Small businesses are now one of the most common targets for cyberattacks — not because hackers are chasing big payouts, but because smaller firms usually have weaker defenses and still hold valuable customer data. A single ransomware attack or data breach can cost a small business tens of thousands of dollars, even before any lawsuit. Cyber insurance exists to cover those costs, and for many small businesses it is now as basic as general liability cover.
This guide explains what cyber insurance actually covers, what it typically costs for a small business, who needs it most, and the exclusions that catch buyers out.
In this guide
What cyber insurance covers
Cyber policies are usually split into two parts. First-party cover pays your own costs after an incident: forensic investigation to find out what happened, restoring or rebuilding data, notifying affected customers, providing credit monitoring, repairing damaged systems, and covering lost income while your business is down. Third-party cover pays claims made against you by others — for example, a customer suing because their personal data was leaked, or a regulator fining you for a data-protection failure.
Many policies also cover ransomware payments and the cost of negotiating with attackers, plus crisis PR help to manage reputational damage. If you store customer payment details, health records, or employee information, or if your business would stop earning the day your systems go down, these are the costs that matter most.
What it typically costs
For a small business, cyber insurance is usually affordable compared with the risk. A typical small firm with modest data exposure can expect to pay roughly $500 to $1,500 per year for a basic policy, while businesses handling sensitive data, processing payments, or operating in regulated industries more often pay $1,500 to $5,000 per year. Larger or higher-risk firms pay considerably more.
Your premium depends mainly on your industry, annual revenue, the type and volume of data you hold, your security practices (such as multi-factor authentication and regular backups), and your claims history. Insurers increasingly ask detailed security questions before quoting — firms without basic protections may be declined or quoted much higher rates. As with any business insurance, the cheapest quote is not always the best value if its limits are too low for a real incident.
Who needs it most
- Businesses that store customer data — online stores, clinics, accountants, law firms, agencies, and any firm with a customer database.
- Businesses that take card payments — a breach of payment data brings both notification costs and potential card-brand fines.
- Businesses that depend on their systems to trade — if a ransomware attack would halt your income for days, business-interruption cover is the safety net.
- Contractors and suppliers — many larger clients now require cyber cover before signing a contract, so a policy can win you work.
If your business is just you, a laptop, and no customer data, the risk is lower — but if you work as a freelancer handling client systems or data, the exposure is real. Our guide to business insurance for freelancers covers the wider package worth considering alongside cyber cover.
What it doesn't cover
Cyber insurance is not a magic shield. Common exclusions include:
- Known vulnerabilities left unpatched — if you ignored a critical security update, the insurer may refuse the claim.
- Deliberate acts by your own staff — insider attacks by employees are often excluded or limited.
- Infrastructure failures — outages caused by power failures or a cloud provider's own outage may not be covered.
- Future lost profits beyond the policy period — business-interruption cover usually has a defined indemnity period, often 30 to 90 days.
- Fines in some jurisdictions — regulatory fines may be uninsurable depending on local law.
How to choose a policy and lower your premium
- Match the limit to a realistic worst case — estimate the cost of a week offline plus notifying your customers; a $250,000 limit is a common starting point for small firms.
- Check the retroactive date — some policies only cover breaches discovered after the policy starts, even if the intrusion happened earlier.
- Confirm ransomware cover explicitly — some policies cap or exclude ransom payments.
- Turn on multi-factor authentication and automated backups — these two steps alone often cut premiums and make approval much easier.
- Ask about incident-response support — a good policy gives you a 24/7 hotline and a pre-vetted response team, which matters more than it sounds at 2 a.m. during an attack.
Finally, review the policy at renewal: your data exposure, revenue, and the threat landscape all change year to year, and a policy that fit last year may not fit now. If your income depends on you personally being able to work, pair this with the right personal safety net — see our guide to disability insurance for the self-employed.
Frequently asked questions
Is cyber insurance worth it for a very small business?
Usually yes, if you hold any customer data or rely on your systems to earn. A single breach can cost far more than several years of premiums, and many small firms never recover from the combined cost and lost trust.
Does general liability insurance cover cyberattacks?
Generally no. Standard general liability policies exclude data breaches and cyber events. Some offer small endorsements, but a dedicated cyber policy is the reliable route.
How long does it take to get cyber insurance?
For a small business, often a few days. You will answer a security questionnaire; firms with multi-factor authentication and backups in place usually get quoted fastest.
Does cyber insurance cover ransomware payments?
Many policies do, up to a sublimit, and usually with the insurer's consent. Check the wording — some policies cap ransom payments separately from the overall limit.