Quick Answer: Cyber insurance costs $100–$500+/month for most small businesses in 2026, depending on industry, revenue, and data exposure. Healthcare and financial services pay the most. Compare cyber insurance quotes →
Cyber attacks cost small businesses an average of $200,000 per incident, and that number is rising. Cyber insurance helps cover breach response costs, ransomware payments, business interruption losses, and lawsuits from affected customers. This guide breaks down exactly what you'll pay, what affects your premium, and how to get the best rate.
Table of Contents
- Average Cyber Insurance Cost by Business Size
- Cost by Industry
- What Affects Your Premium
- What Cyber Insurance Covers
- Cost vs Risk of Not Having It
- Best Carriers and Their Pricing
- How to Lower Your Cyber Insurance Cost
- Getting the Best Rate: Step by Step
- FAQ
Average Cyber Insurance Cost by Business Size
Cyber insurance premiums scale primarily with revenue, number of records stored, and industry risk. Here's what businesses typically pay in 2026:
| Business Size | Annual Revenue | Records Stored | Annual Premium | Monthly Cost |
|---|---|---|---|---|
| Solo/freelancer | Under $100K | Under 1,000 | $400–$800 | $33–$67 |
| Micro business | $100K–$500K | 1,000–10,000 | $600–$1,500 | $50–$125 |
| Small business | $500K–$2M | 10,000–50,000 | $1,200–$3,000 | $100–$250 |
| Mid-size business | $2M–$10M | 50,000–250,000 | $3,000–$8,000 | $250–$667 |
| Upper mid-market | $10M–$50M | 250,000+ | $8,000–$25,000 | $667–$2,083 |
Standard coverage at these prices: $1M per occurrence / $1M aggregate with $2,500–$10,000 deductible.
These are starting points. Businesses in high-risk industries (healthcare, finance, legal) or with prior claims history will pay significantly more.
→ Get a personalized cyber insurance quote for your business
Cyber Insurance Cost by Industry
Your industry is one of the biggest factors in pricing. Industries that handle sensitive personal data, financial records, or health information face higher premiums because the regulatory penalties and litigation costs following a breach are much greater.
| Industry | Annual Premium Range | Monthly Cost | Why |
|---|---|---|---|
| Healthcare / Medical | $2,000–$8,000 | $167–$667 | HIPAA penalties up to $1.9M/year, patient data is most valuable on dark web |
| Financial services | $1,800–$7,000 | $150–$583 | SEC/FINRA regulations, fiduciary liability, high-value transaction data |
| Legal / Law firms | $1,500–$6,000 | $125–$500 | Attorney-client privilege data, ABA Rule 1.6 requirements, trust account exposure |
| Technology / SaaS | $1,200–$5,000 | $100–$417 | Customer data at scale, API vulnerabilities, supply chain exposure |
| Accounting / CPA | $1,200–$4,500 | $100–$375 | Tax records, SSNs, financial data, IRS compliance |
| E-commerce / Retail | $800–$3,000 | $67–$250 | PCI-DSS compliance, credit card data, customer PII |
| Education | $800–$2,500 | $67–$208 | Student records (FERPA), payroll data, research IP |
| Construction | $600–$1,500 | $50–$125 | Employee PII, payroll data, lower data volume |
| Food service | $500–$1,200 | $42–$100 | POS systems, customer data, lower risk profile |
| Professional services | $800–$3,000 | $67–$250 | Client confidential data, project files, contract information |
| Manufacturing | $800–$2,500 | $67–$208 | IoT/OT vulnerabilities, IP theft, supply chain data |
| Real estate | $700–$2,000 | $58–$167 | Wire fraud exposure, client financial data, transaction records |
Why Healthcare Costs the Most
Healthcare organizations pay the highest cyber insurance premiums for three reasons:
- HIPAA penalties are severe — violations can result in fines of $100–$50,000 per violation, up to $1.9M per year per violation category
- Health records are the most valuable — a single health record sells for $250–$1,000 on the dark web, compared to $1–$20 for a credit card number
- Breach costs are the highest — the average healthcare data breach costs $10.9M, more than double any other industry
Wire Fraud: The Hidden Cost Driver
For real estate, legal, and financial services businesses, wire fraud is now one of the most common cyber claims. Criminals intercept email threads about pending transactions and redirect wire transfers to fraudulent accounts. A single successful wire fraud can cost $100K–$500K. Social engineering coverage — which pays for wire fraud losses — is an increasingly important add-on.
