A business can lose access to its systems or expose customer information after one cyber incident, even when it has taken security precautions. Only 1% of global economic cyber losses are estimated to be covered by cyber insurance. The financial impact can reach businesses of any size, from a small shop to a large company.
We explain how Cyber Liability Insurance may help address direct expenses and claims from customers or other parties. The right coverage depends on the data your business holds, its reliance on digital systems, and the losses it could afford to handle itself. We also explain how to compare policy terms and costs without treating a headline limit as a promise of payment.
Small businesses face risks when they store personal information or depend on online tools. A policy can help protect the business and its customers, but only for covered losses. We look at the terms that shape that protection, including limits, exclusions and conditions. The right policy should be judged by the losses it can address and the limits, exclusions and conditions attached to it.
Key Takeaways
- Cyber coverage may address both direct response costs and claims from others.
- Premiums depend on business risks, selected limits and security practices.
- Exclusions and sublimits can reduce payment for certain events.
- Review the policy contract, not only a coverage summary.
- Strong security supports coverage but does not replace it.
What Does Cyber Liability Insurance Cover?
Cyber insurance can help pay covered costs after a business suffers a data breach, ransomware incident or other digital attack. First-party coverage is insurance that pays covered costs a business incurs directly while responding to a cyber incident. The policy may also respond to claims made by customers or other parties.
Cyber insurance generally combines first-party costs with third-party liability coverage. That division matters because a business may need to restore systems and answer legal claims at the same time. The policy wording sets which costs qualify and how much the insurer may pay.
What Cyber Insurance Means for Businesses
Cyber liability insurance is a form of business insurance for certain losses tied to digital systems, data and privacy. It can help a business manage expenses after an attack, a privacy breach or another covered event. It is not a general promise to pay every loss involving a computer.
First-party coverage addresses covered costs the business pays itself. Third-party liability coverage addresses claims and legal defense arising from harm to customers or other parties. A privacy claim may involve customer information, while a service disruption may affect business operations.
First-Party Costs After an Incident
Direct response expenses can include an investigation, data restoration and breach notification. Some policies also cover cyber extortion response and lost income when an insured system interruption stops normal work. A business may need outside experts before it can safely reopen systems.
For example, a retailer could face recovery costs after a point-of-sale system attack. A firm that stores customer details may also need help to assess what information was exposed. Our review of a privacy policy shows why clear practices for handling personal data matter.
Third-Party Liability Claims
Third-party liability coverage may address legal defense, settlements and some regulatory proceedings. A customer could claim that a breach exposed personal information or caused financial harm. Regulators may also investigate how a business handled protected data.
A policy’s exact covered expenses depend on its wording, so a list of coverage categories is not a promise that every claim will be paid.
A coverage label does not decide a claim by itself; the policy’s terms and the facts of the incident control.
Businesses should compare the wording behind each category, including any conditions for using response services. One policy may define an incident or a covered system differently from another. That detail can affect whether a loss falls within the insurance cover.
Which Businesses Face the Greatest Cyber Risk?
A small business can face cyber exposure as soon as it stores customer information or depends on digital systems to operate. Size alone does not show how much data a business holds or how hard it would be to keep working after an attack. Small and medium-sized businesses are among the most underinsured commercial customers.
In 2024, insurance rates rose with company revenue in the reported ranges. The figures below show how often companies in each revenue group had cyber insurance, not the likelihood of an attack.
| 2024 company revenue | Share with cyber insurance | What the range indicates |
|---|---|---|
| More than $1 billion | 60% to 70% | Larger corporations |
| $100 million to $1 billion | 40% to 50% | Mid-sized corporations |
| $10 million to $100 million | 10% to 20% | Smaller corporations |
These figures show that many smaller companies still operate without a cyber policy. A business does not need a large customer base to hold sensitive data or rely on systems that can fail. We suggest checking for these common exposure signals:
- Storing personal information about customers or employees.
- Accepting card payments in person or online.
- Relying on cloud tools or point-of-sale systems.
- Holding sensitive business data, such as client records.
These signals apply to many industries, including retail, health care, professional services and hospitality. A contractor may hold customer records, while a small shop may depend on a payment system all day. A short customer list does not remove the risk of response costs or claims if sensitive information is exposed.
