What Is Cyber Insurance and What Does It Cover?

A single ransomware attack can lock a small business out of its own systems in minutes, and the bill that follows, forensics, legal help, customer notifications, lost sales, can run into six figures. Yet many business owners still assume their general liability policy has them covered. It usually does not. That is exactly the gap cyber insurance is designed to fill. In this guide, we answer the question “what is cyber insurance and what does it cover”, explain how it works when an attack actually happens, what it typically costs, and who really needs it, so you can decide whether your business should have it before you need it, not after.

Table of Contents

What Is Cyber Insurance?

Cyber insurance, also called cyber liability insurance or cybersecurity insurance, is a standalone business insurance policy that helps pay the financial costs of a data breach, ransomware attack, or other digital security incident. In exchange for a monthly or annual premium, the insurer agrees to cover many of the expenses that follow a cyber event, from hiring forensic investigators to paying legal settlements.

The product emerged in the late 1990s, when businesses first began relying heavily on the internet and insurers noticed a gap: traditional commercial policies were written for physical risks like fire and theft, not for stolen customer data or frozen networks. Over time, cyber policies expanded to cover a broad range of threats, including malware, ransomware, business email compromise, social engineering fraud, and system failures caused by a security incident.

It is important to understand what cyber insurance is not: it does not prevent attacks, and it is not a substitute for good security. Firewalls, multi-factor authentication, and backups reduce the chance and severity of an incident; insurance limits how much of the bill lands on your business when one happens anyway. Most insurers now expect basic controls, such as multi-factor authentication, before they will offer a policy.

How Cyber Insurance Works

When a cyber incident happens, the process usually follows a clear sequence, and speed matters at every step.

Step 1: Report the incident immediately. Most policies include a 24/7 breach hotline. Calling it right away connects you with the insurer’s incident response team, which typically includes a breach coach (a lawyer experienced in data incidents), forensic investigators, and IT specialists. Reporting promptly is not just good practice; many policies require it, and delays can complicate a claim.

Step 2: Contain the damage. The response team works to stop the attack from spreading, isolating affected systems, resetting compromised credentials, and preserving evidence. If ransomware encrypted your files, specialists assess whether backups can restore operations or whether negotiation is needed.

Step 3: Investigate what happened. Forensic experts determine how attackers got in and whose data was exposed, an investigation that alone can cost $10,000 to $50,000 for a small business.

Step 4: Notify and comply. If customer data was exposed, nearly every US state has a breach notification law with strict deadlines. The insurer helps pay for notification letters, call centers, and credit monitoring, and helps you meet regulatory reporting duties.

Step 5: Recover and settle claims. The policy pays for restoration, covers lost income, and defends you against claims from customers, vendors, or regulators.

Two numbers shape what the insurer pays: the policy limit (the maximum payout) and the deductible you pay first. Some coverages also carry their own sublimits: for example, a $1 million policy might cap ransomware payments at $250,000, so read the fine print.

What Does Cyber Insurance Cover?

Most cyber policies divide coverage into two buckets: first-party coverage, which pays for your own losses, and third-party coverage, which pays when someone else claims against you. Many policies also include a third category for financial fraud. Here is how they compare:

Coverage type	What it typically pays for	Example
First-party (your own costs)	Forensic investigation, data and system recovery, business interruption, ransomware response, crisis PR, customer notification, credit monitoring	A hacker encrypts your files; the policy pays for investigators, restoration, and lost income during downtime
Third-party (claims from others)	Legal defense, settlements and judgments, regulatory fines and investigation costs, claims from affected customers or partners	Customers sue after their credit card numbers are exposed in a breach of your online store
Financial crime (often sublimited)	Money lost through business email compromise, fake invoice scams, or social engineering	An employee is tricked into wiring payment to a fraudster posing as a supplier

Ransomware and cyber extortion coverage is now standard on most modern policies, paying for incident response, negotiation support, restoration, and, where legally permitted, the ransom itself. Some carriers cap ransomware payments well below the overall limit, and coverage can be denied if required security controls were not in place.

Business interruption coverage replaces income lost while your systems are down because of a covered attack. Standard policies usually limit this to interruptions caused by a security failure, an attack by a bad actor, rather than a system failure like a botched update, unless you buy a specific endorsement.

Third-party liability protects you when others come after you. If a breach exposes customer data, this side of the policy pays for lawsuits, regulatory defense, settlements, and damages, including claims if your compromised systems spread malware to a partner’s network. The Federal Trade Commission recommends confirming any policy includes both first-party and third-party coverage, a 24/7 breach hotline, and “duty to defend” language.

