Cyber Insurance for Small Business: What It Covers and What It Costs

Cyber insurance is a commercial policy protecting businesses from financial losses caused by data breaches, ransomware, and cyberattacks. Small businesses typically pay roughly $1,000 to $3,000 per year for a standard policy offering $1 million in coverage. However, annual premiums can increase significantly for companies lacking multi-factor authentication, storing sensitive client data, or operating in high-risk industries. Below, we break down first-party and third-party coverage, key exclusions, insurer security requirements, and cost factors.

The average small-business cyberattack now costs tens of thousands of dollars — and the hackers know that a 12-person accounting firm with weak email security is a far easier target than a bank with a security operations center. Cyber insurance was a niche product a decade ago; today it's one of the fastest-growing commercial lines, and increasingly a contractual requirement: many clients, lenders, and enterprise vendors now demand proof of cyber coverage before signing small businesses.

Here's what the policies actually cover, what they cost, and the application questions that quietly decide your premium — plus the security controls that have become non-negotiable to get insured at all.

First-party coverage: when it happens to you

First-party coverage pays your own costs after an incident. The big buckets: ransomware and extortion — the ransom itself (where legal), the negotiators, and the forensics; incident response — the breach coaches, IT forensics, and legal counsel who show up in the first 48 hours and bill at eye-watering rates; business interruption — lost income while your systems are down, usually with a waiting period like a deductible in hours; data restoration — rebuilding corrupted systems and data; and notification and credit monitoring — the legally required customer notifications, call centers, and credit-monitoring offers after customer data leaks.

The surprise for most owners: a large share of the cost of a "cyber event" is people, not technology. Lawyers, PR advisors, forensic accountants, and notification logistics routinely exceed the technical cleanup. Good policies pay for all of it.

Third-party coverage: when it happens to your customers

Third-party coverage handles your liability to others when your breach becomes their problem: customer lawsuits after their stolen data gets used, regulatory fines and investigations (where insurable), PCI penalties from card processors, and claims from clients who suffered losses because your compromised email told them to wire money to "your" new account — the business email compromise scenario that has drained small businesses of billions.

For firms that touch other people's data or money — accounting, law, medical, e-commerce, property management — third-party limits are the ones to size carefully, because a class action over leaked client data scales much faster than your own cleanup bill.

What the policies exclude (read this part twice)

Modern cyber policies have teeth in the exclusions. War and state-sponsored attacks — a clause insurers have invoked more aggressively each year. Prior events — anything that started before your coverage began. Failure to maintain agreed security — if your application claimed MFA and endpoint protection and you let them lapse, expect the claim fight of your life. And increasingly, cybercrime-adjacent fraud: social engineering losses where an employee was tricked into wiring funds often carry a sublimit far lower than your headline limit, or require a specific endorsement.

Also worth knowing: property and crime policies don't cover cyber in any meaningful way. Your general liability policy excludes it. The "we already have insurance" assumption is one of the most expensive misconceptions in small business.

What it actually costs

For a small business with modest data exposure, cyber coverage now commonly runs $1,000–$3,000 annually for a $1 million limit — though pricing hardened across the market after several ugly claims years, and risky profiles (poor security posture, crypto involvement, heavy remote access) can multiply that. The dominant pricing factor isn't your industry alone — it's your answers to the security questionnaire. Two identical businesses, one with MFA and offline backups, one without, can see premiums differ by multiples, or the second one simply declined.

Deductibles typically run $2,500–$25,000 for small businesses. As with most commercial lines, the honest comparison is limits-to-premium after reading what's excluded and sublimited — a cheap policy with a $50,000 fraud sublimit isn't cheaper than the one that actually pays.

The security controls insurers now require

The underwriting checklist has effectively become a small-business security standard: multi-factor authentication on email, remote access, and admin accounts — the single highest-leverage control and the most common reason applications get declined; endpoint detection and response on all machines instead of plain antivirus; offline, tested backups — ransomware encrypts reachable backups, so "we have backups" means nothing until they're isolated and restore-tested; patching cadence for operating systems and critical software; email filtering and a wire-verification procedure with a second human for any payment change; and increasingly, security awareness training and a written incident response plan.

If that reads like a compliance burden, the reframe: these are the controls that prevent the incident cyber insurance pays for. The policy is the airbag; the security stack is the brakes — and the insurer is pricing whether you have brakes before selling you the airbag.

How to buy it without the headaches

Come to the application with real answers: employee and revenue counts, how much sensitive data you hold, your hosting and payment stack, and an honest picture of your security posture — misrepresenting it is how claims get denied. Compare at least three quotes on sublimits, not just headline limits. Match limits to your realistic worst case: your legal and notification exposure per record leaked, your downtime cost per day. And if a client contract requires cyber coverage with specific minimums, buy to the contract, because that deal is usually worth more than the premium difference.

Cyber insurance can't make your business un-hackable — nothing can. What it does is convert a potentially business-ending event into a survivable, insured one, and forces the security discipline that prevents most incidents in the first place. For most small businesses handling customer data or client money, that combination has quietly become table stakes.