A cyberattack can cost a small business far more than a broken laptop. Ransomware can halt operations for days, a data breach can trigger legal costs and customer notifications, and a single fake invoice can send thousands of dollars to criminals. Many general business insurance policies don’t cover these risks — or cover them only partially.
Cyber insurance (also called cyber liability insurance) is designed to fill that gap. This guide explains what it covers, what it usually excludes, what insurers require, and how to decide whether your business needs it.
What Is Cyber Insurance?
Cyber insurance helps businesses recover financially from cyber incidents such as data breaches, ransomware, and online fraud. Beyond paying for losses, many policies also give you access to a team of experts — lawyers, forensic investigators, and public relations specialists — to help you respond quickly.
What Cyber Insurance Typically Covers
Coverage is usually divided into two main categories.
First-party coverage (your own losses)
- Incident response: Forensic investigators to find out what happened and stop the attack.
- Data recovery and restoration: Costs to restore systems and data.
- Business interruption: Lost income while your systems are down.
- Cyber extortion: Costs related to ransomware demands and negotiation, where legally permitted and covered by the policy.
- Breach notification: Notifying affected customers as required by law.
- Credit monitoring for affected individuals.
- Public relations to manage reputational damage.
- Funds transfer fraud and social engineering: Losses from fake invoices or impersonation scams (often with lower limits).
Third-party coverage (claims against you)
- Privacy liability: Lawsuits from customers or partners whose data was exposed.
- Network security liability: Claims if malware spreads from your systems to others.
- Regulatory defense and penalties: Costs of regulatory investigations and, where insurable by law, certain fines.
- Media liability: Claims related to online content, such as defamation or copyright infringement.
- PCI-related costs: Assessments related to payment card data breaches.
What Cyber Insurance Often Does NOT Cover
- Known incidents that happened before the policy started
- Failure to maintain required security controls stated in your application
- Acts of war and certain state-sponsored attacks (wording varies by policy)
- Infrastructure failures, such as widespread power or internet outages
- Future lost profits or long-term reputational harm beyond specific coverage
- Cost of improving your security after an incident
- Intellectual property theft (often excluded or limited)
- Bodily injury and property damage, which typically fall under other policies
Always read the policy wording carefully and ask your broker to explain exclusions and sub-limits.
Who Needs Cyber Insurance?
Your business may benefit from cyber insurance if it:
- Stores customer data such as names, emails, addresses, or health information
- Accepts online payments or stores payment details — see our payment gateways comparison
- Depends on computers, cloud apps, or a website to operate
- Sends or receives payments by bank transfer
- Has employees who use email
- Works with clients who require cyber insurance in contracts
In practice, that describes most modern businesses. Small businesses are frequent targets precisely because they often have fewer security resources.
What Insurers Look For
Insurers increasingly require businesses to have basic security controls in place before offering coverage — or charge more if they don’t. Common requirements include:
| Security control | Why insurers want it | Learn more |
|---|---|---|
| Multi-factor authentication (MFA) | Blocks most stolen-password attacks | 2FA methods ranked |
| Secure, tested backups | Enables recovery without paying ransoms | Cloud backup vs storage |
| Endpoint detection and response (EDR) | Detects and stops attacks in progress | Ransomware checklist |
| Timely patching | Closes known vulnerabilities | Ransomware checklist |
| Employee security training | Reduces phishing success | Phishing guide |
| Payment verification procedures | Prevents invoice fraud | Online banking security |
| Incident response plan | Speeds up recovery | Ransomware checklist |
Important: Answer insurance applications accurately. If you state that you use MFA or backups and you don’t, the insurer may deny a claim.
How Much Does Cyber Insurance Cost?
Premiums vary widely depending on:
- Your industry (healthcare, finance, and retail are often considered higher risk)
- Annual revenue and business size
- How much and what kind of data you store
- Your security controls
- Coverage limits and deductibles (retentions)
- Your claims history
The best way to understand costs is to request quotes from several insurers or work with a broker who specializes in cyber coverage.
How to Buy Cyber Insurance
- Assess your risks. What data do you hold, and what would happen if your systems went down for a week?
- Improve your security first. Better controls can mean better coverage and lower premiums.
- Work with a specialist broker who understands cyber policies.
- Compare policies carefully — coverage wording matters more than price.
- Check sub-limits for ransomware, social engineering, and business interruption.
- Understand the claims process and the insurer’s incident response hotline.
- Review coverage annually as your business grows.
Cyber Insurance vs General Liability Insurance
General liability insurance typically covers bodily injury and property damage, not data breaches or cyberattacks. Some business policies offer limited cyber endorsements, but these are usually much narrower than a standalone cyber policy.
Frequently Asked Questions
Is cyber insurance required by law?
Generally not, but some clients, partners, and contracts require it.
Does cyber insurance pay ransomware demands?
Some policies may cover extortion payments where legal, but many insurers now apply strict conditions and sub-limits. Payment may also be restricted by sanctions laws. Law enforcement agencies generally discourage paying ransoms.
Do small businesses really get targeted?
Yes. Many attacks are automated and opportunistic, targeting any business with weak defenses.
What should I do first if I’m attacked?
Contact your insurer’s incident response hotline right away (if you have coverage), isolate affected systems, and follow your incident response plan. Acting without the insurer’s involvement may affect coverage.
Final Thoughts
Cyber insurance helps small businesses survive the financial fallout of data breaches, ransomware, and online fraud, and gives you access to experts when you need them most. But it isn’t a substitute for good security — insurers expect MFA, backups, patching, and training before they’ll offer good terms. Strengthen your defenses first, then work with a specialist broker to find a policy that fits your risks.
This article is for general informational purposes and is not insurance or legal advice. Coverage varies by insurer and policy, so review terms with a licensed professional.