What is cyber insurance for small businesses and what does it cover?
Written byGerri Detweiler
Reviewed by Robin Saks Frankel
Summary
- Cyber insurance pays for the costs of a data breach, ransomware attack, or funds-transfer fraud, including data breach response, business interruption, and liability to customers and regulators.
- Most small businesses that store customer data, take card payments, or run on email and cloud tools are exposed.
- A typical small business policy with $1 million coverage may run roughly fifty to two hundred dollars or more per month, though it can vary significantly.
- Many insurers now ask for basic security controls, such as multi-factor authentication (MFA) and tested backups, before they will write a policy.
What is cyber insurance for a small business?
Cyber insurance, also sold as cyber liability insurance, is a business policy that pays for the costs of a cyberattack or data breach. That can include investigating the incident, notifying customers, restoring data, lost income while you’re down, ransomware and extortion demands, and claims from customers or regulators.
Policies typically have two halves. First party-coverage handles your business’s own losses, and third-party coverage handles what you owe other people when they bring claims against you. (You’ll also see it called cybersecurity insurance.) Some carriers sell the first-party half on its own as data breach insurance, which we’ll cover below.
What does cyber insurance cover?
Here’s what a cyber insurance policy typically pays for, split into the two halves. Read your policy carefully to understand your coverage.
First-party coverage (your losses) | Third-party coverage (what you owe others) |
Breach response and forensics, including investigation and legal counsel | Network security and privacy liability, including defense and settlements when customers or others sue |
Data and system restoration | Regulatory defense and fines, where the policy covers them |
Business interruption, meaning lost income while systems are down | PCI assessments and fines |
Cyber extortion and ransomware | Media liability, such as defamation, copyright or trademark claims |
Funds-transfer and social engineering fraud | |
Public relations and crisis management costs (commonly covered) | |
Customer notification and credit monitoring |
Two of these come up more than any others for small businesses.
Funds-transfer fraud through business emails compromise. Business email compromise (BEC) happens when criminals take over or fake an email account and trick someone into sending money. The FBI logged $3.05 billion in BEC losses across 24,768 complaints in 2025. The National Association of Insurance Commissioners (NAIC) says BEC drives a significant share of cyber insurance claims. One insurer’s claim report, as relayed by a third party, put BEC and funds-transfer fraud at 60% of its claims, with an average claim of $15,000.
Ransomware: The FBI received more than 3,600 ransomware complaints in 2025 with about $32 million in reported losses, but it says that number is low because it leaves out downtime and cleanup costs. In IBM’s 2026 study of breached organizations, 39% reported ransomware, and 41% of those attacks included threats to damage the companies’ reputation. Policies often cap ransomware coverage with a sublimit, and paying a ransom isn’t always easy. The U.S. Treasury Department has warned that facilitating ransomware payments, including by insurers, can risk violating sanctions rules.
What cyber insurance does not cover
Coverage varies by policy so read the exclusions before you buy. Common gaps include:
- Known unpatched vulnerabilities
- Incidents that began before the policy
- Intentional acts
- Bodily injury and property damage
- Contractual penalties beyond PCI
- The cost of upgrading systems after an incident
- War and nation-state attacks
Do small businesses need cyber insurance?
Many small businesses need cyber insurance. The exposures that trigger claims are ordinary ones: customer names and card data, invoices sent by email, cloud accounts, and employees who click on a malicious link. A July 2025 NAIC working group report found that small businesses made up the majority of policyholders and exposure. A few businesses, those with no customer data, no online payments, and no client contracts requiring coverage, may decide to skip it.
You’re a strong candidate if you:
- Take card payments: Payment Card Industry (PCI) rules apply to any business that accepts cards, even when a processor handles the transaction
- Store personal data: Customer personal information was involved in 52% of the breaches IBM studied
- Use email for invoices and payments: That’s the door BEC criminals use for fraud
- Have employees: Human error was behind 23% of breaches, and phishing was the top way in for the fourth year running
- Rely on a website or online store for revenue: Businesses doing most of their work online face more risk
- Sign client contracts that require coverage: If so, you’ll be required to provide a certificate of insurance
Is cyber insurance worth it?
Cyber insurance may pay for itself in one event.
Here’s one benchmark to consider: BEC losses reached $3.05 billion in 2025, up from $2.77 billion in 2024. Spread across the 24,768 complaints, that’s roughly $123,000 per complaint, far more than a year of premiums at any price in the cost section below. This is a very rough estimate: the FBI data doesn’t break out losses by business size, so use it for perspective.
IBM’s Cost of a Data Breach Report 2026 found the average breach cost a record $4.99 million, and only 42% of breached organizations had fully recovered. That sample isn’t limited to U.S. small businesses, though, and IBM says it leans toward organizations with more mature security programs.
Talk with your advisors to understand your risk and compare it to the cost of a policy. Think, too, about whether your business could absorb the cost of a cyber security incident.
How much does cyber insurance cost for a small business?
Small businesses will often pay less than $50 to $200 a month or more for a policy with $1 million in coverage. For reference, published averages run from $129 a month (or about $1550 a year) at one marketplace to $145 a month (or about $1750 a year) at an advisory firm. Lower-risk businesses may pay less. At the marketplace, 41% of customers pay under $100 a month.
