial and jurisdiction clauses; some policies only cover claims brought in the UK.
Does Cyber Essentials reduce premiums?
Some insurers offer discounts for Cyber Essentials certification, according to the NCSC.
Sources
- NCSC: Cyber insurance guidance (6 Aug 2020) · accessed Oct 2026
- Afriwise (Udo Udoma & Belo-Osagie): data breach obligations under the NDPA 2023 (28 Sep 2023) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.