If you run a small business in the United States, you have probably heard that cyber insurance is “getting expensive” or “hard to get.” Both things can be true, but the real answer to how much cyber insurance costs for a small business depends on a handful of factors you can mostly control. This guide breaks down typical 2026 price ranges, what insurers look at when they set your premium, and the practical steps that bring the cost down.
Note: the figures below are typical market ranges for U.S. small businesses, not quotes. Actual premiums vary by insurer, state, and your specific risk profile. Always get written quotes from licensed agents or carriers before you decide.
The Short Answer: Typical Cyber Insurance Costs in 2026
For most U.S. small businesses with fewer than 50 employees and under $5 million in annual revenue, a standalone cyber liability policy commonly falls in these ranges:
| Business profile | Typical coverage limit | Typical annual premium |
|---|---|---|
| Very small / low-risk (1–10 employees, little sensitive data) | $500,000 – $1 million | $500 – $1,500 |
| Small / moderate-risk (10–50 employees, customer data stored) | $1 million – $2 million | $1,200 – $4,000 |
| Higher-risk (health, legal, financial data, or e-commerce payments) | $1 million – $3 million | $3,000 – $10,000+ |
In monthly terms, many very small businesses pay somewhere between roughly $40 and $150 a month for a $1 million policy. Businesses that handle regulated or highly sensitive data pay noticeably more, because a single breach can cost far more to resolve.
What Drives the Price of Cyber Insurance?
Insurers price cyber policies by estimating how likely you are to suffer a breach and how expensive it would be. These are the factors that move your premium the most.
1. Industry and the type of data you hold
A landscaping company that stores a few customer emails is a very different risk from a dental practice holding patient records or a law firm holding confidential client files. Businesses that handle protected health information, financial records, or Social Security numbers pay more, because notification, credit monitoring, and regulatory costs add up quickly.
2. Annual revenue and number of employees
Revenue is a proxy for how much you could lose from downtime, and headcount is a proxy for how many people could click a phishing link. Both push premiums up as they grow.
3. Coverage limits and deductible
A $2 million limit costs more than a $1 million limit, but not twice as much. A higher deductible (also called a retention) lowers your premium, though you will pay more out of pocket if a claim happens. Many small businesses choose a deductible between $1,000 and $10,000.
4. Your security controls
This is the factor you control most. Underwriters now ask detailed questions about your security practices, and the answers can swing your price significantly. Insurers typically look for:
- Multi-factor authentication (MFA) on email, remote access, and admin accounts
- Offline or immutable backups that are tested regularly
- Endpoint protection (EDR or managed antivirus) on all devices
- Employee security awareness training and phishing simulations
- Patch management and up-to-date software
- A written incident response plan
5. Claims and breach history
If you have had a prior cyber incident or claim, expect higher quotes or additional underwriting questions. A clean history helps, and some insurers reward multi-year loyalty.
6. Whether you process payments online
E-commerce businesses and anyone accepting card payments face additional exposure, including payment card industry (PCI) fines and fraud-related costs. Insurers may price this in.
Cyber Insurance Cost by Business Type
Here is how typical annual premiums for a $1 million limit tend to compare across common small business types. Treat these as rough starting points.
Professional services (consultants, accountants, agencies)
Often $800 to $3,000 per year. These businesses hold client financial and personal data, so insurers pay close attention to MFA and email security.
Healthcare practices (dental, medical, therapy)
Often $1,500 to $6,000 per year or more. Patient records are among the most expensive data to lose, and HIPAA exposure raises the stakes, so premiums reflect it.
Law firms
Often $1,500 to $5,000 per year. Confidential client information and the risk of wire-transfer fraud make this a closely underwritten class.
Retail and e-commerce
Often $700 to $3,500 per year, rising with online sales volume and the amount of customer payment data you handle.
Restaurants and local service businesses
Often $500 to $1,800 per year. Lower data sensitivity usually means lower premiums, though point-of-sale systems and online ordering add some risk.
What Does a Cyber Insurance Policy Actually Cover?
The price only makes sense if you know what you are buying. Most small business cyber policies combine two kinds of protection.
