Forty percent of small business owners say a cyberattack costing $100,000 or less would be enough to put them out of business. Yet a majority of small businesses still carry no cyber insurance at all, betting that hackers only go after companies with household names and nine-figure revenue. They don't. Roughly a quarter to a third of reported data breaches now hit small businesses directly, and the average recovery bill — $120,000, with downtime alone running $53,000 an hour — is exactly the kind of number that turns a bad week into a permanent closure.
Cyber insurance sits in an odd spot for most owners: it feels like a big-company expense for a small-company problem. In reality it's one of the few insurance products priced specifically for the risk a five-person consulting firm or a twenty-person e-commerce shop actually faces. The trouble is that the policies are confusing, the premiums vary by 10x depending on who's quoting you, and the exclusions are where most owners get burned. Here's how to think about the trade — the real cost of a policy, the real cost of skipping one, and the fine print that decides whether a claim actually pays out.
What a Breach Actually Costs a Small Business
The headline "average cost of a data breach" numbers you see in the news — $4.44 million globally, over $10 million in the U.S. — are skewed by enterprise incidents involving millions of customer records. They're not the number that matters to a business with a dozen employees and a handful of vendors.
The more useful figures for a small operation:
- $120,000 — average total recovery cost for a small business incident (investigation, remediation, notification, and cleanup combined).
- $53,000 per hour — average cost of downtime while systems are offline, which for a retail or service business can dwarf the direct remediation bill within a single business day.
- $120,000 to $1.24 million — the range Verizon's breach research reports depending on incident severity, meaning "small" incidents can still land at six figures once legal, forensic, and notification costs are counted.
- 60% — the share of small businesses that close within six months of a major cyberattack, according to widely cited industry surveys. This is the number that should reframe the conversation: it's not really an IT cost, it's a survival risk.
Ransomware and business email compromise (BEC) are the two incident types most likely to hit a small business specifically, and they behave very differently. Ransomware is a blunt, opportunistic attack — automated scanners find an exposed remote-desktop port or an unpatched server, and any business is a target regardless of size. BEC is more targeted: a scammer impersonates a vendor, a landlord, or even the owner via email and tricks someone in accounting into wiring funds or updating direct-deposit details. The FBI's Internet Crime Complaint Center attributed over $2.7 billion in reported losses to BEC in a single recent year, out of $16.6 billion in total reported cybercrime losses — and BEC is exactly the category where cyber insurance coverage gets complicated, which we'll get to below.
What a Policy Actually Pays For
Cyber insurance splits into two halves, and understanding the split explains why premiums vary so much and why the cheapest policy is often the wrong one.
First-party coverage pays for your own business's direct costs after an incident: forensic investigation to figure out what happened, data restoration, system repair, business interruption income you lose while systems are down, customer notification and credit monitoring if personal data was exposed, crisis PR, and — if you choose to pay — ransomware extortion demands.
Third-party coverage pays when someone else sues you because your breach exposed their data or hurt their business: legal defense costs, settlements, regulatory fines and penalties (where insurable), and the cost of a customer or vendor claiming your negligence caused them financial harm.
Most small business policies bundle both, but the balance shifts depending on what you actually store. A business that holds customer payment card data, health information, or Social Security numbers needs strong third-party coverage because that's where lawsuits and regulatory exposure concentrate. A business that mostly just needs to keep its own operations running — a contractor, a small manufacturer, a professional practice with light data exposure — leans more on the first-party side: getting systems back up and covering the lost income while they're down.
What It Actually Costs in 2026
Premiums have stabilized after several years of steep increases, and the market has gotten meaningfully more accessible for small businesses with reasonable security practices in place. Current pricing for a small business:
- Typical range: roughly $400 to $1,600 per year for a policy with a $1 million aggregate limit, with a common median landing around $130–$145 per month.
- Wider range: businesses in higher-risk categories (technology, healthcare, financial services, anyone storing significant customer data) can see premiums run well above $2,000–$5,000 annually, while lower-risk service and retail businesses often land toward the bottom of the range.
- The biggest cost drivers: industry (tech and IT companies pay roughly 88% above the national average; recreation and low-data-exposure businesses pay roughly 38% below it), the volume and sensitivity of data you store, your revenue, and — increasingly — whether you can demonstrate baseline security controls like multi-factor authentication (MFA), endpoint protection, and regular backups.
That last point matters more each renewal cycle. Insurers have tightened underwriting after years of ransomware losses, and MFA specifically has gone from a "nice to have" question on the application to a hard requirement for coverage at most carriers. If you can't check that box, expect either a higher premium, a coverage exclusion for the gap, or a declined application outright.
Where Claims Actually Get Denied
The premium is the easy part. The part that determines whether the policy actually helps you when you need it is the exclusions and sublimits — and this is where a lot of small business owners discover, mid-crisis, that their "$1 million policy" doesn't cover the loss they just suffered.
Social engineering and BEC sublimits. This is the single most common gap. Many policies quietly cap payouts for social-engineering and wire-fraud losses — the exact BEC scenario described above — at $25,000 to $50,000, even when the headline policy limit is $1 million or more. If a scammer tricks your bookkeeper into wiring $180,000 to a fake vendor account, a policy with a $25,000 social-engineering sublimit leaves you covering the other $155,000 yourself. Ask specifically about this sublimit before you buy; it's rarely highlighted in a quote summary.
Callback verification requirements. Some social-engineering endorsements only pay out if your business had already implemented a callback or dual-verification process for changing payment details — meaning the claim can be denied not because the fraud wasn't covered in principle, but because you can't prove you followed the required verification procedure at the time.
Security control requirements. If your application said you had MFA enabled and an audit after the incident shows you didn't, insurers can deny the claim for misrepresentation. This is the fastest-growing category of claim denial as underwriting has tightened.
Reporting delays. Most policies require notifying the insurer within a defined window (often 30–60 days) of discovering an incident. Waiting to see if the problem "resolves itself" before calling your insurer is a common — and entirely avoidable — way to lose coverage.
Regulatory fines and war exclusions. Not all regulatory penalties are insurable depending on jurisdiction, and most policies exclude losses tied to state-sponsored or "act of war" cyber incidents, a category insurers have been defining more broadly since 2022.
The practical takeaway: don't just compare premiums across quotes. Compare the social-engineering sublimit, the specific security controls required to keep the policy valid, and the incident-reporting deadline. A cheaper policy with a $25,000 fraud sublimit is not a better deal than a slightly pricier one with a $250,000 sublimit if BEC is your realistic exposure.
Deciding If You Need It
Cyber insurance makes the most sense when at least one of these applies to your business: you store customer payment or personal data, you handle wire transfers or payment changes by email, you'd lose meaningful revenue from even a day or two of downtime, or a $100,000 unplanned expense would genuinely threaten the business. For a large share of small businesses, that's most of the list.
If you decide to buy, budget for it the way you'd budget for any other fixed operating cost — and if you decide to skip it, treat prevention spending (MFA, backups, employee training on wire-transfer verification) as the self-insurance alternative, since it costs a fraction of what recovery does regardless of whether a policy is in place.
Keep Your Risk Visible in Your Books
Whether you carry a policy or not, the businesses that recover fastest from a cyber incident are the ones that can immediately answer "what did this cost us, and what's covered." That starts with clean, current financial records — knowing your cash position, your outstanding payables, and exactly which transactions moved before and after an incident. Beancount.io gives you plain-text, version-controlled accounting with a full audit trail, so if you ever do need to document a loss for an insurance claim or simply understand the damage, the numbers are already there. Get started for free and keep your financial records as auditable as your security logs should be.