What Drives Cyber Insurance Costs for a Business?
Small businesses pay an average of $129 a month for cyber liability insurance, but a particular business’s quote can fall well below or above that figure. That average offers a starting point, not a set price for every business. A quote reflects the business’s risk and the coverage it selects.
Small-business premiums range from around $400 to over $8,000 per year. A business paying for a higher limit or broader terms may receive a different quote than one seeking basic protection.
Typical Premiums for Small Businesses
| Cost measure | Figure | Condition |
|---|---|---|
| Small-business monthly average | $129 | Average |
| Small-business annual average | $1,552 | Average |
| Annual premium range | Around $400 to over $8,000 | Range |
For a $1,000,000 cyber liability insurance limit, $129 a month is the small-business average, not a fixed monthly rate. A specific quote depends on the business and the coverage it selects. Chubb says its Cyber Enterprise Risk Management policies have no minimum premium, with prices tied to coverage scope and limits.
What Changes the Premium
Insurers may weigh industry, revenue, daily operations and the sensitivity of stored data. The policy limit, claims history and cybersecurity practices can also affect the price. A company that handles payment details may present a different risk from a firm with little personal data.
Strong risk management may help a business qualify for lower rates. U.S. cyber insurance prices were generally flat in 2025, and that trend was expected to continue through at least the first half of 2026. A quote still reflects the applicant’s details, not a market average alone.
Ask what the quote includes before comparing it with another offer. One price may include a wider range of coverage or a different policy structure. Treat the average as a planning benchmark, not as a quote for a specific limit or risk.
What Limits and Deductibles Should You Choose?
A cyber policy can have one maximum for a single event and a separate maximum for all claims during its term. Both amounts shape how much insurance may pay. Common policy limits range from $1 million to $5 million.
The aggregate limit is the total amount available for all claims during the policy term, usually one year. A per-occurrence limit sets the maximum for one covered event. A deductible is the amount the policyholder pays before covered insurance payments apply.
| Policy term | Typical figure or rule | What it limits |
|---|---|---|
| Per-occurrence limit | Policy limits typically range from $1 million to $5 million | Maximum for one covered event |
| Aggregate limit | Part of the same $1 million to $5 million policy limit | Maximum for all covered claims in a policy term, usually one year |
| Deductible | $1,000 to $2,500 average for Insureon customers | Amount paid before covered insurance payments apply |
A business could use much of its available limit on one expensive event. Several smaller claims might also draw from the aggregate during the same policy term. We recommend weighing these amounts against plausible response expenses, customer obligations and potential downtime.
For example, a company that relies on online sales may face serious income loss during an outage. A service firm may need funds for a forensic review and customer support. Choose limits based on likely losses, not the premium alone.
Check whether a ransomware sublimit or another special cap is lower than the headline policy limit.
What Cyber Insurance Options Can a Business Buy?
A basic data-breach endorsement may suit a simpler risk, while a business with technology services or complex exposures may need a broader policy. The right form depends on what the business does and what losses it faces. Some businesses can add breach coverage to a business owner’s policy, while others buy standalone cyber liability insurance.
Technology errors and omissions coverage matters for businesses that sell technology products or services. It can address claims tied to technology work, not only privacy events. Policy forms differ, so businesses should compare the risks each one names.
Data-Breach Endorsements and Standalone Policies
A data-breach endorsement adds selected protection to an existing business owner’s policy. This route may fit a smaller operation with simpler needs. A standalone cyber policy can offer a broader set of protections and higher or more tailored limits.
Chubb’s Cyber Enterprise Risk Management policy is one example of broader business protection. It covers response, business interruption, digital data recovery, network extortion, cyber and privacy liability, payment-card loss, regulatory proceedings and media liability. Its regulatory coverage includes defense, fines and penalties where the law allows insurance.
Businesses may add computer fraud, funds transfer fraud and social engineering fraud by endorsement. Business interruption may cover lost net profits and ongoing operating expenses after insured systems stop working. Contingent business interruption may address an outsourced technology provider’s systems.
Technology E&O and Specialized Cyber Programs
Chubb says it can provide local multinational cyber programs in more than 35 countries. Its DigiTech Enterprise Risk Management combines technology errors and omissions, media and cyber exposures for technology companies. It includes software copyright infringement and product-recall loss-of-use coverage, with no exclusions for delays or failure to deliver.
