Many small business owners assume cyber attacks are a big-company problem. The reality is the opposite: small businesses are the most common target of cyber attacks, precisely because they are less likely to have strong security controls.
Here is why small businesses need cyber insurance — and what it actually costs.
Why Small Businesses Are Targeted
Cybercriminals are rational actors. They target small businesses because:
Weaker security. Small businesses typically have fewer IT resources, less sophisticated security tools, and less security awareness training than large enterprises.
Valuable data. Small businesses hold customer payment information, employee records, and business financial data — all valuable to attackers.
Gateway to larger targets. Small businesses that serve as vendors or contractors to larger companies can be used as entry points into those larger organizations.
Lower defenses, lower risk for attackers. A small business is less likely to have the forensic capabilities to identify and prosecute attackers.
According to the Verizon Data Breach Investigations Report, small businesses (under 1,000 employees) account for the majority of confirmed data breaches each year.
The Real Cost of a Cyber Incident for a Small Business
The average cost of a data breach for a small business is $120,000–$200,000. For many small businesses, this is an existential threat.
Costs include:
- Forensic investigation: $10,000–$50,000
- Legal counsel: $10,000–$30,000
- Customer notification: $5,000–$50,000 depending on the number affected
- Credit monitoring for affected customers: $5,000–$30,000
- Business interruption: Varies widely
- Regulatory fines: $0–$100,000+
- Reputational damage: Difficult to quantify but often significant
Many small businesses that experience a significant cyber incident do not survive the financial impact.
What Cyber Insurance Costs for Small Businesses
Cyber insurance premiums for small businesses vary based on:
- Revenue and size
- Industry (healthcare, financial services, and retail pay more)
- Amount of sensitive data handled
- Security controls in place
- Coverage limits and deductibles
Typical ranges for small businesses:
- Micro businesses (under $1M revenue): $500–$1,500/year
- Small businesses ($1M–$10M revenue): $1,500–$5,000/year
- Mid-size businesses ($10M–$50M revenue): $5,000–$20,000/year
These are rough benchmarks. Businesses in high-risk industries or with poor security controls pay more.
What Security Controls Affect Your Premium
Cyber insurers increasingly require specific security controls as a condition of coverage. Controls that reduce your premium and improve your insurability:
Multi-factor authentication (MFA): Required by most carriers for email and remote access. Reduces the risk of credential-based attacks significantly.
Endpoint detection and response (EDR): Modern security software that detects and responds to threats in real time.
Offline backups: Backups that cannot be reached by ransomware. Critical for recovery and often required by carriers.
Security awareness training: Regular training for employees on phishing and social engineering.
Patch management: Keeping systems and software updated to address known vulnerabilities.
Privileged access management: Limiting who has administrative access to systems.
Businesses that cannot demonstrate these controls may face higher premiums, lower coverage limits, or difficulty obtaining coverage at all.
What Small Businesses Should Look for in a Cyber Policy
First-party coverage: Covers your own losses — breach response, ransomware, business interruption, data recovery.
Third-party coverage: Covers claims by customers and others — privacy liability, regulatory defense.
Social engineering coverage: Covers losses from business email compromise and fraudulent wire transfers. This is increasingly important and not always included in basic policies.
Incident response services: Many cyber policies include access to a 24/7 incident response hotline and a team of forensic, legal, and PR experts. For a small business without these resources in-house, this is extremely valuable.
Adequate limits: A $250,000 limit may not be sufficient for a business with significant customer data. Work with your agent to determine appropriate limits based on your actual exposure.
The Bottom Line
Cyber insurance is not just for large enterprises. For small businesses that handle customer data, process payments, or depend on their systems to operate, cyber insurance is a necessary part of a complete business insurance program.
Talk to a RightQuote advisor about cyber insurance for your business, or explore business insurance options.
Part of the Cyber Insurance Guide.