A single phishing email can cost a small business months of cleanup: forensic investigators, customer notifications, a website that stops taking orders, and clients who want answers. Cyber insurance exists to absorb that financial hit so a security incident does not become a business-ending one.
Policies are easier to understand once you learn two terms. First-party coverage pays your own costs after an incident. Third-party coverage pays when other people blame you. Nearly everything else in a policy hangs off that pair.
This guide explains what cyber insurance covers, what it leaves out, what it tends to cost a small business, and how to buy a policy that will actually pay when you need it.
Key Takeaways
- Cyber insurance pays for breach response, lost income, data recovery, and legal claims tied to a security incident.
- First-party coverage protects your business directly; third-party coverage protects you from claims by clients and partners.
- Small business policies commonly cost from several hundred to a few thousand dollars per year, depending on revenue and security practices.
- Insurers expect basics like multifactor authentication, offline backups, and employee training before offering their best rates.
- Exclusions matter as much as coverage, so read them closely and compare quotes with a licensed agent.
How Cyber Insurance Works
A cyber policy is a contract that pays specific costs after specific events, such as a ransomware infection, a stolen laptop full of customer records, or a breach that starts with one reused password. When an incident happens, you notify the insurer and follow their response process, and the policy pays covered costs minus a deductible, which in cyber policies is often called a retention.
First-party coverage: your own losses
First-party coverage reimburses what the incident costs you directly. Common pieces include data breach response, which brings in forensic investigators and pays for legal guidance on notification duties; customer notification and credit monitoring; business interruption, which replaces income lost while systems are down; and costs tied to cyber extortion where the policy includes them.
Third-party coverage: claims against you
Third-party coverage steps in when others suffer because of your incident. If client data was exposed and a lawsuit follows, or a regulator demands documents, this side of the policy pays for legal defense, settlements, and related costs. Companies that store or process other people’s data lean on this half heavily.
| Coverage part | What it typically pays for | Side of the policy |
|---|---|---|
| Data breach response | Forensics, legal guidance, notification, credit monitoring | First-party |
| Business interruption | Income lost while systems are down after a covered incident | First-party |
| Data restoration | Rebuilding or recovering compromised data and systems | First-party |
| Liability claims | Legal defense and settlements when clients or partners sue | Third-party |
What Cyber Insurance Typically Costs
Premiums move with your revenue, industry, the type and amount of data you hold, and the security controls you run. A modest small business policy commonly runs from several hundred to a few thousand dollars per year, with coverage limits frequently set between $250,000 and $1 million. Businesses that handle health or payment data usually pay more for the same limits.
What insurers ask before quoting
Expect a questionnaire about multifactor authentication, backup practices, endpoint protection, patching habits, employee training, and who can access systems remotely. Your answers drive both eligibility and price. Answer honestly, because misstatements on the application can void coverage later.
What moves your premium
Revenue and data sensitivity push prices up; verified security controls pull them down. A higher deductible lowers the premium, as do lower limits, though both trade away protection. Prices across the whole market also rise and fall with claims experience in your industry, so quotes can shift between renewal cycles even when nothing about your business changed.
What Cyber Insurance Usually Does Not Cover
No policy covers everything, and cyber exclusions deserve a slow read. Common gaps include:
- Incidents that began before the policy was in force.
- Losses tied to systems you knew were vulnerable and left unpatched.
- Funds lost to social engineering fraud, which is often excluded or capped unless you buy an endorsement.
- The cost of upgrading systems beyond restoring what existed before the incident.
- Physical theft of equipment, which belongs to property coverage.
Insurability of regulatory fines also varies by state and by agency, so never assume fines are covered. If a gap matters to your business, ask about endorsements that close it before you buy rather than after an incident.
How to Lower Your Cyber Insurance Premium
- Turn on multifactor authentication everywhere, especially email and remote access.
- Keep backups current, with at least one copy stored offline.
- Patch operating systems and key applications promptly.
- Run regular employee awareness training, since phishing starts most incidents.
- Write a basic incident response plan that names who does what in the first hours.
Each control lowers the chance of a claim, which is why insurers reward it. The same habits protect you whether or not a policy ever pays out. Free guidance helps too: the Small Business Administration and the Federal Trade Commission both publish practical cybersecurity basics for small businesses.
How to Buy Cyber Insurance Wisely
Compare cyber insurance quotes with a licensed agent
Coverage definitions, exclusions, and retentions differ widely between carriers, so identical headline limits are not identical policies. A licensed agent or broker who works in cyber can line up real comparisons for you. Your state insurance department licenses agents and tracks complaints, and the National Association of Insurance Commissioners offers tools for checking a company before you buy.
Read the parts other people skip
Focus on the definition of a covered event, the exclusions, the retention, and any requirement to use insurer-approved vendors after an incident. Ask what proof of security controls the carrier will want at claim time. Getting these answers before you buy is far easier than arguing about them during a breach.
A simple buying sequence keeps the process manageable. Inventory the data you hold and the systems you depend on, so you know what you are protecting. Pull together evidence of your security controls before applying, because answers you can verify lead to better prices. Then collect several quotes with matching limits and retentions, and compare the exclusions side by side before signing anything.
Frequently Asked Questions
Does general liability insurance cover data breaches?
Almost never. General liability policies cover bodily injury and physical property damage, and they typically exclude losses tied to electronic data. Some carriers add a small cyber endorsement, but the limits are usually modest. If a breach would hurt your business, a dedicated cyber policy is the tool built for the job.
Is cyber insurance required by law?
Generally, no. There is no broad federal mandate for small businesses to carry it. In practice, pressure comes from contracts: larger clients often require proof of cyber coverage before signing. Some professional licenses and industries carry their own expectations, so check the rules that apply to your field.
What security do insurers require at a minimum?
Most carriers expect multifactor authentication on email and remote access, current backups with an offline copy, endpoint protection on devices, prompt patching, and basic employee training. Weak answers on the application can mean higher premiums, reduced coverage, or a declined application. Strong practices pay twice: lower premiums and fewer incidents.
Are ransomware payments covered?
Often, but not always, and the details matter. Many policies cover extortion costs, including professional negotiators and the payment itself, subject to limits and conditions. Some exclude payments to sanctioned parties, and most insurers require you to involve them before any payment is made. Read that section before you buy, not during an attack.
Related reading: How to Choose the Best VPN for Privacy and Streaming, Do You Really Need a Password Manager?, and Identity Theft Protection: What It Covers and What It Doesn’t.
The Bottom Line
Cyber insurance for small business is a financial airbag, not a substitute for security basics. A good policy pays for breach response, business interruption, and the claims that follow an incident, while the practices insurers reward, like multifactor authentication and offline backups, prevent most incidents from happening at all.
Because policies vary sharply, compare several quotes, read the exclusions closely, and work with a licensed agent who can match coverage to how your business actually operates. Your state insurance department and the NAIC offer consumer resources if questions come up along the way.