What Cyber Insurance Does Not Cover

Cyber insurance is broad, but it has real limits. Knowing them before you buy prevents a nasty surprise at claim time.

Physical property damage. If hardware is damaged during an incident, cyber insurance generally does not pay to replace it. That is a commercial property claim, not a cyber claim.
Prior incidents. A breach that started before your policy began, or a vulnerability you already knew about and did not disclose, will not be covered.
System failures without an attack. Downtime caused by a failed software update, a configuration mistake, or a vendor’s bad patch is usually classed as a system failure and excluded unless you purchased a specific endorsement.
Acts of war and infrastructure outages. Many policies exclude losses from war, terrorism, or widespread power and internet outages, though wording varies widely by carrier.
Intellectual property theft. The theft of trade secrets or proprietary information is often excluded or only partly covered.
Intentional wrongdoing. Losses caused by fraud or illegal acts committed by the business itself, or by an owner, are excluded.
Weak security controls. If you told the insurer you used multi-factor authentication and you did not, a claim can be reduced or denied. Honesty on the application is essential.
Future lost profits and reputational harm. A policy may cover income lost during downtime, but it will not compensate for customers who never come back or for long-term damage to your brand.

How Much Does Cyber Insurance Cost?

Cyber insurance for a small business is more affordable than most owners expect, but prices vary widely by industry, revenue, the amount of data you hold, and the security controls you run.

Industry data from 2026 puts the typical small business premium at roughly $100 to $300 per month, or about $1,200 to $3,600 per year for a $1 million policy. The median small business pays around $140 per month for a standalone policy with $1 million in coverage and a $2,500 deductible. Low-risk sole proprietors and freelancers can sometimes find coverage starting around $30 to $60 a month, while mid-sized firms handling sensitive data often pay $400 to $1,000 a month. At the entry level, basic policies for very small businesses commonly run $500 to $900 a year for $100,000 to $250,000 in limits, while comprehensive policies with $1 million or more in limits typically cost $1,500 to $5,000 a year.

What drives your price up or down? The biggest factors are:

Industry. Healthcare practices often pay $3,000 to $7,500 a year because of HIPAA exposure, while professional services firms with strong controls often land in the $1,500 to $3,000 range and retailers in the $2,000 to $5,000 range.
Revenue and records. The more customer records you hold, the more a breach costs, and the more you pay.
Security controls. Businesses with multi-factor authentication, endpoint detection and response, and immutable offline backups commonly pay 20 to 40 percent less than peers with minimal controls. Without multi-factor authentication, you may not qualify at all, or you may pay a 25 to 50 percent surcharge.
Coverage limits and deductible. A $250,000 limit costs far less than $2 million, and a higher deductible lowers the premium.
Claims history. A prior breach or claim pushes premiums up, just as with any other insurance.

Rates for the same risk can differ by 40 percent or more between insurers, so get several quotes. These are typical ranges, not quotes, your actual premium depends on your business.

Who Needs Cyber Insurance?

The short answer: if your business collects, stores, or processes personal information, payment card data, or health information, you should seriously consider it. Roughly 43 percent of cyberattacks target small businesses, and the average small-business breach costs over $100,000, a figure that can be fatal for a company without coverage.

E-commerce and retail businesses need it most urgently: they hold payment data, which brings PCI compliance exposure and liability if card numbers are stolen. Healthcare practices face HIPAA fines of up to $1.5 million per violation category. Professional services firms hold sensitive client files attackers prize. And any business working with larger clients may find coverage required by contract, many vendor agreements and RFPs now demand proof of $1 million or $2 million in cyber coverage.

Even a business that keeps no customer data online is not risk-free. If you rely on email, cloud software, or an online booking system, a ransomware attack can still shut you down for days. The question is not whether you are big enough to be targeted, attackers use automated tools that scan the internet for vulnerable systems of any size. The real question is whether you could absorb a six-figure incident bill from operating cash. If the answer is no, cyber insurance deserves a place in your budget.

Pros and Cons of Cyber Insurance

Pros:

Financial protection. A single incident can cost hundreds of thousands of dollars; insurance transfers most of that risk to the insurer.
Expert help on call. The 24/7 breach hotline gives you a forensic team, a breach coach, and PR help within hours, resources a small business could never keep in-house.
Legal and regulatory support. The policy helps you meet state notification laws and defends you against lawsuits and regulatory fines.
Business continuity. Business interruption coverage replaces income lost while systems are down, keeping the business alive through recovery.

