Small businesses often assume hackers only target big companies. In reality, smaller firms are frequent targets precisely because they tend to have weaker defences. A single phishing email can lead to stolen customer data, a locked computer system or a fake invoice paid to a criminal’s bank account.
Cyber insurance for small business helps pay for the fallout: investigation, recovery, legal costs and lost income. This guide explains what it covers, what it typically excludes, what insurers will expect you to have in place, and how to choose a policy. If your business is moving systems online, our plain-English guide to cloud computing for business owners is useful background.
Why Small Businesses Need to Think About Cyber Risk
Common incidents that hit small firms include:
- Ransomware: criminals encrypt your files and demand payment to unlock them.
- Business email compromise: a criminal impersonates a supplier or executive to redirect payments.
- Data breaches: customer names, emails, card details or health information are exposed.
- Account takeovers: stolen passwords give attackers access to email, banking or software.
- Website attacks: sites are defaced or taken offline.
The costs go well beyond IT repairs: lost sales while systems are down, legal advice, customer notifications and reputational damage.
What Cyber Insurance Typically Covers
Policies usually combine two types of cover.
First-party cover (your own losses)
- Forensic investigation to find out what happened
- Data recovery and system restoration
- Business interruption: lost income while systems are down
- Customer notification and credit monitoring after a breach
- Crisis communications and public relations support
- Ransomware response, including negotiation support, where legal
Third-party cover (claims against you)
- Legal defence if customers or partners sue after a breach
- Settlements and judgments
- Regulatory investigations and, where insurable, fines
- Payment card industry (PCI) assessments after card data is exposed
Common Exclusions
Read exclusions carefully. Policies often don’t cover:
- Known incidents that happened before the policy started
- Poor security practices that contradict what you stated on your application
- Social engineering fraud (fake invoice scams), unless added as an extra
- Infrastructure failures such as power or internet provider outages
- Acts of war, with wording that varies between insurers
- Improvements to systems beyond restoring them to their previous state
Funds-transfer fraud is one of the most common losses for small firms, so ask specifically whether it’s covered and up to what limit.
What Insurers Expect You to Have in Place
Insurers increasingly require basic security controls before they’ll offer cover, or charge more without them. Typical requirements:
- Multi-factor authentication on email, remote access and admin accounts
- Regular, tested backups, with at least one copy offline or separate from your network
- Up-to-date software with security patches installed promptly
- Endpoint protection such as modern antivirus on all devices
- Staff training on phishing and suspicious payment requests
- Payment verification procedures, such as calling suppliers on a known number before changing bank details
The US Federal Trade Commission’s cybersecurity guidance for small businesses covers these basics and is a good checklist before you apply.
What Cyber Insurance Costs
Premiums depend on:
- Your industry (healthcare, finance and retail usually pay more)
- Annual revenue and number of employees
- How much sensitive data you hold
- Your security controls
- Coverage limits and deductible
- Claims history
Small, low-risk businesses with good controls can often find affordable policies. The best way to know is to get quotes from several insurers or a broker who focuses on cyber cover.
How to Buy the Right Policy
- Map your risks: what data you hold, which systems you can’t operate without, and how you take payments.
- Estimate downtime costs: how much would a week offline cost in lost sales?
- Choose limits that cover realistic worst cases, not just minimums.
- Check sub-limits for ransomware, business interruption and funds-transfer fraud.
- Confirm the response service: many policies include a 24/7 hotline and access to incident response experts, which can be as valuable as the money.
- Answer the application honestly. Misstating security controls can void a claim.
Cyber Insurance vs General Business Insurance
It is worth checking your existing policies before buying anything new, because you may already have some limited protection.
General liability and property policies usually exclude or severely limit cyber incidents. Some business owner policies offer small cyber add-ons, but these often have low limits. A standalone cyber policy usually provides broader protection and expert response support.
What to Do If an Incident Happens
- Call your insurer’s incident hotline before paying any ransom or hiring your own consultants
- Disconnect affected devices from the network, but don’t wipe them
- Preserve emails, logs and messages as evidence
- Follow legal requirements to notify customers or regulators, with your insurer’s advice
Five Low-Cost Security Steps Before You Apply
- Turn on multi-factor authentication everywhere, starting with email, banking and accounting software.
- Use a password manager so every account has a unique, strong password.
- Set up automatic backups to a cloud service and a separate offline drive, and test restoring a file.
- Turn on automatic updates for operating systems, browsers and key software.
- Agree a payment rule: any change to supplier bank details must be confirmed by phone on a known number.
These steps reduce your risk, can lower your premium and make the insurance application far easier to answer honestly.
A Real-World Example
A small accounting practice receives an email that appears to come from a regular client, asking to update their bank details for a refund. A staff member makes the change and sends $18,000 to the criminal’s account. Without social engineering cover, the firm absorbs the full loss. With it, and with the incident reported promptly, the policy may cover part or all of the loss, subject to the limit and deductible. A simple call-back rule could have prevented it entirely.
Frequently Asked Questions
Do sole traders need cyber insurance?
If you store client data, take online payments or rely on email for invoicing, a basic policy can still be worthwhile.
Does cyber insurance pay ransoms?
Some policies cover ransom payments where legally allowed, but insurers usually require approval first, and paying is never guaranteed to restore data.
Will insurance cover a fake invoice scam?
Only if the policy includes social engineering or funds-transfer fraud cover. Check limits carefully.
How much cyber cover does a small business need?
It depends on your data, revenue and downtime costs. Many small firms start with limits that would cover a realistic week or two of disruption plus breach response costs, then adjust with a broker’s advice.
Is cyber insurance tax deductible?
Business insurance premiums are often treated as a deductible business expense, but check with your accountant.
Key Takeaways
- Cyber insurance covers both your own recovery costs and claims made against you.
- Funds-transfer fraud is often excluded unless you add specific cover.
- Insurers expect multi-factor authentication, tested backups and staff training.
- Answer application questions honestly, because misstatements can void a claim.
- Call the insurer’s incident hotline before taking major action after an attack.
The Bottom Line
Cyber insurance can protect a small business from the financial shock of ransomware, data breaches and payment fraud, but only if you choose the right cover and maintain the security controls insurers expect. Put the basics in place, compare policies carefully and know who to call when something goes wrong. For more business guides, browse our Business section.
General information only, not insurance advice.
