Cyber liability insurance pays your business's own costs after a data breach, ransomware attack or online payment scam, such as forensics, customer notification, data recovery, ransom and lost income, and your legal costs when customers or regulators come after you. Any business that keeps customer data, takes card payments or pays invoices by email has the exposure. Insureon's small-business customers pay a median of $129 a month, or $1,552 a year.
The claim most small businesses should worry about isn't ransomware. It's a convincing email that gets someone to wire money to a criminal: the FBI received 24,768 business email compromise complaints in 2025 with $3.05 billion in reported losses. That cover often sits under a small sublimit, so check it before you compare prices. When you're ready, you can compare business insurance quotes for your whole program.
What does cyber liability insurance cover?
A cyber policy has two halves. First-party coverage pays your own costs after an incident. Third-party coverage pays when someone else, a customer, a client or a regulator, holds you responsible for it (The Hartford, Insureon).
| First-party (your losses) | Third-party (claims against you) | |
|---|---|---|
| What it pays | Forensic investigation, legal advice, customer notification, credit monitoring, PR, data recovery and system restoration, ransom payments and negotiation, lost income while systems are down | Defense and settlements in privacy and network security lawsuits, regulatory inquiries and fines, card-brand (PCI) fines and assessments |
| Typical trigger | Ransomware locks your files; a hacker copies customer records; an employee wires money on a fake instruction | A customer whose data leaked sues; a state regulator investigates; your hacked email infects a client |
| Who mainly needs it | Almost every business that uses email, payments or customer data | Businesses holding other people's data, and tech firms whose security work clients rely on |
Insureon notes that technology businesses responsible for clients' systems usually need third-party cover bundled into technology E&O, not standard cyber alone. If that's you, see our tech startup insurance guide.
What triggers a cyber claim at a small business?
Small-business cyber policies are built around three events.
Funds transfer fraud and business email compromise. A criminal gets into or imitates an email account and changes payment instructions, and your bookkeeper pays the "new" bank account. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with $3,046,598,558 in reported losses (FBI IC3 2025 report). The Hartford lists exactly this, a compromised email that sends funds to a fraudulent account, among the events its cyber cover responds to.
Ransomware. Malware encrypts your files and demands payment. IC3 received more than 3,600 ransomware complaints in 2025 with over $32 million in reported losses, and the FBI says those figures usually leave out lost business, staff time, files and equipment. Because those reported numbers leave out downtime and rebuilding, look closely at the business interruption and data restoration parts of any cyber quote.
A data breach that triggers notification. All 50 states, the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands have laws requiring private businesses to notify people when their personal information is breached (NCSL, checked October 2026). Notification brings its own bills: forensics to find out what was taken, legal advice, letters and credit monitoring. First-party cyber pays those.
Does a BOP or general liability policy cover cyber?
Usually not, or only a little. Don't assume your existing policy will respond.
In 2014 ISO, which writes the standard general liability forms many insurers use, introduced endorsements that exclude injury or damage arising from access to or disclosure of confidential or personal information. ISO said the exclusion applies even when the damages claimed are notification costs, credit monitoring, forensic or PR expenses (Insurance Journal interview with ISO). The form numbers to look for on your GL endorsement list are CG 21 06 and CG 21 07. If either is there, your general liability policy excludes that kind of data breach claim.
Policies vary. The Hartford, for example, says third-party cyber claims "may fall within" its general liability coverage, and it sells Data Breach and Cyber Virus and Malware add-ons to its business owner's policy for businesses with "non-complex" cyber risks. Its customers pay about $320 a year for that data breach coverage (The Hartford). An add-on like that is cheap because it's narrow. Ask three questions about any BOP or GL cyber add-on:
- What's the limit, and is it separate from or inside the BOP limit?
- Does it cover ransomware payments, lost income and funds transfer fraud, or only breach response costs?
- Does it cover lawsuits from customers, or only your own costs?
If the answers are "small", "no" and "no", you need a standalone cyber policy.
Social engineering sublimits: the line to check first
Most cyber policies cover funds transfer fraud and social engineering, but under a sublimit: a smaller cap inside the main limit, with its own line on the declarations page. A $1 million cyber policy can pay far less than $1 million for a fake-invoice wire.