Personal cyber protection serves a different purpose. Chubb Masterpiece Cyber Protection covers personal cyber extortion and ransomware, cyber financial loss, cyberbullying, cyber disruption and breach of privacy. It is a personal policy, not a replacement for business insurance.
Match the policy form to the work the business performs, especially when it develops software or manages technology for clients.
How Do Cyber Policies Handle Ransomware and Extortion?
Ransomware is the leading source of cyber insurance losses, yet a policy may put conditions on who negotiates and whether a ransom can be paid. Payment is not automatic, even when an event appears to fit cyber extortion coverage. A policy may require an insurer-approved negotiator, called a carrier-approved negotiator.
Some insurers require consent before a ransom payment or reimbursement. Coverage may also pay for extortion response, system restoration and interruption, subject to the policy terms. Paying a ransom does not guarantee that the business will recover its data.
Ransom demands can put business leaders under intense time pressure. A hasty payment may conflict with policy conditions or fail to restore access. We recommend following the policy’s response process:
- Contact the insurer promptly after discovering the incident.
- Use the carrier’s approved response resources when required.
- Preserve evidence related to the attack and ransom demand.
- Obtain written consent before payment if the policy requires it.
In 2025, 28% to 32% of ransomware victims paid a ransom, down from 37% in 2024. The rate shows that many victims did not pay, though each incident has different demands and risks. Insurer approval requirements can affect whether a payment qualifies for reimbursement.
Do not promise a ransom payment or hire a negotiator before checking the policy’s consent requirements.
What Exclusions and Sublimits Can Reduce a Payout?
A $1 million policy limit does not guarantee a $1 million payment for every kind of cyber event. Exclusions and sublimits can narrow the amount a business may recover. An exclusion removes a type of loss from cover, while a sublimit caps payment for a covered category.
A special cap may leave the business responsible for losses above that category’s limit. Some policies have ransomware sublimits below the overall policy limit. Other wording may restrict losses linked to war, state-sponsored cyber activity or widespread events.
Exclusions for Certain Events and Losses
War, cyber-war or hostile-cyber-activity exclusions may apply to state-sponsored attacks. Some policies also restrict losses from systemic events, such as a major cloud-provider outage or a supply-chain attack. The wording can affect whether a broad event counts as covered.
Other exclusions may address intentional acts, known incidents or physical property damage. A policy might not cover damage to hardware caused by an event, even if it covers related data loss. Preventive upgrades may also fall outside standard coverage.
Sublimits and Conditions That Narrow Coverage
A sublimit applies to a defined type of loss and can sit below the main policy limit. A ransomware cap, for example, may set a lower maximum for that event. This can change the amount available for restoration or other covered costs.
Vendor outages need special attention. A policy may treat an interruption of the business’s own systems differently from an outage at a cloud or technology provider. Contingent business interruption wording may apply, but a systemic-event limit or exclusion could still restrict recovery.
Read the exclusions and category-specific limits together, especially for ransomware and dependent technology providers.
How Does California’s Breach-Notification Law Affect Coverage?
California businesses must notify affected residents when unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person. The notice duty applies whether or not a business carries insurance. Coverage may help with some response expenses, but it does not replace legal duties.
Beginning January 1, 2026, affected individuals must be notified within 30 calendar days after discovery or notice of a breach. When more than 500 residents are affected, the business must send the Attorney General a copy of its notice within 15 days after notifying individuals.
For a single breach affecting more than 500 California residents, a sample notice must also go to the Attorney General. These requirements can shape how a business plans its response and tracks notice dates. A lawyer can help assess the facts and other duties.
- Notify affected individuals within 30 calendar days after discovery or notice.
- Send the Attorney General a copy within 15 days after notifying individuals when more than 500 residents are affected.
- Submit a sample notice for a single breach affecting more than 500 California residents.
Notice obligations can arise when information was acquired, or is reasonably believed to have been acquired, without permission. The details of an incident may affect who must be notified and what the notice must say. A breach investigation can help establish which records were involved.
For privacy practices and data handling, businesses can review a privacy policy as one point of comparison. Consult California counsel or the Attorney General for case-specific obligations. The 2026 notification deadlines depend on specific events, not the date a business buys insurance.
