Cyber Liability Insurance for Small Businesses

What Is Cyber Liability Insurance for Small Businesses?

Cyber liability insurance helps a small business pay for the costs of a data breach, ransomware attack or other cyber incident. It covers two kinds of losses: your own costs to investigate, notify customers and recover, and the legal costs when someone else sues you over the incident. Standard general liability and business owner’s policies usually exclude data breaches, so cyber coverage fills a gap most small businesses do not realize they have.

Any business that stores customer names, emails, payment cards, Social Security numbers, health information or login credentials has cyber risk. That includes retailers, restaurants, consultants, medical and dental offices, accountants, real estate agents, online stores and IT firms. You do not need to be a tech company to be a target.

Why Small Businesses Are Targets

Attackers often go after smaller companies because they tend to have fewer security staff and simpler defenses. According to figures cited by Insureon, nearly 43% of cyberattacks target small businesses (Accenture, 2023), and small and midsize businesses account for 82% of ransomware attacks (University of Maryland). Insureon also cites NetDiligence’s 2025 Cyber Claims Study, which found that 98% of cyber insurance claims come from small and midsized businesses.

The costs can be large. Insureon cites IBM’s Cost of a Data Breach Report 2025, which puts the average breach cost in the U.S. at $10.22 million. Most small business incidents cost far less than that, but even a modest breach can mean forensic bills, legal fees, customer notifications and days of lost sales. The same IBM data shows that 51% of breaches were malicious or criminal attacks, 26% came from human error and 23% from IT failures.

First-Party vs Third-Party Cyber Coverage

First-party coverage: your own losses

First-party coverage pays costs that hit your business directly after an attack. It typically includes:

• Data breach response: forensic investigation, customer notification letters, and credit or fraud monitoring for affected people.
• Ransomware and extortion: help with extortion demands and the cost of restoring systems.
• Business interruption: lost income while your systems are down, plus extra expenses such as temporary staff or rented equipment.
• Crisis management: public relations help to protect your reputation.
• PCI fines and assessments: Insureon notes that first-party coverage can help pay payment card industry (PCI) compliance fines after a breach.

Third-party coverage: claims against you

Third-party coverage responds when customers, clients or partners sue you because their data was exposed or their business was harmed. It pays legal defense costs, settlements and court-ordered judgments. For IT and software businesses, this protection is often bundled with errors and omissions insurance as technology E&O.

Coverage You Need for Cyber Risk

How Much Does Cyber Liability Insurance Cost?

According to Insureon, small businesses that buy cyber insurance through its marketplace pay these typical amounts:

Insureon reports that annual cyber premiums range from about $400 to over $8,000, that 41% of its customers pay less than $100 per month and 26% pay between $100 and $200. Policy limits typically run from $1 million to $5 million, and the average deductible its customers choose is $1,000 to $2,500.

How to read these numbers: they are medians of premiums that insurers sold to one marketplace’s small business customers, most with fewer than five employees, revenue from under $50,000 to over $200,000 and five years or less in business. Medians leave out unusually high and low premiums. Annual figures marked “monthly x 12” are simple multiplications, not separate data. None of this is a quote. Your price depends on your industry, revenue, the amount and type of data you hold, your security controls, your limits and deductible, and your claims history.

What insurers look at

• Multi-factor authentication on email, remote access and admin accounts.
• Backups that are tested and kept offline or separate from your network.
• Patching and endpoint protection on every device.
• Employee training on phishing and payment verification.
• How much sensitive data you store and whether it is encrypted.

Cyber Claim Examples

These simplified “for example” scenarios show how coverage can respond. Actual results depend on your policy wording.

• For example, a dental office is hit by ransomware that locks patient records. First-party cyber can pay for forensic experts, system restoration, patient notifications and income lost while the office is closed.
• For example, an online store discovers malicious code on its checkout page that captured card numbers. Cyber coverage can help with forensic costs, customer notification, credit monitoring and PCI-related fines, and third-party coverage can defend lawsuits from affected customers.
• For example, a bookkeeping firm loses a client’s financial files when an employee’s email account is compromised. The client sues. Third-party cyber liability can pay defense costs and a settlement.

