Does My Business Need Cyber Insurance?

What a cyber policy pays for

A cyber policy usually pays for two kinds of costs. The FTC's small-business guide to cyber insurance lists what each one typically includes.

Your own costs (insurers call this "first-party" coverage):

• Experts who investigate the attack and get you running again
• A lawyer to tell you who you must notify, and when
• Recovering or replacing lost data
• Notifying customers, a call center and credit monitoring
• Income you lose while you're shut down
• Responding to ransomware and other extortion
• Public relations help

Claims against you ("third-party" coverage): lawsuits from customers whose data was exposed, the cost of regulatory investigations, and fines where the law allows them to be insured. Many policies also come with a 24/7 hotline that connects you to these experts.

The gap most owners miss: wire fraud

Business email compromise, where a scammer poses as a vendor, a client or your own boss to redirect a payment, cost US victims about $3.05 billion in reported losses in 2025, from 24,768 complaints. Only investment fraud cost more (FBI Internet Crime Report 2025).

That's exactly the loss basic cyber coverage handles worst. The insurance regulators' 2026 market report says standard cyber policies frequently exclude, or sharply limit, "social engineering" and "funds transfer fraud" losses, and often leave them to a separate crime policy (NAIC, 2026).

When you compare quotes, look for those two phrases by name, and for the separate, smaller limit (a "sublimit") that often sits beside them. Then ask your agent, in writing: if an employee pays a fake invoice, which of our policies pays, and up to how much?

What cyber insurance usually doesn't cover

Every insurer words its exclusions differently, but these are common (Reed Smith, 2023; NAIC, 2026):

• Upgrades. The policy restores what you had. Better systems after an attack are on you.
• War and state-backed attacks. These exclusions have been widely used since 2023.
• Old problems. Incidents that began before the policy started, or that you already knew about.
• Outside outages. Failures at power, internet or phone providers are often excluded. Cloud outages vary by policy.
• Injuries and physical damage. Other policies are expected to handle those.
• Broken promises. Some policies exclude losses if you didn't keep up the security you described when you applied.

Your policy limit is a ceiling, not a promise. Some losses have smaller caps inside the policy, and the deductible and a waiting period of several hours come off first. Most cyber policies are also "claims-made": the claim generally has to be reported while the policy is active, so a gap between policies can leave you uncovered.

Doesn't my business policy already cover this?

Probably not much of it. Standard general liability forms have excluded data-breach claims since 2014 (Insurance Journal, 2014).

Your business owner's policy may include a cyber add-on (an "endorsement"). Most cyber policies in force in the US are add-ons like this, yet they bring in only about 4% of cyber premiums, a sign of how narrow and low-limit they tend to be (NAIC, 2026).

That may explain a puzzle. In a 2026 survey of 300 small business owners, 42% said they buy cyber insurance (Nationwide, 2026), while industry estimates put cyber insurance use among small and midsize businesses at just 10% to 20% (cited in NAIC, 2026). Many owners who believe they're covered may have only a small add-on.

To check yours, find the declarations page and look for "cyber," "data compromise" or "social engineering," and the limit printed next to each.

Who needs it most, and who can reasonably skip it

The case for coverage is stronger if:

• You send or receive payments by wire or ACH based on email instructions.
• You keep Social Security numbers, bank details, health information or card numbers for customers or staff.
• You can't operate for long without email and your main software.
• A client contract, lease or loan requires it.
• You're in a regulated field. Tax preparers and other businesses covered by the FTC Safeguards Rule, for example, must notify the FTC within 30 days of a breach affecting 500 or more consumers (FTC).

The case is weaker for a very small business that stores no customer data, lets its payment processor handle cards, always confirms bank-detail changes by phone, and could absorb a five-figure loss. A small add-on, or crime coverage that includes social engineering, may be enough there.

Six questions to ask yourself

1. If a fake invoice emptied our account tomorrow, how much could we lose, and could we survive it?
2. Do we keep Social Security numbers, bank details, health information or card numbers?
3. How many days could we work without email and our main software?
4. Does any contract, lease or loan require cyber coverage?
5. What does our current policy say about "cyber," "data compromise" or "social engineering," and what's the limit?
6. Who would we call at 2 a.m. if ransomware locked us out?