What Affects Your Cyber Insurance Premium
Insurance carriers evaluate dozens of risk factors when pricing cyber coverage. Understanding these helps you both estimate your cost and take steps to lower it.
High-Impact Factors (Biggest Effect on Premium)
1. Industry and data types handled
Businesses handling healthcare records (PHI), financial data, or children's data pay 50–200% more than businesses with low-sensitivity data.
2. Annual revenue
Revenue is a proxy for the size of your digital footprint and the potential magnitude of a claim. Every $1M in additional revenue typically adds $200–$500 to your annual premium.
3. Number of records stored
More records = more breach notification costs. Carriers categorize by volume:
- Under 10,000 records: standard pricing
- 10,000–100,000: 20–40% premium increase
- 100,000+: 50–100% premium increase
4. Prior claims history
A single prior cyber claim can increase premiums by 50–100%. Two or more claims may make coverage difficult to obtain at any price.
Medium-Impact Factors
5. Security controls in place
Carriers increasingly require specific security measures. Having these can lower your premium by 10–25%:
- Multi-factor authentication (MFA) on all accounts
- Endpoint detection and response (EDR) software
- Regular employee security awareness training
- Encrypted data at rest and in transit
- Regular security assessments or penetration testing
- Incident response plan documented and tested
6. Coverage limits selected
Higher limits cost more, but not proportionally:
- $1M limit: baseline premium
- $2M limit: typically 40–60% more than $1M
- $5M limit: typically 100–150% more than $1M
7. Deductible chosen
Higher deductibles lower premiums:
- $1,000 deductible: highest premium
- $2,500 deductible: 5–10% savings
- $5,000 deductible: 10–20% savings
- $10,000 deductible: 15–30% savings
- $25,000 deductible: 25–40% savings
Lower-Impact Factors
8. Business age and stability
Newer businesses (under 3 years) may pay slightly higher premiums due to less established security practices.
9. Geographic location
States with stricter privacy laws (California, New York, Illinois) or higher litigation rates can increase premiums by 5–15%.
10. Third-party vendor risk
If you share data with many third-party vendors without formal security agreements, carriers view this as increased risk.
What Cyber Insurance Covers
A comprehensive cyber policy includes both first-party (your direct losses) and third-party (lawsuits and regulatory actions) coverage.
First-Party Coverage (Your Direct Costs)
| Coverage | What It Pays For | Why It Matters |
|---|---|---|
| Breach response | Forensic investigation, identifying the vulnerability | Average cost: $50,000–$150,000 |
| Notification costs | Legally required letters/emails to affected individuals | $1–$3 per person, required in all 50 states |
| Credit monitoring | 12–24 months of credit monitoring for affected individuals | $10–$30 per person |
| Business interruption | Lost revenue while systems are down during recovery | Average downtime: 21 days |
| Data restoration | Rebuilding corrupted or destroyed databases and files | $5,000–$100,000+ depending on volume |
| Ransomware/extortion | Ransom payments, negotiation specialists, decryption | Average ransom: $150,000+ for small businesses |
| Crisis management | PR and communications to protect your reputation | $10,000–$50,000 |
Third-Party Coverage (Lawsuits and Regulatory)
| Coverage | What It Pays For | Why It Matters |
|---|---|---|
| Regulatory defense | Legal costs defending against government investigations | HIPAA, PCI-DSS, state AG actions |
| Regulatory fines | Penalties imposed by regulators for data protection failures | Can reach millions for HIPAA, GDPR |
| Privacy liability | Lawsuits from individuals whose data was exposed | Class actions are increasingly common |
| Network security liability | Claims from third parties affected by a breach originating from your systems | Your breach can spread to clients |
| Media liability | Claims arising from online content (defamation, copyright) | Included in many cyber policies |
What Cyber Insurance Does NOT Cover
- Prior known incidents — breaches you knew about before buying the policy
- Unencrypted devices — some policies exclude breaches from unencrypted laptops/phones
- War and terrorism — state-sponsored cyber attacks may be excluded
- Infrastructure failure — widespread internet or power outages
- Intentional acts — deliberate data theft by the business owner
- Bodily injury — physical harm from cyber incidents (rare but possible with IoT)
- Improvement costs — upgrading security after a breach (the policy pays to restore, not improve)
Cyber Insurance Cost vs Risk of Not Having It
The math is straightforward. Here's what a breach actually costs compared to annual premiums:
| Cost Category | Average Cost (Small Business) | Covered by Insurance? |
|---|---|---|
| Forensic investigation | $50,000–$150,000 | ✅ Yes |
| Legal counsel | $30,000–$100,000 | ✅ Yes |
| Breach notification | $10,000–$50,000 | ✅ Yes |
| Credit monitoring | $15,000–$75,000 | ✅ Yes |
| Business interruption | $25,000–$200,000 | ✅ Yes |
| Regulatory fines | $10,000–$1,900,000 | ✅ Yes |
| Customer lawsuits | $50,000–$500,000+ | ✅ Yes |
| Reputation damage | Incalculable | Partially (PR coverage) |
| Total potential cost | $190,000–$2,975,000 | |
| Annual premium | $600–$3,000 |
The average small business data breach costs $108,000. Cyber insurance premiums of $50–$250/month are a fraction of that exposure. The question isn't whether you can afford cyber insurance — it's whether you can afford to go without it.
