2026-04-11 · business, cyber

Updated: 2026-10-09

By InsuraFAQ Editorial Team · Reviewed for accuracy

Small-business desk with a laptop showing an abstract network-security dashboard beside a hardware security key

Cyber Insurance

At a glance

Cyber insurance is commercial coverage that can help a business manage losses from a cyber incident. What is covered—and what is excluded—depends on the policy wording, limits, and endorsements.

What it is: coverage a business can evaluate alongside its other policies and its incident-response plan.
What it can cover: first-party incident costs and third-party liability, if the policy includes them and subject to its terms.
What to compare: covered events, exclusions, sublimits, deductibles, defense language, and required security practices.
Who may consider it: a business that holds sensitive information or relies on connected systems should assess its exposure with an insurance professional.
Price: premiums and availability depend on the applicant and the insurer; obtain current quotes rather than relying on a general estimate.

Key takeaways

Cyber insurance can help with cyber-incident losses, but the policy—not a general description—determines the result.
The FTC distinguishes first-party coverage for a business’s own incident costs from third-party coverage for claims brought by others.
Review limits, sublimits, exclusions, deductibles, and any security representations before buying or renewing.
Security practices such as MFA can reduce account-compromise risk, but they do not guarantee insurance eligibility or coverage.
Have an agent, broker, or qualified coverage adviser compare the cyber terms with your existing policies.

Overview

Cyber insurance is commercial coverage a business can use to manage some costs of a cyber incident. The Federal Trade Commission (FTC) recommends discussing whether first-party coverage, third-party coverage, or both fit the business’s needs; the answer depends on the policy and the business’s exposure. The FTC’s cyber-insurance guide lists questions to use when comparing coverage.

A policy is not a replacement for incident prevention or response planning. CISA explains that multifactor authentication (MFA) adds a second or additional authenticator beyond a password and can reduce the risk of unauthorized account access. Read CISA’s MFA guidance.

Use the declarations, insuring agreements, definitions, exclusions, endorsements, and application answers—not a checklist from another policy—to decide what protection you have.

What Cyber Insurance Covers

Cyber policies may address first-party coverage (costs your business incurs directly) and third-party coverage (liability to outside parties). Whether either applies, and the limits, sublimits, deductible, and conditions that apply, come from the specific contract. The FTC recommends asking an insurer or broker about the policy’s coverage and exclusions before buying it.

First-Party Coverage

Breach response costs. Forensics to figure out what happened, legal counsel to guide the response, and help meeting notification requirements.
Data recovery. The expense of restoring data, rebuilding systems, and replacing compromised software or hardware where covered.
Business interruption. Lost income and extra operating expenses while systems are down after a covered event.
Ransomware and cyber extortion. Ransom payments (where legally permissible), negotiation support, and related response costs. Limits and conditions on this coverage have tightened in recent years.
Notification and credit monitoring. The cost of notifying affected individuals and providing identity monitoring services, which many state and federal laws require.

Third-Party Coverage

Privacy and network security liability. Defense and damages when affected customers, employees, or partners sue over a breach.
Regulatory defense and penalties. Legal costs and, where insurable, fines tied to privacy laws such as HIPAA, state breach notification statutes, or international rules like GDPR.
Payment card industry (PCI) fines and assessments. Some policies respond to PCI DSS penalties after a card data compromise.
Media liability. Claims arising from content a business publishes online, such as defamation or intellectual property infringement.

Crisis Management and PR

Most policies include funds for crisis communications, public relations, and call center support. A well-handled response can meaningfully reduce long-term damage to the brand and customer trust, so this coverage is often more valuable than it looks on paper.

Common Exclusions

Cyber policy exclusions and conditions differ substantially. When comparing a form, ask the insurer or broker to identify how it treats the following areas rather than assuming a standard answer:

Known vulnerabilities left unpatched. If your organization knew about a critical vulnerability and did not act on it, the insurer may deny the claim.
Prior incidents discovered after the policy begins. Losses traced to a breach that occurred before the policy’s retroactive date are typically excluded.
Acts of war and nation-state attacks. War exclusions have become a more contested area as insurers adjust their language in response to state-sponsored activity. Read this clause carefully.
Social engineering and wire transfer fraud. Many policies exclude or sublimit funds transfer fraud unless you add a specific endorsement.
Failure to maintain security standards. Not keeping agreed-upon controls (for example, multi-factor authentication or backups) can limit or void coverage.
Bodily injury and property damage. These losses usually belong under general liability or property policies, not cyber.

Always compare exclusions and endorsements when you shop, and do not assume two policies behave the same way just because they both say “cyber.”

Who Needs Cyber Insurance?

Cyber insurance is relevant for almost any business that uses a computer, stores customer information, or depends on the internet to operate. That includes organizations most people would not immediately think of as “tech companies”:

Retailers and e-commerce sellers that process card payments and store customer records.
Healthcare providers, clinics, and practices that handle protected health information under HIPAA.
Professional services firms (accountants, law firms, architects, consultants) that store sensitive client documents and often handle wire transfers.
Nonprofits, schools, and municipalities that hold donor, student, or citizen data and often have limited in-house security resources.
Manufacturers and logistics firms that rely on connected systems and cannot afford prolonged downtime.

Small businesses are frequently targeted precisely because attackers expect weaker defenses and faster payouts. The assumption that “we are too small to be a target” is one of the most common reasons a business ends up uninsured at the worst possible moment. For a broader look at how cyber coverage fits alongside other business policies, see our business owners policy guide.

