Cyber liability insurance for small businesses

Cyber liability insurance covers losses from data breaches, ransomware, business email compromise, and other cyber events. It’s gone from “luxury for large businesses” to “essential for most” as attacks have increasingly targeted small businesses.

What cyber insurance covers

First-party (your direct losses):

• Forensic investigation costs
• Ransomware payments (where insurable; some carriers no longer cover)
• Business interruption losses
• System restoration costs
• Customer notification and credit monitoring services
• Cyber extortion response

Third-party (your liability to others):

• Lawsuits from affected customers
• Regulatory fines (where insurable)
• Defense costs
• Contract penalties for breach of data

Who needs cyber insurance

If your business:

• Stores customer PII (names + emails + addresses, payment info, SSNs)
• Stores employee PII
• Stores health information (HIPAA exposure)
• Stores payment card data (PCI exposure)
• Uses cloud services (AWS, Google, Microsoft)
• Has remote employees
• Accepts wire transfers
• Has any digital business assets

…you have cyber exposure. The question is whether you can absorb a six-figure recovery without insurance.

Average breach cost for small business

Industry data shows the average data breach costs a small business $120,000-$1.2 million to fully recover, depending on size and severity. Ransomware demands have risen significantly.

What cyber insurance costs

For a typical small business (under 100 employees, no PHI):

• Basic policy ($250K-$500K limits): $500-$1,500/year
• Mid-tier policy ($1M limits): $1,500-$5,000/year
• Comprehensive policy ($2M+ limits with broad coverage): $3,000-$10,000/year

Healthcare, financial services, and businesses with large customer databases pay significantly more.

What underwriters look at

Cyber underwriters now require security measures:

• Multi-factor authentication on all accounts
• Endpoint detection and response (EDR) deployed
• Backups that are tested and segmented
• Employee training on phishing
• Incident response plan documented
• No EOL software (no Windows 7, etc.)

If you can’t check these boxes, you may not qualify for coverage — or you’ll pay significantly more.

What it doesn’t cover

• Pre-existing breaches discovered after policy starts
• Fines from regulatory violations that occurred before coverage
• Reputational damage (separately covered by some policies)
• Cyber crime where insured fails to follow reasonable security procedures

Common carriers

Chubb, AIG, Beazley, Coalition, Cowbell, At-Bay, Travelers, Hiscox, and CNA all write cyber coverage for small business. Specialized “insurtech” carriers (Coalition, Cowbell, At-Bay) often bundle active security monitoring with coverage.