Cyber Insurance for Small Business: A Complete Guide

Cyber insurance pays for the mess after a breach or ransomware attack: the investigators, the customer notices, the days you cannot trade, and the lawyers if someone sues. For a small business, that bill can be larger than a year of profit.

The short version:

• Among the online broker Insureon’s small business customers, the median cyber premium is $129 a month, about $1,550 a year. Your price depends on your industry, data, and security.
• If you use email and keep any customer information, you have exposure worth insuring.
• Insurers now expect basic security such as multi-factor authentication and tested backups before they will sell you a policy.
• Answer the application truthfully. A wrong answer about your security can sink a claim later.

This is general information, not insurance or legal advice. Terms vary by carrier and policy, so go through any policy with a licensed insurance professional before you rely on it.

Why small businesses get hit

It is a myth that hackers only chase big companies. Most attacks are automated. Phishing campaigns, password-guessing bots, and vulnerability scanners do not look at your revenue first. They probe millions of businesses at once and take whoever is easiest.

Small businesses are often easiest: few or no dedicated IT staff, older software, patchy updates, and nobody watching alerts at 2 a.m.

They also hold things worth stealing. Customer payment details, employee records with Social Security numbers, bank logins, and a way into larger partners through vendor relationships. And because a small business can least afford downtime, it is more likely to pay a ransom quickly, which makes it an attractive ransomware target.

Industry research consistently finds that a large share of cyberattacks land on small and midsize businesses. Once you add forensics, downtime, notification, legal exposure, and lost customers, the cost for a smaller firm routinely reaches tens or hundreds of thousands of dollars.

What a cyber policy is

A cyber policy is a bundle of coverages in two halves.

First-party coverage pays your own costs: forensic investigation, customer notification, credit monitoring, data restoration, lost income while you are down, ransom and extortion payments, and crisis communications.

Third-party coverage, the liability half, pays when other people make claims against you: legal defence, settlements, judgments, and certain regulatory penalties. The coverage checklist covers who can sue after a breach and how defence costs affect your limit.

What a policy excludes, and where it caps individual benefits, matters as much as what it covers. Our coverage guide goes through those details line by line.

What it costs

Your premium depends on your industry, your revenue, how much sensitive data you hold, your security controls, and the limit you pick. As a reference point, the online broker Insureon reports a median of $129 a month, about $1,550 a year, among its small business customers. Healthcare, financial services, and retailers with heavy card volume pay more. Treat these as rough estimates for orientation, not quotes.

The real comparison is not whether that premium is affordable. It is whether a six-figure incident with no insurance is.

If you are budgeting several policies at once, our breakdown of small business LLC insurance cost shows cyber next to general liability, BOPs, and the rest.

Do you need it?

You are a strong candidate if any of these is true:

• You keep customer names, emails, addresses, or phone numbers in any system
• You accept credit or debit cards
• You store employee records, payroll data, or tax documents digitally
• You rely on email, cloud software, or a website day to day
• Your revenue depends on systems staying online
• A client, landlord, or contract requires it

The last one surprises people. A growing number of enterprise clients and vendor agreements now require cyber insurance in the contract, the way they have long required a general liability certificate.

To be fair about it: nearly every modern business ticks at least one of these boxes.

What insurers want before they sell you a policy

Our separate guide to cyber insurance requirements covers this in more depth.

Applications used to ask a handful of questions. Carriers now expect specific security controls, and your answers become part of the policy. Common requirements:

• Multi-factor authentication (MFA) on email, remote access, and admin accounts
• Endpoint protection, meaning modern antivirus or EDR on company devices
• Regular, tested backups, ideally with one copy offline or immutable
• Prompt patching of operating systems and anything facing the internet
• Security awareness training so staff can spot phishing
• Email filtering and basic anti-phishing defences
• An incident response plan, even a simple one

The most important warning in this guide: answer the application accurately. If you say MFA is enforced everywhere and a breach later shows it was not, the carrier may have grounds to rescind the policy or deny the claim. Your coverage depends on these controls actually being in place.

How to buy a policy

1. Take stock of what you hold. List the kinds of data you store (customer, payment, employee, health), roughly how many records, and the systems you cannot operate without. This sets the limit you need and keeps your application accurate.

2. Use a broker or agent who places cyber regularly. Cyber policies differ from each other more than most business policies do, and the differences sit in definitions, sublimits, and exclusions. An independent broker can compare carriers for you.

3. Compare coverage before price. Two quotes at the same premium can be very different products. Check the sublimits for ransomware, social engineering, and notification costs. Check whether defence costs sit inside or outside the limit. Check the waiting period before business interruption cover starts.

4. Ask about the incident response panel. Most policies require you to use the carrier’s approved breach coaches, forensics firms, and notification vendors, or to get consent first. Learn how the hotline works before you need it at midnight on a Sunday.

5. Keep the controls running after you buy. Put MFA, backups, patching, and training on a recurring calendar. Your renewal and any future claim depend on them being real.

Frequently asked questions

How much does cyber insurance cost for a small business?

The online broker Insureon reports a median of $129 a month among its small business customers. Your quote depends on industry, data volume, revenue, the limit you choose, and your security controls. Higher-risk industries and higher limits cost more. Strong controls such as MFA and tested backups can lower the quote meaningfully.

Is cyber insurance required by law?

Generally no. No federal law forces most small businesses to carry it. Some client contracts, vendor agreements, and landlords do require it, and businesses in regulated sectors may find their partners effectively insist on it.

Does cyber insurance cover ransomware?

Most policies cover ransomware costs, including extortion payments where legally permitted, negotiation, forensics, data restoration, and business interruption. Ransomware benefits often have their own sublimits and conditions, so check the policy itself.

How much cover does a small business need?

A $1 million limit is a common starting point and suits many small firms. Businesses holding large volumes of sensitive records, or with contractual requirements, often need more. A broker can model scenarios against your actual data.

I run my business from home. Does my homeowner’s policy cover this?

No. Homeowner’s and renter’s policies exclude business activity, and a business data breach certainly falls outside them. A home-based business that stores customer data needs its own business coverage, which can include cyber.

Official resources

• FTC: Cyber insurance: what the Federal Trade Commission suggests a policy should cover.
• CISA: Cyber guidance for small businesses: free, prioritised security steps from the federal cybersecurity agency.
• SBA: Strengthen your cybersecurity: the Small Business Administration’s security checklist.
• FBI Internet Crime Complaint Center: annual reports: the FBI’s yearly figures on reported cybercrime and losses.
• Insureon: Small business insurance cost: median premiums by policy type among the broker’s customers.

Where to go from here

The steps are unglamorous: put the basic controls in place, get a few quotes through a broker who knows cyber, and read the sublimits before you sign.

Next, work through the coverage checklist, check the cyber insurance requirements, or see what LLC insurance costs. All the business insurance guides are in one place. Arhox is an independent publication, not an insurer, broker, or law firm; our editorial policy and disclaimer explain how these guides are prepared. For decisions about your own coverage, talk to a licensed insurance professional.