The 60% Statistic
60% of small businesses that experience a significant cyber attack close within 6 months. The combination of direct breach costs, lost customer trust, and operational disruption is more than most small businesses can absorb.
Best Carriers and Their Pricing
Hartford — Best Value for Small Businesses
- Starting premium: $500/year ($42/mo) for $1M coverage
- Best for: Businesses under $5M revenue wanting straightforward cyber coverage
- Strengths: Competitive pricing, simple application, bundles with BOP
- Deductible: Starting at $2,500
Chubb — Best Comprehensive Coverage
- Starting premium: $1,200/year ($100/mo) for $1M coverage
- Best for: Businesses with significant data exposure or regulatory requirements
- Strengths: Broadest coverage terms, highest limits, superior claims handling
- Deductible: Starting at $5,000
Coalition — Best Tech-Forward Option
- Starting premium: $700/year ($58/mo) for $1M coverage
- Best for: Tech companies and businesses wanting proactive security tools
- Strengths: AI-powered underwriting, active risk monitoring, security tools included
- Deductible: Starting at $1,000
Hiscox — Best for Professional Services
- Starting premium: $600/year ($50/mo) for $1M coverage
- Best for: Consultants, law firms, and professional services firms
- Strengths: Easy online application, bundles with E&O, fast binding
- Deductible: Starting at $2,500
| Carrier | Starting Annual | Min Deductible | Max Limit | Online App | Best For |
|---|---|---|---|---|---|
| Hartford | $500 | $2,500 | $5M | ✅ | Small businesses |
| Chubb | $1,200 | $5,000 | $25M+ | ❌ | High-value businesses |
| Coalition | $700 | $1,000 | $15M | ✅ | Tech companies |
| Hiscox | $600 | $2,500 | $5M | ✅ | Professional services |
→ Compare cyber insurance quotes from all carriers side-by-side
How to Lower Your Cyber Insurance Cost
Carriers reward businesses that demonstrate strong security practices. These steps can reduce your premium by 10–30%:
1. Implement Multi-Factor Authentication (MFA)
MFA on email, VPN, and cloud applications is the single most impactful security measure you can implement. Many carriers now require it for coverage. Having MFA in place can reduce premiums by 10–15%.
2. Deploy Endpoint Detection and Response (EDR)
Traditional antivirus is no longer sufficient. EDR tools (CrowdStrike, SentinelOne, Microsoft Defender for Business) actively monitor for threats. Carriers view EDR as a significant risk reduction. Premium impact: 5–10% reduction.
3. Conduct Regular Employee Security Training
Phishing attacks are responsible for 90%+ of breaches. Annual or quarterly security awareness training (KnowBe4, Proofpoint) demonstrates to carriers that you're addressing the human element. Premium impact: 5–10% reduction.
4. Maintain an Incident Response Plan
Having a documented, tested incident response plan shows carriers you're prepared. Plans that include contact trees, communication templates, and legal counsel relationships get the best rates. Premium impact: 5–10% reduction.
5. Choose a Higher Deductible
If your business can absorb the first $5,000–$10,000 of a cyber incident, a higher deductible can significantly reduce your premium. Premium impact: 10–25% reduction.
6. Bundle with Other Policies
Many carriers offer 10–15% discounts when you bundle cyber with GL, BOP, or E&O coverage. Hartford and Hiscox both offer meaningful bundle discounts.
7. Encrypt Sensitive Data
Data encryption at rest and in transit reduces both the likelihood and severity of a breach. Some carriers offer explicit discounts for encrypted environments. Premium impact: 5–10% reduction.
