What cyber insurance actually is

Cyber insurance covers financial losses resulting from cyberattacks, data breaches, and related incidents. Like other business insurance, it doesn’t prevent incidents — it limits the financial damage when they occur.

For small businesses, the relevant question is: what would a serious cyber incident actually cost, and is that cost large enough that I need insurance to cover it?

What cyber insurance typically covers

First-party coverage (your costs):

  • Data breach investigation and notification costs (notifying customers is legally required in most states and can be expensive)
  • Business interruption losses when a cyberattack takes your systems down
  • Ransomware payments and system recovery costs
  • Credit monitoring services for affected customers
  • PR and reputation management costs

Third-party coverage (claims against you):

  • Legal defense and settlements if customers sue over a data breach
  • Regulatory fines and penalties (coverage varies significantly by policy)

What it typically doesn’t cover

  • Pre-existing vulnerabilities that were known before the policy was taken out
  • Incidents caused by employee negligence or insider threats (coverage varies)
  • Physical damage to hardware
  • Intellectual property theft (covered by different policies)
  • Loss of future revenue beyond the interruption period

Who needs it

Cyber insurance is worth serious consideration if your business:

  • Stores customer personal information (names, addresses, payment data, health data)
  • Would be significantly disrupted by a ransomware attack that encrypted your systems
  • Operates in a regulated industry (healthcare, financial services) with mandatory breach notification requirements
  • Has clients who require it by contract

For a business with no customer data, no online systems, and no meaningful digital assets, cyber insurance may not be worth the cost. For most businesses with computers and customer records, it deserves evaluation.

What it costs

For small businesses, basic cyber insurance runs $500–2,000/year depending on coverage limits, industry, and security posture. Businesses with good security practices (MFA, backups, employee training) typically pay less. Get quotes from 2–3 providers and compare coverage limits and exclusions, not just price.