Pen Underwriting Doubles Its SME Cyber Limit to £10 Million, Raises the Incident Response Tower to £1 Million and Brings UK Cyber Claims Handling In-House

Pen Underwriting, a UK managing general agent that writes cyber insurance for small and medium-sized businesses, has announced a set of changes that double the main policy limit and widen several of the supporting covers. The details in this article come from Pen's announcement dated 8 June 2026. They are a company's description of its own product, and the policy wording, which was not reviewed, will determine what is actually covered.

The headline change

The main limit on Pen's SME cyber policy doubles to £10 million. It applies to companies with revenue of up to £600 million, and to risks that start on or after 1 July 2026. A policy limit is the most the insurer will pay for claims in the policy period, so the change raises the ceiling for the whole programme. The announcement does not say what the previous limit was in so many words, but a doubling to £10 million implies £5 million.

The incident response tower

Alongside the main limit sits an incident response tower, which is a separate pot of money for the immediate costs after an attack, such as forensic investigation, legal advice and public relations support. It sits outside the main limit, which means that spending from it does not reduce the £10 million. Pen is raising this tower from £250,000 to £1 million, a fourfold increase. The point of a separate tower is that a business can pay for specialists in the first hours and days without worrying that those costs will reduce the money available for later losses.

Crime sub-limits

Sub-limits for crime-type losses are also rising. The announcement lists phishing, corporate identity theft and services fraud, and says that sub-limits increase to £100,000 or £250,000. A sub-limit is a cap on a specific type of loss that is lower than the overall limit. Crime losses such as fraudulent payment instructions are frequent for smaller firms, so these figures determine how much of such a loss the policy will repay. Buyers should check which sub-limit applies to which event.

Underwriting, excesses and rates

Pen says it has simplified its underwriting questions, which should make it quicker to get a quote. Excesses, the amount a policyholder pays before the insurer pays, are cut by more than half for certain revenue bands. Rates have been adjusted at the lower revenue end of the range. The announcement does not give the rate changes, and it does not say which bands receive which excess reductions, so the effect on a given business cannot be judged from the release.

Claims in-house

All UK cyber claims handling is being brought in-house. For policyholders, this means that Pen's own claims team handles claims instead of an outsourced administrator. Whether this improves service depends on execution, which the announcement does not evidence. The change builds on six enhancements to the product that Pen announced the previous September.

The company's message

Ian Summerfield, managing director of cyber at Pen, said: "Our mantra in this market is that cyber risk never stands still, so we won't either." The statement positions the changes as part of a continuing process of product development.

How to read the announcement

Four points are worth separating. First, a higher limit matters most for the larger end of the range, such as a company with several hundred million pounds in revenue, whose potential losses from an outage or data breach could be large. Second, the larger incident response tower may be the most practical improvement for small companies, because immediate costs after an attack are often significant relative to a small firm's budget. Third, lower excesses make claims more likely to pay out from the first pound for small losses. Fourth, a company announcing broader cover is also taking on more risk, so buyers should expect underwriters to scrutinise controls such as multi-factor authentication, backups and incident plans. That last point is a general observation about the market and not something stated in the release.

What buyers should do

A business considering the policy should compare it with others on the same terms, including exclusions for war and infrastructure failure, conditions on security controls, and the definition of business interruption. Broker advice is useful because wordings differ. The announcement is a summary, and the actual cover is set by the policy document.

Putting the limits in context

A £10 million limit for companies with up to £600 million of revenue is a large amount for the SME segment, where policy limits of a few million pounds are common. Whether a business needs that much depends on its size, the data it holds and how reliant it is on its systems. A firm with £600 million of revenue could lose a good deal of income from a prolonged outage, so a higher limit may be appropriate, while a firm with a few million pounds of revenue may find the incident response tower and the crime sub-limits more relevant than the headline figure. The incident response allowance of £1 million is worth noting because it sits outside the main limit, which means that, on the announced terms, the total available for a major event can be higher than £10 million. This last point is simple addition of the two announced figures and depends on the policy wording.

The in-house claims change is also significant for brokers. Having claims handled by the insurer's own team can speed decisions and keep one point of contact, but it also concentrates responsibility. Brokers will likely watch how quickly incident response providers are engaged after a notification, since that is when delays are most costly.

Limits

This article is based on a company announcement and has not been independently tested. It is general information, not insurance advice, and it is not a recommendation to buy a particular product.