Cyber Liability Insurance for Small Businesses

What cyber liability insurance covers

Cyber liability insurance helps your business recover from cyber incidents such as data breaches, ransomware, hacked email accounts and some types of online fraud. Policies usually have two parts.

First-party coverage (your own costs):

• Breach response: notifying affected customers, call centers and credit monitoring.
• Forensic investigation: experts who find out what happened and stop it.
• Data recovery: restoring files and systems.
• Cyber extortion: responding to ransomware demands, subject to the policy's terms and the law.
• Business interruption: lost income while your systems are down.
• Crisis management: public relations help to protect your reputation.

Third-party coverage (claims against you):

• Lawsuits from customers or partners whose data was exposed.
• Regulatory proceedings and, where insurable, some fines and penalties.
• Media liability for content published online, in some policies.

Example: An employee at a real estate agent's office clicks a phishing link. Criminals access email accounts that contain client financial documents. The cyber policy pays for the investigation, legal advice on notification rules, letters to affected clients and credit monitoring.

Example: An online store is hit by ransomware during a holiday sale. Orders stop for four days. The policy helps pay to restore systems and covers part of the lost income during the outage.

What cyber insurance doesn't cover

• Improving your systems beyond their pre-attack condition.
• Incidents you knew about before the policy started.
• Physical damage to hardware, which is a property claim under a business owner's policy.
• Long-term reputational losses, in many policies.
• Claims tied to ignored security requirements, if the policy makes certain controls a condition of coverage.

Also note that general liability and most BOPs exclude or sharply limit cyber incidents, so don't assume you are covered.

Who needs cyber liability insurance?

If your business stores or handles sensitive information, you have cyber risk. That includes:

• Businesses that take payments online or by card, such as online stores and restaurants.
• Businesses holding personal or financial data, like real estate agents, consultants and landlords.
• Health-related businesses holding protected health information, such as therapists, physical therapists and home care agencies.
• Technology providers, like IT consultants, whose access to client systems increases exposure.
• Any business that relies on email and online banking, which is almost every business.

Some clients, especially larger companies and healthcare organizations, require vendors to carry cyber insurance.

How much does cyber insurance cost?

According to Insureon's 2026 data from 100,000 small-business customers, the median cost of cyber insurance is $129 a month. Your price depends on:

• Industry and the kind of data you hold.
• Number of records, such as customer files and card numbers.
• Revenue.
• Security controls, such as multi-factor authentication, backups and employee training.
• Limits, sub-limits and deductibles.
• Past incidents.

Compare cyber with other policies in our guide to how much business insurance costs, or estimate your total with the business insurance cost calculator.

Limits, sub-limits and deductibles

Cyber policies have an aggregate limit for the year, and many have sub-limits for specific costs, such as ransomware payments, social engineering fraud (tricking staff into sending money) or regulatory fines. A policy with a $1 million limit might cover only a much smaller amount for social engineering. Check:

• The overall limit and each sub-limit.
• The deductible or retention you pay first.
• The waiting period before business interruption coverage starts.
• Whether you must use the insurer's approved response vendors.

How to buy cyber insurance

Expect a detailed application about your security practices. Answer accurately, since misstatements can affect coverage. Compare quotes from licensed agents, brokers or insurers, and look closely at what's covered, not just the price. Once you are insured, save the breach response hotline and share it with your team.

Simple steps that reduce cyber risk

• Turn on multi-factor authentication for email, banking and key systems.
• Back up data regularly and keep at least one copy offline.
• Update software and devices promptly.
• Train staff to spot phishing and payment-change scams; confirm payment requests by phone.
• Limit access so each person has only the access they need.

Free guidance for small businesses is available from the Federal Trade Commission and the Cybersecurity and Infrastructure Security Agency (CISA).

What to do in the first hours after a cyber incident

How you respond early can affect both the damage and your coverage. A typical sequence:

1. Call your insurer's breach hotline as soon as you suspect an incident. Many policies require prompt notice and give you access to approved lawyers and forensic firms.
2. Contain the problem. Disconnect affected devices from the network, but don't wipe them, because investigators need the evidence.
3. Don't pay a ransom on your own. Payments involve legal and policy rules, and the insurer's experts should guide that decision.
4. Change passwords for affected accounts from a clean device and confirm multi-factor authentication is on.
5. Preserve records of what happened, when, and who was involved.
6. Follow legal advice on notification. State laws set rules for telling customers and, in some cases, regulators. Your breach lawyer will explain what applies.

Cyber insurance vs. technology E&O

These two policies are often confused:

Technology businesses often buy both, sometimes as a combined policy. See professional liability insurance for more on E&O.

Does a home-based or very small business need cyber coverage?

Size alone doesn't remove the risk. A one-person business can lose access to its email, get tricked into paying a fake invoice, or expose client files on a stolen laptop. If a breach would force you to notify clients or stop working for days, it is worth getting a quote, especially if a client contract requires it.