Record the discovery date and the date individual notices go out, since both deadlines are measured from specific events.
How Can Strong Security Practices Help With Underwriting?
Stronger security practices can improve a business’s risk profile and may help it qualify for lower cyber insurance rates. Good controls can lower the chance that a threat turns into a costly claim. They do not guarantee a discount or policy approval.
Insurers may ask about security measures during underwriting, so describe them accurately. Common controls include firewalls, current software and multi-factor authentication. A formal bring-your-own-device policy can also help manage employee devices.
We suggest reviewing these basics before applying:
- Maintain firewalls that protect business networks.
- Patch software to address known security weaknesses.
- Use multi-factor authentication for key accounts.
- Set a formal bring-your-own-device policy for staff devices.
These steps support better risk management, but the insurer still reviews the business as a whole. The right controls can vary with the systems and data a company uses. A small office and a software firm may need different safeguards.
Applications should describe the protections that are in place, not planned changes or informal habits. If staff use personal phones for work, state how the business manages that access. Answer security questions accurately, since an application that overstates protections can create trouble if a claim follows.
Which Cyber Insurance Companies Fit Different Business Needs?
The right insurer shortlist depends first on whether the business needs a basic add-on, a broader standalone policy or technology-specific protection. Fit matters more than a ranking, because a policy built for another kind of company may leave important gaps. In 2024, 218 U.S. insurers reported direct cyber insurance premiums.
The top five insurers held about 30% of the U.S. market in 2024. That share was down from 32% in 2023 and 48% in 2020, leaving many providers for businesses to compare.
Best Fit for a Small Business Seeking an Add-On
The Hartford’s business owner’s policy add-on is one route for a small business seeking simpler protection. It may suit a company that wants breach coverage attached to existing business insurance. We would still compare the endorsement’s terms with the business’s data and operations.
Travelers offers CyberRisk options for different business types, along with CyberRisk Tech for technology companies. Those options can help businesses compare coverage that reflects different operations. A technology company should look closely at professional claims as well as privacy risks.
Best Fit for Broad or Technology-Specific Protection
Chubb’s Cyber Enterprise Risk Management is an example of broader cyber protection. Its DigiTech Enterprise Risk Management is designed around exposures faced by technology companies. Businesses can compare The Hartford for an add-on, Travelers for varied industries, and Chubb for broader or technology-specific needs.
U.S. direct gross written premiums fell from about $7.25 billion in 2023 to $7.08 billion in 2024. Cyber insurance loss ratios averaged 40% to 50% from 2022 through 2024, with a 49% ratio in 2024. These market figures do not measure any single insurer’s service or policy quality.
The global cyber insurance market was estimated at $16 billion to $20 billion in 2025 and could reach $30 billion to $50 billion by 2030. North America is expected to account for 60% to 70% of that market, while Asia-Pacific is expected to grow fastest. A large market does not make every contract alike.
The best fit is the policy that responds to the business’s actual operations, data and likely claims.
Compare the policy forms and exclusions in the final quote, not just the insurer’s name.
What Should You Check Before You Buy a Policy?
Before buying, check the policy contract itself rather than relying on a short coverage summary. The contract sets the terms that apply to a claim. A certificate of insurance is evidence of coverage, not a replacement for the contract or a promise that a specific claim will be paid.
Review the full policy wording and every endorsement. Confirm that the named business and its listed operations are accurate. An incorrect description may not reflect the work the company actually performs.
Ask an insurance agent or broker to explain any unclear clause before the policy starts. We would keep the issued contract with the endorsements, so the terms remain easy to find during an incident. Keep the issued policy and endorsements with your business records so the coverage terms are available during an incident.
Conclusion
Cyber insurance is most useful when its limits and conditions match the losses your business could actually face. Coverage works alongside security controls, not in place of them. The policy wording, exclusions and sublimits determine how much protection applies after an incident.
We recommend treating the contract as part of the business’s risk planning. Strong controls can help reduce exposure, while a suitable policy may help pay covered costs. Neither one removes every risk.
Before requesting a quote, write down the sensitive data you hold, the systems your business depends on and the expenses you could not absorb after an incident.