First-party coverage (your own losses)
- Incident response costs: forensic investigators, legal counsel, and breach coaches
- Data recovery: restoring or recreating lost data and systems
- Business interruption: lost income while your systems are down
- Cyber extortion: ransomware negotiation and, in some policies, ransom payments
- Notification and credit monitoring: informing affected customers
Third-party coverage (claims against you)
- Privacy liability: lawsuits from customers whose data was exposed
- Regulatory defense and fines: where insurable by law
- Media liability: certain online content claims
- Payment card liabilities: PCI-related penalties and assessments
Common exclusions to watch for
Read the exclusions as carefully as the coverage list. Typical gaps include acts of war, failure to maintain required security controls, prior known incidents, and certain losses from unencrypted devices. Some policies also sublimit ransomware or social engineering coverage, meaning they pay far less than the headline limit for those events.
Why Small Businesses Need Cyber Insurance Anyway
It is tempting to assume attackers only go after large companies. In practice, small businesses are attractive targets because they tend to have weaker defenses and still hold valuable data. The cost of a single incident, including investigation, legal fees, downtime, notification, and lost customers, can easily exceed the cost of many years of premiums.
Also, your general liability policy usually does not cover cyber events. Standard commercial policies often exclude or heavily limit data breach and ransomware losses, which is why a dedicated cyber policy matters.
How to Lower Your Cyber Insurance Premium
You do not have to accept the first number you see. These steps often reduce what you pay.
Turn on multi-factor authentication everywhere
MFA is the single most requested control. If an insurer asks whether MFA is enabled on email and remote access and you can answer yes, you typically qualify for better pricing, and sometimes for coverage at all.
Back up your data the right way
Keep backups that are separate from your main network, and test restores. Insurers want to know you can recover without paying a ransom.
Train your team
Phishing remains the most common way in. Regular security awareness training and simulated phishing campaigns are inexpensive and signal that you take risk seriously.
Choose a sensible deductible
If you can comfortably absorb a larger out-of-pocket cost, raising your deductible lowers your premium. Make sure the number is one your cash flow can actually handle.
Right-size your limits
Estimate your real exposure: how many customer records you hold, what a day of downtime costs you, and what notification would cost. Buy enough to cover a realistic worst case, not a theoretical maximum.
Compare multiple quotes
Pricing differs widely between carriers, and appetite varies by industry. Work with an independent agent who can quote several insurers, and compare coverage terms, not just price.
Bundle where it makes sense
Some carriers offer cyber coverage as an add-on to a business owner’s policy (BOP) or professional liability policy. That can be cheaper, but add-on coverage often has lower limits, so check the details.
How to Get Accurate Quotes
Follow this simple process to get quotes you can actually compare.
- Gather your basics: revenue, employee count, industry, and the types and volume of data you store.
- Document your security controls: MFA, backups, endpoint protection, training, and any written policies.
- Decide on limits and deductibles: request quotes at two or three levels so you can see the price difference.
- Ask about sublimits: specifically for ransomware, social engineering, and business interruption.
- Request quotes from at least three sources: an independent agent, a direct carrier, and a specialist cyber insurer if available.
- Read the application carefully: inaccurate answers can give an insurer grounds to deny a claim later.
Frequently Asked Questions
Is cyber insurance worth it for a very small business?
Usually, yes. Even a one-person business can lose significant income to ransomware or business email compromise, and a basic policy is relatively affordable compared with the potential loss.
Does cyber insurance cover ransomware?
Most policies cover ransomware response costs, and many cover extortion payments, but sublimits and conditions are common. Confirm the exact terms before you buy.
Can I get cyber insurance without MFA?
It is increasingly difficult. Many insurers require MFA as a baseline, and some will decline coverage or charge much more without it.
How long does it take to get a policy?
For small, lower-risk businesses, quotes can come within a day or two and coverage can start soon after. More complex or higher-risk applications take longer.
Will my premium go up every year?
Premiums can rise or fall at renewal depending on the market, your claims history, and any changes to your controls. Improving your security usually helps you at renewal.
Final Thoughts
For most U.S. small businesses, cyber insurance costs somewhere between a few hundred and a few thousand dollars a year, with higher prices for industries that handle sensitive data. The best way to keep your cost down is to strengthen the basics that insurers care about: MFA, tested backups, employee training, and up-to-date systems. Those same steps also reduce the odds that you ever need to file a claim.
Start by gathering your business details and security controls, then request quotes from several sources and compare coverage line by line. A little preparation can save you money and leave you far better protected.
Disclaimer: This article is for general informational purposes only and is not insurance, legal, or financial advice. Cost ranges are illustrative and may not reflect current quotes. Consult a licensed insurance professional before purchasing coverage.