Cyber Insurance for Small Business: Coverage and Cost

Cyber insurance for a small business pays the costs of a hack or data breach: forensic investigation, notifying customers, credit monitoring, negotiating and paying a ransom, lost income while systems are down, and lawsuits or regulatory actions that follow. Small businesses buy it separately because general liability, property and businessowners policies exclude cyber losses or barely touch them. A typical small business policy has a $1,000,000 limit and costs around $1,500 a year, based on Insureon's customer data.^[1]

Most owners assume hackers only go after big companies. The data says otherwise. Verizon's 2025 Data Breach Investigations Report found ransomware in 88 percent of breaches at small organizations, compared with 39 percent at large ones.^[2] Attackers also use a small vendor's network as a back door into a larger customer's systems.

What is cyber liability insurance?

Cyber liability insurance, also called data breach insurance, protects a business against hacking, data breaches and ransomware, and against the lawsuits that follow. It exists because traditional policies were never designed for this risk. Your general liability policy says electronic data is not tangible property. A businessowners policy has only small electronic data sublimits, and commercial crime insurance picks up some computer fraud but nothing close to a full breach response.

What does cyber insurance cover?

Cyber insurance covers two kinds of loss. First party coverage pays your own costs after an attack: forensic analysis to find out whether data was breached, legally required customer notices, credit monitoring, data restoration and ransom payments, plus the income you lose while getting back online. Third party coverage pays damages and defense when others make claims after an attack: customers who sue because their personal information was exposed, regulators enforcing privacy laws such as HIPAA or the CCPA, and card networks imposing assessments under the Payment Card Industry Data Security Standard. A single incident often triggers several of these at once.

The ISO benchmark form organizes this into eight insuring agreements, and most proprietary forms follow the same outline under different names:

What does cyber insurance not cover?

Cyber insurance does not cover war, and many newer forms also exclude widespread events and outages at infrastructure you depend on but do not control. State-sponsored attacks raised the question of whether foreign government hacking counts as "war" under a policy's war exclusion. In Merck & Co., Inc. v. ACE American Insurance Company (2023), a New Jersey appellate court held that a traditional war exclusion did not bar Merck's recovery for its $1.4 billion NotPetya loss.^[3] Carriers rewrote their war wording in response, and many policies now exclude nation-state and widespread events outright. The base form also excludes outages at your own power or internet provider, so a cloud failure that takes your systems down needs contingent business interruption coverage, added by endorsement and usually sublimited.

How much does cyber insurance cost for a small business?

Small businesses pay an average of $129 a month, or about $1,552 a year, for cyber insurance, according to Insureon's analysis of its customers' policies, and 41 percent pay less than $100 a month.^[1] That usually buys a $1,000,000 limit with a retention of $1,000 to $2,500. By comparison, NetDiligence puts the average cyber claim for a small or mid-sized enterprise (SME) at $246,000 over a five-year period, more than most small businesses could absorb.^[4] Premiums rise with revenue, industry, the amount of personal and card data you hold, prior incidents, and fall with the security controls you can confirm.

Two terms decide how much a policy actually pays after a loss:

• Eroding limits: on most cyber forms, defense costs reduce the limit as they are spent. A $1,000,000 policy that spends $400,000 on lawyers has $600,000 left for the judgment.
• Sublimits: extortion, social engineering and regulatory fines are common sublimit targets. A $1,000,000 policy with a $100,000 ransomware sublimit is not a $1,000,000 ransomware policy.

What do cyber insurers require before they quote?

Cyber underwriters require a set of baseline security controls before they quote, and your answers on the application become part of the policy. Nearly every carrier requires multifactor authentication on email, remote access and administrator accounts. Most also expect tested offline backups, endpoint detection and response (EDR) software, and phishing training. Many carriers scan your public internet footprint before quoting, and the most common problem they find is Remote Desktop Protocol (RDP) open to the internet on port 3389. Coalition's 2024 Cyber Claims Report found that policyholders with internet-exposed RDP were 2.5 times more likely to have a claim.^[5] Answer precisely: the insurer relies on your application answers, and a misstatement found after a loss can void coverage.

This guide is for educational purposes and summarizes standard ISO policy language. Your policy's specific terms, conditions, and endorsements control. Talk to a licensed broker about your actual exposures.

Buying cyber coverage that pays

Cyber insurance pays your own breach costs and the claims others bring after a breach, a gap your general liability and property policies leave wide open. At around $1,500 a year against an average claim of about $246,000, the math favors buying it. Answer the application's security questions accurately, because a control you said you had but never deployed can void the policy after a loss. And ask your broker how the policy handles wire transfer fraud limits and ransomware sublimits.