Note that the below numbers are averages. Your costs will vary based on multiple attributes including the number of employees, what state your business is based in, your business type and other factors.
Source | What it reports | Notes |
Insureon | Customers pay an average of $129/month | Based on its customers, most with fewer than five employees |
Windes | About $1,740 a year ($145) for businesses under 50 employees | $1 million limit, $2,500 average deductible |
$1,000 to $7,599 a year | $1 million in coverage. Range, not average | |
CyberRiskPolicy | $1,500 to $3,500 a year, with a median near $1,500 | $1 million standalone policy |
Cyber Readiness Institute | $500 to $5,000 a year | General estimate, no stated method |
Morrow Institute | $1,200 to $7,500 a year | $1 million standalone policy |
What can affect your cost:
- Annual revenue. Insureon says revenue and location can affect cost.
- Industry. Insureon reports that IT/technology businesses typically pay almost three times the amount a therapy and counseling business would.
- How much sensitive data you store. Card numbers, Social Security numbers, and health records may push rates up.
- Coverage limits and deductibles: Higher limits raise premiums while higher deductibles lower premiums.
- Your existing security controls: Better controls can often mean lower rates, and underwriters view them favorably.
- Claims history: A past claim can raise your renewal premium.
Cyber insurance requirements: What insurers ask for
Insurers have changed how they decide which companies to cover. Many now underwrite on security controls, and underwriters view strong ones favorably. No federal law requires you to carry cyber insurance, but many carriers want proof of specific controls before they will issue or renew a policy. Applications may ask about:
⃞ MFA on email, remote access, and admin accounts
⃞ Offline or immutable backups, tested for restoration
⃞ Endpoint detection and response (EDR), or equivalent on every device — antivirus alone may not qualify
⃞ Email filtering and anti-phishing beyond default spam filters
⃞ Regular patching
⃞ Employee security training
⃞ A written incident response plan
Putting these basics in place before you apply can help with both eligibility and price.
The Information Technology Laboratory / Applied Cybersecurity Division of NICE offers free and low-cost cybersecurity training and resources to help you get started.
How much cyber insurance do you need?
Most published pricing assumes a $1 million limit. Insureon says limits typically run from $1 million to $5 million, depending on your industry and how much personal data you handle. Windes says businesses with 50 to 250 employees often carry $2 million.
For most small businesses, the sublimits on ransomware and funds-transfer fraud matter more than the headline limit. The right number can also scale with the records you hold, revenue, or risk.
Notification isn’t optional. All 50 states, D.C., and several territories require businesses to notify people when their personal information is breached. IBM’s 2026 report, covering breaches of 2,590 to 115,380 records, put the all-in cost of a compromised customer record at $192 on average. That figure includes far more than notification, and IBM cautions against using it to estimate much larger breaches.
Cyber insurance vs data breach insurance vs tech E&O
Data breach insurance usually covers the first-party slice, the costs of a breach itself, such as investigation and notification. It can be sold on its own or as an endorsement on a business owner’s policy (BOP). Cyber liability insurance is the fuller product, adding third-party protection when customers, partners, or regulators get involved. Technology errors and omissions (E&O) insurance is different. Its professional liability coverage for damage caused by errors in a tech company’s own products and services.
Here are a few points to think about when choosing:
- An endorsement fits a very small business with little data. Endorsements make up 55% of cyber policies in force, but only 4% of premium, and they typically cover a limited range of threats.
- A standalone policy fits anyone holding customer data or handling payments.
- Tech E&O is an addition for technology service providers.
Don’t count on general liability to fill the gap. It typically excludes electronic data loss. Nav’s guide to general liability insurance cost explains what it does cover.
How to get cyber insurance for your small business
- Inventory your data and systems. List the customer records, payment tools, email, and cloud accounts your business depends on. The type of data you store shapes your risk.
- Put the baseline controls in place first. Start with MFA, tested backups, and EDR.
- Gather your application details. Expect questions about revenue, records held, security controls, and prior incidents.
- Decide between standalone and endorsement. An endorsement is cheaper but narrower.
- Compare quotes from several places. Some online carriers say you can quote and buy in about ten minutes, and some marketplaces say coverage can begin within as little as 24 hours. Compare cyber-focused providers alongside general carriers.
- Review exclusions and sublimits before buying. Look for war and state-backed attack language, upgrade and hardware gaps, and security-maintenance exclusions. You may also want to confirm whether the policy pays in excess of other insurance you hold.
- Schedule an annual review. Pricing changes. NAIC reported U.S. cyber rates fell an average of 5% in the fourth quarter of 2024, the first quarterly drop after seven years of increases.
The bottom line
Cyber insurance matters because the incidents it covers have become ordinary. About 4.4 million cyber policies were in force in the U.S. in 2024, and insurers received nearly 50,000 claims, up almost 40% from the year prior. The controls insurers ask about are the same ones the FBI and CISA recommend. Whether a policy costs less than a week of downtime, or whether proof of coverage now shows up in clients’ contracts, it’s worth the time to evaluate whether your business needs cyber insurance.
Compare options in Nav’s business insurance marketplace. And because some insurers review business credit, take the time to check your business credit scores. Nav is not a lender or a credit bureau. Credit information is provided by third-party sources.