Cons:

It costs money every year: typically $1,000 to $3,000 for a small business, whether or not you ever claim.
Coverage has gaps. Property damage, prior incidents, system failures, and reputational harm are usually excluded.
Security requirements. Insurers may require MFA, endpoint protection, and backups before they will issue a policy, which means investing in security first.
Claims can be denied if your application was inaccurate or required controls were not actually in place.

How to Choose a Cyber Insurance Policy

Start by listing what you actually need to protect: customer records, payment data, health information, and the systems your business cannot operate without. That inventory tells you how much coverage you need, most small businesses land between $500,000 and $1 million in limits, though businesses handling health or financial data often need more.

Next, compare at least three quotes, and compare the policy wording, not just the price. Check that both first-party and third-party coverage are included, look for the ransomware sublimit, confirm the business interruption waiting period (many policies only pay after 8 to 12 hours of downtime), and read the exclusions. Ask the agent directly: does this policy cover social engineering fraud? What security controls are required? What happens if we are breached through a vendor?

Consider working with an independent broker who can shop multiple carriers, rates for the same risk can differ by 40 percent or more. And before you apply, put the basics in place: multi-factor authentication on email and remote access, endpoint protection on every device, tested offline backups, and basic employee training on phishing. These controls not only qualify you for better rates, they also make a successful attack far less likely. Keeping your passwords and accounts locked down is part of the same picture; our guide to the top features of Samsung Password Manager covers one practical way to manage strong, unique passwords across your team. Phishing is also the most common way attackers get in, so it helps to know how to spot it, see our guide on what spam text messages are and how to stop them.

Frequently Asked Questions

How much does cyber insurance cost for a small business?

Most small businesses pay between $100 and $300 per month, or roughly $1,200 to $3,600 per year for a $1 million policy. The median is around $140 a month. Low-risk freelancers may find coverage from $30 to $60 a month, while businesses handling sensitive data can pay $400 to $1,000 a month. Strong security controls can cut premiums by 20 to 40 percent.

Does cyber insurance cover ransomware?

Yes, virtually all modern cyber policies cover ransomware, including the ransom payment where legally permitted, negotiator fees, forensic investigation, system restoration, and business interruption losses. However, some carriers cap ransomware payments well below the overall limit, and coverage can be denied if required controls like multi-factor authentication were not in place.

Is cyber insurance required by law?

There is no broad federal mandate requiring small businesses to carry cyber insurance. However, several states and industries effectively require it, New York requires it for financial services firms, and healthcare organizations face HIPAA obligations that make breach coverage near-essential. In practice, the requirement usually comes from contracts: larger clients, vendors, and lenders increasingly demand proof of cyber coverage before doing business with you.

Does general liability insurance cover cyberattacks?

No. Standard general liability policies specifically exclude cyber-related losses. Some include a small cyber endorsement, but the coverage is limited and rarely enough for a real incident. A standalone cyber liability policy is the only reliable protection when a breach, ransomware attack, or wire fraud actually happens.

Do individuals need cyber insurance, or is it only for businesses?

Cyber insurance is primarily a business product, but personal cyber insurance exists too, often as a homeowners add-on covering identity theft and fraud. For most individuals, strong passwords, multi-factor authentication, and bank-provided identity theft protection cover the main risks.

What should I do first if my business is hacked?

Call your insurer’s 24/7 breach hotline immediately, before you wipe systems or pay anyone. The insurer’s response team will guide containment, preserve evidence, and bring in forensic experts. Then document everything, avoid communicating with the attacker directly, and let the breach coach handle notifications and legal steps. Quick, guided action in the first hours makes a measurable difference to the final cost.

Conclusion

Cyber insurance is a financial safety net for a risk that nearly every modern business faces: a data breach, a ransomware attack, or a fraudster tricking an employee into sending money. It typically covers investigation, recovery, lost income, legal defense, and customer notification, the costs that turn a bad day into a business-ending one. It does not prevent attacks and it does not cover everything, so pair it with solid security habits and read the exclusions before you buy. If your business handles customer data or depends on being online, getting a few quotes is one of the cheapest ways to protect everything you have built.

This article is general information, not licensed insurance advice. Policy terms vary by insurer and state, always read your policy and confirm details with a licensed agent.

Sources: NerdWallet, Cyber Insurance: What It Is, Best Options; TechTarget, What Is Cyber Insurance, and Why Is It Important?