How big are small-business cyber losses?

Most are smaller than the scary headlines, but the worst ones are severe. Verizon studied US cyber insurance claims. For businesses with under $25 million in revenue, it found that "the impact median approximates a modest $38,000," and that the loss as a share of revenue "was as high as 3% of revenue in the top 10% of cases and over 7% in the more extreme top 2.5% of cases" (2026 Breach Impact Study).

Insurance is mostly for that bad tail: the loss you couldn't absorb on your own.

You may have seen the claim that 60% of small businesses go out of business within six months of a cyberattack. The organization it's usually credited to says the figure can't be verified and recommends against using it (National Cyber Security Alliance, 2022).

What it costs

There's no independent public price benchmark for small-business cyber insurance. The best available numbers come from insurance sellers. One large online agency says most of its cyber buyers pay $500 to $999 a year, with prices ranging from about $200 to more than $17,000. Most of its buyers have fewer than five employees (Insureon, 2026).

Your price depends mostly on your industry, revenue, how much sensitive data you keep, your security habits, your claims history, and the limits and deductible you choose.

Timing is on buyers' side for now. US cyber insurance rates fell for eight straight quarters through early 2026 (NAIC, 2026) and were flat in the third quarter (Marsh, October 2026). Don't pick on price alone, though. Compare what each quote pays for wire fraud, the limit beside it, the deductible and the waiting period.

The application: answer it like a sworn statement

Expect questions about two-step login (the "MFA" on your application), protection on every computer, backups, employee training, and how you verify payment requests. Your answers become part of the policy.

In a 2022 case, an Illinois company reported a ransomware attack about two months after its cyber policy began. The insurer said the company's answers about two-step login were wrong, and the policy was voided from its start by agreed court order (Travelers v. International Control Services, C.D. Ill. 2022).

If you're not sure whether something on the form is true everywhere in your business, find out before you sign.

If something happens

• Call your insurer's breach hotline first. Many policies only pay for approved vendors, or for costs incurred after you've notified the insurer.
• If money was wired to a scammer, call your bank right away to request a recall, then report it at ic3.gov. Hours matter: in 2025 the FBI's recovery team froze $679 million in fraudulent transfers (FBI IC3, 2025).
• Don't wipe and rebuild computers before the experts look. You can destroy evidence the claim depends on.
• Don't pay or negotiate a ransom on your own. Insurers usually require consent, and the US Treasury warns that paying a sanctioned group can bring penalties even if you didn't know who they were (OFAC, 2021).
• Talk by phone or a separate account, not over email that may be compromised.

This guide is general information, not insurance or legal advice. Policies differ a lot from one insurer to the next. Read your policy and talk to a licensed insurance agent or broker before you buy or change coverage. Tech Solutions Now doesn't sell insurance.

Sources

1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026. Reported complaints from individuals and businesses, not verified losses.
2. National Association of Insurance Commissioners, Report on the Cybersecurity Insurance Market, 2025 Reporting Year, October 2026.
3. Verizon, 2026 Breach Impact Study, June 2026. About 70,000 US cyber insurance claims, 2019–2025; medians, not averages.
4. Federal Trade Commission, Cyber Insurance (small-business guide) and FTC Safeguards Rule: What Your Business Needs to Know.
5. Nationwide, 2026 Cybersecurity Survey Report, August 2026. Online survey of 300 owners of businesses with 1–50 employees, July 2026.
6. Insureon, cyber insurance trends release, June 2026. Data from an online insurance agency's own customers.
7. Marsh, Global Insurance Market Index, Q3 2026, October 2026.
8. Reed Smith, Navigating common exclusions in cyber policies, June 2023.
9. Insurance Journal, ISO Comments on CGL Endorsements for Data Breach Liability Exclusions, July 2014.
10. Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill.), agreed order of rescission, August 30, 2022.
11. US Treasury, Office of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, September 2021.
12. National Cyber Security Alliance, statement on an incorrect small business statistic, May 2022.
13. Ohio Revised Code 1349.19 (breach notice) and 1354.02 (Data Protection Act defense).