Cyber Insurance
Cyber insurance is written around what happens after a data breach, a ransomware attack or a fraudulent payment request. This page explains the usual parts of a policy and what to gather before you compare options.
What cyber insurance is for
Most small businesses now run on email, cloud software, online payments and a customer list stored somewhere on a laptop or server. When a criminal gets into those systems, the bills arrive quickly: someone has to find out what happened, restore the files, tell the people whose information was exposed and answer the questions that follow. Cyber insurance is the policy built around that sequence of events.
Ordinary business policies were not designed with stolen data in mind. The Insurance Information Institute points out that a Business Owner’s Policy sometimes reaches narrow data incidents, such as files lost to a virus, while a fuller range of cyber risks calls for a stand-alone policy. Asking how your current policies treat electronic data is a sensible first step before shopping for anything new.
The parts a cyber policy is usually built from
First-party coverage responds to your own costs. The Federal Trade Commission’s small-business guidance lists the usual pieces: forensic investigation, legal counsel on notification duties, customer notices and call-center help, recovering or replacing lost data, crisis communications, income lost while systems are down, and cyber extortion such as a ransomware demand.
Third-party coverage addresses claims brought against your business by others: customers whose records were exposed, partners who say an attack reached them through your systems, or regulators asking questions after a breach. Defense costs, settlements and judgments sit on this side, along with some media claims, such as a copyright or trademark dispute over content you published online.
Many cyber forms also offer protection for fraud that moves money: a criminal who takes over your inbox and redirects a customer payment, or a fake vendor invoice that persuades a bookkeeper to wire funds. Insurers call these funds-transfer fraud and social-engineering fraud, and they are often written with their own, smaller limit. Ask whether the cyber form you are reviewing carries them or whether a crime bond is meant to hold that exposure.
Businesses that ask about cyber insurance
If you keep customer names, card details, health information or bank account numbers, the question applies to you. Consultants and bookkeepers hold client financial files. Real estate businesses exchange wiring instructions that fraudsters love to imitate. Childcare centers store family contacts and medical notes, and retailers with an online checkout process card payments every day.
Size offers little shelter. Criminals send phishing emails and fake payment requests to small offices precisely because those offices tend to have fewer safeguards and one person handling the money. A bookkeeping firm with a handful of staff can face the same notification steps as a much larger company if a laptop full of client files goes missing from a car.
What to have ready for a cyber insurance quote
Cyber applications ask more about how you run your systems than most commercial forms do. Expect questions about multifactor authentication on email and remote access, how often you back up data and whether a copy sits offline, who installs software updates, and whether staff are taught to spot phishing messages before they click.
Gather a rough count of the records you hold and what kind they are, the software and cloud services you rely on, any outside IT provider and its contract, your annual revenue, and any past incidents. Client contracts sometimes name a cyber or technology liability limit, so bring those pages too. The business insurance quote checklist covers the general details every application starts with.
When you compare quotes, line up the same items side by side: the limit for each part, any smaller limit tucked inside it for fraud or extortion, the retention you pay first, and whether the insurer supplies a panel of breach lawyers and forensic firms you are expected to call.
How cyber fits beside your other coverage
General liability is built around bodily injury and physical damage to other people’s property, and many current forms carry data-related exclusions. Ask how a breach claim would be handled before assuming it belongs there. Professional liability addresses mistakes in the services you deliver; for an IT consultant or software firm, a breach that grows out of client work can sit between the two, which is why technology businesses often review combined technology E&O and cyber forms.
Crime coverage and cyber coverage overlap around stolen money. A crime policy centers on theft of your money and property, including theft by employees, while a cyber policy centers on data, systems and the work of responding to an attack. Reading both together shows whether a payment-fraud loss would fall to one policy, the other, or neither.
California breach notices and your response plan
California’s breach notification law, Civil Code section 1798.82, requires a business to notify California residents whose unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person. The Attorney General’s data breach page sets out when a sample of that notice also goes to the state.
Notification is only one step. Lawyers, forensic investigators and call centers are often needed within days, and the breach-response part of a cyber policy is organized around arranging that help. Write a one-page plan now: who to call first, where the policy number lives offline, and how to reach your bank quickly if a payment was diverted. Keep it with your other renewal papers so it is easy to find on a bad morning.
How much does cyber insurance cost for a small business?
Cyber premiums start low for the smallest firms. National small-business insurance marketplaces published annual premiums from about $400, with a median near $129 a month, or roughly $1,550 a year, as of 2026. Those figures come mostly from owners with fewer than five employees and modest revenue buying a standard $1 million limit with a deductible of $1,000 to $2,500. A company with staff, a few million in revenue or a database of patient, payment or client financial records commonly pays well above that median, and the published spread climbs past $8,000. All of it is published industry data on other buyers, not a Mithril1 quote.
Insurers rate cyber mainly on revenue, the number and type of records you hold, and how many people can reach them. Headcount shows the scaling most clearly in published figures. One national model puts a business with one to four employees at about $83 a month for a $1 million aggregate limit and a $1,000 deductible, and a five-person business about 45% higher. The arithmetic: $83 × 1.45 comes to about $120 a month, or roughly $1,440 a year. The same model puts a firm with 20 to 49 employees at around four times a sole proprietor’s premium.
Your premium runs higher with more medical, payment or Social Security records, more staff who can open them, a past breach or ransomware incident, a larger limit or a smaller deductible, and add-ons such as funds-transfer fraud or business interruption. Tech firms sit toward the top of the published industry figures. It runs lower with multifactor authentication on email and remote access, tested offline backups, prompt patching, a written call-back step before any payment change, a clean incident history and a higher deductible. List your systems and record counts with the cyber readiness checklist, then contact us for a quote built on your own answers.
A few useful answers
Common questions
Is cyber insurance worth considering for a business with only a few employees?
Yes, if the business keeps customer data, takes payments online or uses email to move money. Small offices receive the same phishing and fake-invoice attempts as large companies, and the response steps after a breach do not shrink with headcount.
Does a Business Owner’s Policy include cyber insurance?
Some BOPs carry a limited data endorsement, often aimed at accidental data loss. A stand-alone cyber policy addresses a wider set of events, such as ransomware, breach notification and privacy claims. Compare the two side by side before relying on the endorsement.
What is the difference between first-party and third-party cyber insurance?
First-party coverage is for your own costs after an attack: investigation, notices, data recovery, lost income and extortion. Third-party coverage is for claims others bring against you, such as customers or partners affected by the breach.
How does cyber insurance treat a ransomware demand?
Cyber extortion is a standard part of many cyber policies, usually alongside the cost of restoring systems and data. Ask how the policy handles negotiation, the payment decision and time offline, and what the insurer expects you to do before acting.
What questions does a cyber insurance application usually ask?
Expect questions on multifactor authentication, backups, software updates, staff phishing awareness, the types and rough number of records you hold, your IT provider and any past incidents. Honest, specific answers make quotes easier to compare.
Which handles a fraudulent wire transfer, cyber insurance or a crime bond?
It turns on the wording of each policy. Some cyber forms include social-engineering or funds-transfer fraud, and many crime policies offer computer and funds-transfer fraud. Bring both policies to the review and ask which one names that loss and at what limit.