Here is how one real form handles it. Hiscox's specimen CyberClear coverage part pays funds transfer fraud, social engineering and reverse social engineering losses "up to the limit stated in the Declarations." Those payments sit inside, not on top of, the overall cyber limit, and they apply only in excess of any crime insurance you carry (Hiscox specimen CYBCL-CYB P0001A CW (10/19)). Travelers' cyber application asks you to request a separate limit and retention for Funds Transfer Fraud and for Social Engineering Fraud (Travelers CYB-14102).
Sublimit sizes vary by insurer. At-Bay, for example, says activating its email security tool unlocks a financial fraud sublimit of up to $500,000, and its top package offers up to $1 million with no fraud retention (At-Bay).
How to size it: look at the largest single payment your business sends by wire or ACH in a normal month. If the social engineering sublimit is below that, ask for more, or add commercial crime insurance (see below).
What cyber insurance doesn't cover
Cyber policies are written around data and networks, so physical losses and a few predictable situations fall outside. These exclusions come from Hiscox's specimen form; other insurers' wording differs.
| Usually excluded | Where to look instead |
|---|---|
| Bodily injury and physical property damage | General liability and property policies |
| Outages at your internet provider, phone company or utility (unless your data in the cloud was breached) | Ask whether the cyber form adds system-failure or dependent business cover |
| Incidents you knew about, or that were reported under an earlier policy, before this one started | The earlier policy |
| Intentional or criminal acts by the business's owners | Not covered |
| Mistakes in professional or tech services you deliver to clients | Professional liability / tech E&O |
| Employee theft of money or property | Commercial crime insurance |
How much does cyber insurance cost?
A small business pays a median of $129 a month for a standalone cyber policy at Insureon, and much less for a BOP add-on with narrower cover.
| Source | What it measures | Figure |
|---|---|---|
| Insureon (updated April 24, 2026) | Median premium, standalone cyber, Insureon's small-business customers | $129/month ($1,552/year); about $400 to over $8,000 a year |
| Insureon | Same, by industry | IT businesses $179/month; finance businesses $59/month |
| The Hartford (updated Feb. 25, 2026) | Average premium its customers pay for data breach coverage | About $320/year |
Sources: Insureon cyber cost, The Hartford cyber cost. Insureon calls its figure an average but calculates it as the median of policies sold to its customers, most of whom have fewer than five employees.
In Insureon's data, 41% of customers pay under $100 a month and another 26% pay $100 to $200. Its customers' limits typically run from $1 million to $5 million, with deductibles of $1,000 to $2,500. The price moves with your industry, revenue, how much personal data you hold, your security controls, claims history, limit and retention. For a fuller breakdown, see how much cyber insurance costs.
What insurers ask before they quote
Cyber applications are mostly a security questionnaire. Your answers set the price and, if they turn out to be wrong, can put a claim at risk. Two published applications, Travelers' CyberRisk application and multi-factor authentication supplement and Beazley's US application for companies under $250 million in revenue, ask about the same controls (Travelers CYB-14306, Beazley F00863):
- Multi-factor authentication (MFA) on web-based email, on all remote access to your network, and on admin accounts, including admin access to your backups.
- Backups: how often you back up critical data; Travelers also asks whether backups are automated and tested at least once a year.
- Endpoint protection on all company devices. Beazley asks every applicant about anti-virus or endpoint protection, and asks for the vendor of endpoint detection and response (EDR) or managed detection (MDR) tools only from applicants with more than $35 million in revenue.
- Patching: whether critical patches are installed; Travelers asks if that happens within 30 days of release.
- Phishing training: whether and how often staff get it.
- Payment controls: Beazley asks whether staff who send money get anti-fraud training and whether you confirm a vendor's bank-detail change by a different channel than the request came in, for example a phone call to a known number after an email.
- Data you hold: card data and PCI compliance, medical records, Social Security numbers, and roughly how many people's records you store.
- Past incidents and any current cyber policy.
If you can't answer "yes" to MFA on email and remote access, fix that before applying. It is the first control both insurers ask about. Our checklist of what you need for a business insurance quote covers the rest of the paperwork.