What Cyber Insurance Usually Does Not Cover

• Professional mistakes: missed deadlines or bad advice belong under professional liability or E&O.
• Physical damage and power outages: data lost to fire, a power surge or a natural disaster usually needs EDP coverage.
• Dropped or damaged client devices: accidental physical damage is typically excluded; electronic data liability added to general liability can help.
• Known incidents before the policy started: breaches you knew about before buying are excluded.
• Weak security you misrepresented: if your application says you use controls you do not, a claim can be disputed.
• Future lost profits and system upgrades: improving your systems after an attack is usually your cost.

State Rules: Breach Notification Laws

According to the National Conference of State Legislatures (NCSL), all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws that require businesses to notify people when a security breach involves their personally identifiable information. Most states extend the duty to government entities too.

NCSL notes these laws typically define who must comply, what counts as personal information (for example, a name combined with a Social Security number, driver’s license or state ID number, or account number), what counts as a breach, when and how notice must be given, and exemptions such as for encrypted data. Because deadlines and details differ, a business with customers in several states may face several sets of rules after one incident. Notification costs are one of the main reasons first-party cyber coverage exists.

Businesses that accept card payments also follow the Payment Card Industry Data Security Standard (PCI DSS) through their card processing agreements. A breach of card data can lead to PCI fines and assessments on top of state notification costs, which is why some cyber policies cover them.

Workers’ compensation is set state by state. Most states require it once you hire your first employee. Some use thresholds: according to the Florida Division of Workers’ Compensation, non-construction employers need coverage at four or more employees, construction employers at one or more, and agricultural employers at six regular employees, with corporate officers and LLC members counted toward the total. A state-by-state summary from Cerity lists Georgia, North Carolina and Virginia at three or more employees and Alabama, Tennessee and Mississippi at five or more. Texas generally lets private employers choose not to carry it, except for construction and government work. Rules change, so confirm with your state agency.

Bottom Line

If your business stores customer data, takes card payments or relies on email and computers to operate, cyber liability insurance is worth pricing. First-party coverage pays your own breach, ransomware and downtime costs, while third-party coverage handles lawsuits. Every state has breach notification rules, so response costs can add up fast. Strengthen your security controls, check limits and sublimits carefully and compare several quotes.

Frequently asked questions

Do small businesses really need cyber insurance?

Most small businesses that store customer data, take card payments or rely on email benefit from it. Cyber coverage is not required by state law, but general liability and BOPs usually exclude data breaches. Some clients also require cyber coverage in contracts before they share sensitive information with you.

How much does cyber liability insurance cost for a small business?

Insureon reports a median of about $129 per month, or $1,552 per year, for its small business customers, with annual premiums ranging from about $400 to over $8,000. Your price depends on your industry, revenue, data volume, security controls, limits and claims history.

Does cyber insurance cover ransomware?

Many cyber policies include ransomware and extortion coverage as part of first-party protection, helping with extortion demands, forensic work and system restoration. Coverage terms, sublimits and conditions vary, and some insurers require security controls like multi-factor authentication and backups, so read the policy carefully.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays your own costs after an incident, such as forensic investigation, notification, credit monitoring, ransomware and lost income. Third-party coverage pays legal defense, settlements and judgments when customers or clients sue you because their data was exposed or their business was harmed.

Does general liability cover a data breach?

Usually not. Insureon lists data breaches among the exclusions of general liability insurance. To protect against breach response costs and related lawsuits, a business typically needs a separate cyber liability policy, or technology E&O for IT and software companies.

You may also search for: business insurance cost, coverage limits, insurance deductibles

How we research this page: figures come from the third-party sources listed below, are attributed in the text and are reviewed when sources update. We do not accept payment to change rankings or conclusions. Read our editorial standards.

This page is for general information only and is not insurance, financial or legal advice. Coverage, rules and prices vary by state and insurer. Compare quotes and speak with a licensed agent before buying a policy. Sources: How Much Does Cyber Insurance Cost? – Insureon, Cyber Liability Insurance – Insureon, Security Breach Notification Laws – NCSL, Is Workers’ Comp Required in My State? – Cerity, Coverage Requirements – Florida Division of Workers’ Compensation.