How Much Does Cyber Insurance Cost?

There is no universal price tag for cyber insurance. Quotes can vary between insurers for the same business, so use current quotes and compare the protection offered—not just the premium. Underwriters may consider factors such as:

Industry. Healthcare, financial services, legal, and technology tend to be priced higher because of the sensitivity and volume of data they hold.
Annual revenue. Larger revenue generally means larger exposure and higher limits, which raises premium.
Data volume and type. The more personal, financial, or health records you store, the more you pay.
Security posture. Insurers reward strong controls. Multi-factor authentication, endpoint detection, backups, and tested incident response plans can materially reduce premium and even determine whether you can get coverage at all.
Claims history. Past incidents or unresolved vulnerabilities can increase cost or make some markets unavailable.
Limits and deductibles. Higher limits and lower deductibles raise premium, while higher deductibles reduce it.

For a deeper look at the variables that influence pricing across business policies, see our guide on insurance cost drivers.

How to Reduce Cyber Insurance Costs

Security controls can reduce cyber risk, but they do not guarantee a particular premium, eligibility decision, or coverage outcome. Use the insurer’s current application and policy wording to understand any required controls:

Enforce multi-factor authentication (MFA). MFA on email, remote access, privileged accounts, and cloud services is now effectively a minimum requirement from most insurers.
Maintain offline or immutable backups. Regularly tested backups make ransomware less catastrophic and are a major underwriting factor.
Patch and update on a schedule. Outdated operating systems and software increase premiums and can lead to coverage gaps.
Train employees on phishing. Human error remains a leading cause of breaches, and documented training programs help your application.
Adopt endpoint detection and response (EDR). Modern detection tools are now a common insurer requirement for mid-size and larger businesses.
Have a written incident response plan. Documented procedures, tested annually, demonstrate maturity and can lower premium.
Work with a broker who specializes in cyber. Markets shift quickly, and a specialist can match your risk profile to the right carriers.

Before comparing quotes, review our guide on how to compare insurance quotes so you can evaluate coverage apples to apples instead of chasing the lowest headline premium.

Cyber Insurance vs. General Liability

A business should not assume that a general liability policy or standard business owners policy will respond to a cyber event. Compare the actual policy forms and endorsements with the cyber risks the business wants to insure.

General liability covers bodily injury, property damage, and advertising injury. It does not cover data breaches, ransomware, or digital business interruption.
Property insurance covers physical damage to covered property. Stolen data and corrupted systems are not “physical” losses under most policies.
Business owners policies (BOPs) sometimes include a small cyber endorsement, often with low limits and narrow coverage. For a business with real digital exposure, those sublimits are usually not enough.

A standalone cyber policy, or a substantial cyber endorsement alongside your core coverage, is how serious risk gets handled. For help understanding where general liability does and does not respond, see our general liability insurance guide.

Conclusion

Cyber insurance can be one part of a business’s risk-management plan; it does not prevent an attack or replace security and response planning. Pair a review of the actual policy with a realistic view of your data exposure and the controls your business can maintain. Review coverage before renewal, confirm application answers remain accurate, and revisit limits as the business changes.

Frequently asked questions

What does cyber insurance actually cover?

Cyber policies split into first-party coverage — your business’s own losses like breach response, data recovery, business interruption, ransomware and extortion, and notification and credit monitoring — and third-party liability, which pays for privacy and network security claims, regulatory defense, PCI fines, and media liability. Most policies bundle both, though the limits and sublimits for each piece vary by carrier.

Does my general liability policy cover a data breach?

Almost always no. Standard general liability responds to bodily injury, property damage, and advertising injury, and it does not address breaches, ransomware, or digital business interruption. Business owners policies sometimes include a small cyber endorsement, but the sublimits are usually too low for a business with real digital exposure, so a standalone cyber policy or a substantial cyber endorsement is how serious risk gets handled.

What does cyber insurance NOT cover?

Common exclusions include known unpatched vulnerabilities the business failed to act on, prior incidents traced to a date before the policy’s retroactive date, acts of war and nation-state attacks, social engineering and wire transfer fraud without a specific endorsement, and failure to maintain agreed-upon controls such as multi-factor authentication or backups. Bodily injury and property damage are also excluded — those losses belong under general liability or property policies.

Do small businesses really need cyber insurance?

For most small businesses, yes. Small firms are frequently targeted precisely because attackers expect weaker defenses and faster payouts, and many can struggle to absorb the cost of a single serious incident. Retailers, healthcare providers, professional services firms, nonprofits, schools, and manufacturers with connected systems are all typical candidates, and vendor contracts increasingly require coverage as a condition of doing business.

How much does a small-business cyber policy cost?

There is no universal price. Ask for current quotes that state the limits, deductible, included coverages, sublimits, exclusions, and conditions. Insurers may consider the business’s industry, revenue, data, security controls, claims history, and selected limits.

What security controls do insurers require before they will bind coverage?

Requirements vary by carrier and size, but most insurers now expect multi-factor authentication on email, remote access, privileged accounts, and cloud services, along with tested offline or immutable backups, timely patching, documented phishing training, and endpoint detection and response for mid-size and larger businesses. Higher-risk applicants may also need a written incident response plan, a vulnerability management program, and third-party security assessments.