Cyber vs crime insurance: which covers what?
They overlap on one loss, a fraudulent wire, and split on the rest. Coalition, which sells both, says crime policies respond to wire fraud through computer fraud, funds transfer fraud and fraudulent impersonation agreements, while cyber policies respond through a funds transfer fraud agreement. A business holding both can stack the wire fraud limits (Coalition).
| Loss | Cyber policy | Crime policy |
|---|---|---|
| Fake vendor email leads to a wire to a criminal | Yes, under the funds transfer fraud / social engineering sublimit | Yes, under fraudulent impersonation or funds transfer fraud |
| Bookkeeper embezzles over two years | No | Yes (employee theft) |
| Ransomware, breach notification, data restoration | Yes | No |
| Customer sues after their data leaks | Yes (third-party) | No |
| Forged checks | No | Yes |
Remember the Hiscox form above: its cyber fraud cover pays only after any crime policy, so the two work as layers. Read more about commercial crime insurance.
Claims-made, retroactive dates and switching insurers
The liability parts of cyber policies are claims-made: they respond to claims first made during the policy period, and defense costs reduce the limit, as both Travelers' and Beazley's applications state. First-party cover in Hiscox's form responds to events that first occur on or after the policy's retroactive date and that you discover during the policy period. When you switch insurers, ask the new one to match your old retroactive date so an older, undiscovered intrusion stays covered. Our guide to occurrence vs claims-made policies explains tail coverage.
How to buy cyber liability insurance
- Fix the basics first: MFA on email and remote access, tested backups, and a call-back rule for any change to payment details.
- List what you hold: card payments, customer records, health data, employee files.
- Decide on a limit and look hard at the sublimits for funds transfer fraud, social engineering and ransomware.
- Get at least two quotes and compare the forms, not only the price: what's excluded, the retroactive date, and whether the insurer runs its own incident response line.
Cyber is widely offered to office-based businesses. In QuoteSweep's carrier appetite data (insurers' own pages, checked March 2026), 15 insurers list cyber for at least one business class, most often technology companies (14 insurers) and professional services firms (12). Only one, biBERK, lists it for restaurants and for general contractors on those pages, so trades and food businesses may need to ask for it or buy it from a specialist. Cyber-focused insurers include Coalition and At-Bay; our best cyber insurance for small business page compares options.
To price cyber alongside your general liability, BOP and workers' comp, compare business insurance quotes, or start at business insurance for the full list of policies.
Frequently Asked Questions
What does cyber liability insurance cover?
It pays your own costs after a breach, ransomware attack or payment scam (forensics, notification, credit monitoring, data recovery, ransom, lost income) and your legal costs when customers or regulators pursue you over the incident.
How much does cyber insurance cost for a small business?
Insureon's small-business customers pay a median of $129 a month, or $1,552 a year, with most annual premiums between about $400 and over $8,000. The Hartford's customers pay about $320 a year for a narrower data breach add-on.
Does my general liability policy cover a data breach?
Often not. ISO's CG 21 06 and CG 21 07 endorsements, introduced in 2014, exclude claims arising from access to or disclosure of personal or confidential information, including notification and credit monitoring costs. Check your GL endorsement list for those form numbers.
What is a social engineering sublimit?
It's a smaller cap inside your cyber limit for losses when someone tricks an employee into sending money. A $1 million cyber policy might pay far less for a fake-invoice wire, so compare the sublimit with the largest payment you usually send.
What limit of cyber insurance do small businesses buy?
Insureon says its customers' cyber limits typically range from $1 million to $5 million. Pick a limit based on how many customer records you hold and how long you could run without your systems, and check the sublimits inside it.
Do I need cyber insurance if my data is in the cloud?
Usually, yes. A hijacked email account can still send your money to a criminal, and a breach at a cloud provider can still expose your customers' records. Hiscox's specimen form, for one, keeps cover for breaches of data stored in the cloud even though it excludes internet and utility outages.
Is cyber insurance the same as crime insurance?
No. Both can cover a fraudulent wire, but only crime covers employee theft and forgery, and only cyber covers ransomware, breach response and customer lawsuits. Some businesses carry both and stack the wire fraud limits.
