Small Business Cyber Insurance: What It Covers and How Much It Costs

Why Small Businesses Need Cyber Insurance in 2026

Sixty percent of small businesses that suffer a significant cyberattack close within six months — not because the attack itself was unsurvivable, but because the financial aftermath was. Between breach notification costs, regulatory fines, legal fees, customer notification, credit monitoring services, and lost revenue during downtime, a single ransomware incident can cost a small business $50,000 to $500,000 or more. Cyber insurance exists to cover exactly these costs.

Yet fewer than 20 percent of small businesses carry cyber insurance. Most assume they are too small to be targeted, that their general liability policy covers cyber events (it almost never does), or that premiums are unaffordable. This guide corrects all three misconceptions.

What Cyber Insurance Actually Covers

Cyber insurance policies vary significantly by carrier and tier, but most business policies include two categories of coverage: first-party coverage for your own losses, and third-party coverage for liability to customers and partners.

First-Party Coverage — Your Own Losses

• Ransomware payments: Covers ransom payments to attackers if your data is encrypted and you choose to pay. Most policies also cover the cost of a professional negotiator.
• Business interruption: Replaces lost revenue and covers ongoing expenses during the period your systems are down due to a cyber incident.
• Data recovery: Covers the cost of restoring or recreating data and systems after an attack, including forensic investigation costs.
• Notification costs: Most states require businesses to notify customers when their personal data is breached. Notification — printing, mailing, call center staffing — costs money. Cyber insurance covers this.
• Credit monitoring services: Covers the cost of providing credit monitoring to affected customers, often required under state breach notification laws.
• Cyber extortion response: Covers professional crisis response services, including cybersecurity firms brought in to contain and remediate the attack.

Third-Party Coverage — Liability to Others

• Customer data liability: If your breach exposes customer personal information and they sue, this covers legal defense and settlements.
• Regulatory fines and penalties: HIPAA, PCI-DSS, CCPA, and other regulations impose fines for breaches. Some policies cover regulatory defense and certain fines.
• Media liability: Covers claims related to copyright infringement, defamation, or privacy violations in your digital content.
• Network security liability: If a breach in your network spreads to a vendor or customer and causes them losses, this covers the resulting claims.

What Cyber Insurance Does Not Cover

Understanding exclusions is as important as understanding coverage. Common exclusions in small business cyber policies include:

• Prior breaches: Incidents that began before the policy effective date are not covered, even if discovered after.
• Nation-state attacks: Many policies exclude attacks attributed to foreign governments — a growing exclusion concern given the rise of state-sponsored cybercrime.
• Social engineering fraud without specific endorsement: Standard policies often exclude losses from CEO fraud and wire transfer scams unless you specifically add a social engineering rider.
• Infrastructure failures: Outages caused by your cloud provider, ISP, or utilities are typically excluded.
• Physical theft of hardware: Covered under property insurance, not cyber.
• Intentional acts: Breaches caused by your own employees acting maliciously may be excluded or sub-limited.

How Much Does Small Business Cyber Insurance Cost?

Premiums vary based on your industry, revenue, the type of data you handle, your existing security controls, and your claims history. As a general benchmark for small businesses in 2026:

• Very small business (under $1M revenue, low data exposure): $500 to $1,500 per year
• Small business ($1M–$5M revenue, standard data): $1,500 to $5,000 per year
• Small business handling medical, financial, or payment card data: $3,000 to $10,000+ per year

The industry you operate in significantly affects your premium. Healthcare, financial services, legal, and e-commerce businesses pay more than retail, construction, or service businesses because of the sensitivity and volume of data they handle.

What Insurers Look at When Setting Your Premium

When you apply for cyber insurance, carriers will ask about your security posture. Having these controls in place lowers your premium and increases your likelihood of approval:

• Multi-factor authentication on email and remote access
• Endpoint detection and response (EDR) software on all devices
• Regular, tested data backups stored offline or in immutable cloud storage
• Employee cybersecurity training — at least annually
• Patch management — systems updated within 30 days of critical patch releases
• Incident response plan — even a basic written plan signals maturity

Businesses that cannot demonstrate these basics are increasingly being declined coverage or charged significantly higher premiums. The controls that lower your insurance cost are the same ones that reduce your actual risk — they pay double dividends.

How to Buy Cyber Insurance

You have three main options for purchasing cyber insurance as a small business:

1. Through your existing business insurance broker: If you already have a broker handling your general liability or BOP (Business Owners Policy), ask them about adding a cyber endorsement or standalone cyber policy. Many BOP policies now include limited cyber coverage — review what you already have before buying separately.
2. Directly through a cyber-specialist carrier: Companies like Coalition, At-Bay, and Corvus specialize in small business cyber insurance and offer online applications with same-day quotes. These carriers also provide active monitoring tools and risk alerts as part of the policy.
3. Through a professional association: Many industry associations offer group cyber insurance rates to members. If you belong to a trade association, check whether they offer this benefit.

Bottom Line

Cyber insurance is not a replacement for good security — it is the financial safety net that exists when security fails. For a small business, a premium of $1,000 to $3,000 per year to protect against a potential six-figure loss is straightforward risk math. Review your existing coverage for gaps, document your current security controls before applying, and get at least three quotes before choosing a policy.