Compare business insurance quotes
Pick two or more companies to see rates where you live. Free, no obligation.
Why it matters
IBM’s 2025 study found the average data breach cost $4.44 million globally and a record $10.22 million in the United States. Breaches took an average of 241 days to identify and contain. Small businesses face far smaller bills, but even a modest ransomware attack or email fraud can cost tens of thousands of dollars in recovery, lost sales and notification costs, enough to threaten a small company.
What cyber insurance covers
| First-party (your own losses) | Third-party (claims against you) |
|---|---|
| Forensic investigation and incident response | Lawsuits from customers whose data was exposed |
| Customer notification and credit monitoring | Regulatory inquiries, fines and penalties where insurable |
| Data restoration and system repair | Liability for spreading malware to others |
| Business income lost during an outage | Media liability for online content |
| Ransomware response and, where legal, extortion payments | Legal defense |
| Public relations help | Payment card industry assessments |
The Hartford’s CyberChoice policy, for example, covers ransomware income loss, liability for others’ data, data restoration, forensics and public relations, with a 24/7 hotline. Many policies include a breach response team you call first.
What’s often excluded
- Losses from known vulnerabilities you failed to fix
- Social engineering or funds-transfer fraud, unless specifically added
- Upgrading systems beyond their pre-breach condition
- Bodily injury and property damage
- Acts of war, depending on the wording
What it costs
Insureon’s small business customers paid a median of $129 a month ($1,548 a year) in 2026. Price depends on your industry, revenue, how much sensitive data you hold, your security controls and the limits you choose. See our cost guide.
What insurers expect
Applications typically ask about your security practices. Common requirements include:
- Multi-factor authentication on email and remote access
- Regular, offline or immutable backups
- Prompt software patching and supported systems
- Endpoint protection on all devices
- Staff training on phishing
- An incident response plan
Strong controls can lower your premium and make claims smoother. IBM found more ransomware victims are refusing to pay, 63% in 2025, often because good backups let them recover.
Do you need it?
If you store customer names, emails, payment details or health information, rely on computers to operate, or take online payments, cyber insurance is worth considering. Some clients and contracts now require it. Professional services firms should check whether their professional liability policy includes any cyber cover. Compare providers in our insurer guide.
Frequently asked questions
What does cyber insurance cover for small businesses?
Costs of a breach or attack, including investigation, notification, data restoration, lost income and lawsuits from affected customers.
How much is cyber insurance for a small business?
A median of about $129 a month, or $1,548 a year, in Insureon’s 2026 data.
Does general liability cover cyberattacks?
Usually not. Data breaches and cyber losses need a cyber policy or endorsement.
Does cyber insurance pay ransoms?
Some policies cover extortion payments where legal, along with recovery costs. Check the policy wording.
How can I lower my cyber insurance premium?
Use multi-factor authentication, keep backups, patch software, train staff and have an incident response plan.
Sources
- CyberScoop – IBM Cost of a Data Breach 2025
- Insureon – Small business insurance costs (Feb 2026)
- Business Wire – The Hartford bolsters small business cyber insurance (Sept 2025)
- U.S. Small Business Administration – Get business insurance
- NerdWallet – Hiscox business insurance review (Feb 2026)
Insurance prices, discounts and rules change often and vary by state. Figures were checked in October 2026; confirm details with the insurer or your state insurance department.