Getting the Best Rate: Step by Step
Step 1: Inventory Your Data
Before shopping for quotes, understand what data you store, process, and transmit:
- Customer PII (names, addresses, SSNs, DOBs)
- Payment card data (PCI-DSS applies)
- Health records (HIPAA applies)
- Employee records (payroll, benefits)
- Client confidential information
- Intellectual property
Step 2: Document Your Security Controls
Carriers will ask about your security posture. Prepare answers for:
- Do you use MFA? On which systems?
- What endpoint protection do you run?
- How often do you back up data? Where are backups stored?
- Do you conduct security awareness training?
- When was your last vulnerability assessment?
- Do you have an incident response plan?
Step 3: Compare Multiple Carriers
Cyber insurance pricing varies by 40–60% between carriers for identical coverage. The same business can see quotes ranging from $800 to $2,000 for $1M in coverage. Always compare at least three carriers.
Step 4: Review Coverage Details
Don't just compare premiums. Check:
- Retroactive date — how far back does coverage extend?
- Sublimits — are ransomware, wire fraud, or business interruption capped separately?
- Waiting period — how many hours of downtime before business interruption kicks in?
- Exclusions — are unencrypted devices, nation-state attacks, or prior incidents excluded?
- Panel providers — does the carrier require you to use specific breach response vendors?
Step 5: Bind Coverage
Once you select a carrier, most can bind coverage within 24–48 hours. Hartford and Coalition offer same-day binding for businesses under $5M revenue.
→ Compare cyber insurance quotes from top carriers — takes under 10 minutes
Frequently Asked Questions
How much does cyber insurance cost for a small business?
Most small businesses (under $2M revenue) pay $600–$3,000 per year ($50–$250/month) for $1M in cyber coverage. Exact pricing depends on industry, revenue, number of records stored, and security practices.
Is cyber insurance worth it for small businesses?
Yes. The average small business data breach costs $108,000, and 60% of small businesses that experience a significant cyber attack close within six months. At $50–$250/month, cyber insurance is a small price for existential risk protection.
What's the average cyber insurance deductible?
Most small business cyber policies have deductibles of $2,500–$10,000. Lower deductibles ($1,000) are available from some carriers like Coalition but come with higher premiums. Higher deductibles ($25,000+) can reduce premiums by 25–40%.
Does general liability insurance cover cyber attacks?
No. Standard GL policies specifically exclude cyber incidents, data breaches, and digital perils. You need a standalone cyber liability policy or a cyber endorsement on your BOP. Most experts recommend standalone cyber coverage for broader protection.
Does cyber insurance cover ransomware?
Yes — most cyber policies cover ransomware including the ransom payment, negotiation specialist fees, system restoration costs, and business interruption during recovery. However, some policies have sublimits for ransomware, so check your specific coverage.
What's the difference between first-party and third-party cyber coverage?
First-party covers your direct costs (forensics, notification, business interruption, ransomware). Third-party covers claims against you (lawsuits from affected individuals, regulatory fines and defense costs). A comprehensive policy includes both.
How long does it take to get cyber insurance?
Most carriers can provide a quote within 10–30 minutes and bind coverage within 24–48 hours. Hartford and Coalition offer same-day binding for straightforward applications.
Does cyber insurance cover employee mistakes?
Yes. Most policies cover breaches caused by employee negligence, such as clicking a phishing link or misconfiguring a database. However, intentional data theft by an employee may be excluded (crime insurance covers that).
Can I get cyber insurance with a prior breach?
Yes, but it's more difficult and expensive. Carriers will want details about the breach, what remediation steps were taken, and what security improvements were implemented. Expect premiums 50–100% higher than businesses without prior claims.
Do I need cyber insurance if I use cloud services (AWS, Google, Microsoft)?
Yes. Cloud providers' terms of service make clear that security is a "shared responsibility." While they secure the infrastructure, you're responsible for data access, user credentials, and configuration. Breaches from misconfigured cloud settings are increasingly common and are not covered by your cloud provider.
Ready to protect your business from cyber threats? Compare quotes from Hartford, Chubb, Coalition, Hiscox, and more — get your free cyber insurance quote.
Related Coverage Pages
- Cyber insurance — Compare business cyber insurance quotes from top carriers
- Cyber security insurance — Protection for ransomware, phishing, and digital threats
- Data breach insurance — First-party breach response coverage
See what your business would pay — get your free quote in under 2 minutes →