Coverage guide

Cyber liability insurance

For businesses that store customer data, take payments or move money by email: what a cyber policy pays for, what it costs and the breach notice deadlines it helps you meet.

Independent brokerage: we compare several insurers
Licensed agents review every application
No cost and no obligation to buy

Get cyber liability insurance quotes

What similar businesses pay

Cyber insurance, all industries: About $129 a month
Annual premium range: $400 to over $8,000 a year
Data breach coverage: About $320 a year

Published benchmarks, not quotes. Your price depends on underwriting.

Cost

What cyber liability insurance costs

About $129 a month

Cyber insurance, all industries

Insureon median for its small-business customers, updated April 24, 2026

$400 to over $8,000 a year

Annual premium range

Insureon small-business customers, updated April 24, 2026

About $320 a year

Data breach coverage

The Hartford small-business customer average, updated February 25, 2026

Insureon’s median of $129 a month ($1,552 a year) is what its small-business customers actually paid: 41% pay under $100 a month and 26% pay $100–$200, usually for limits of $1 million to $5 million with a $1,000–$2,500 deductible. The Hartford’s $320 average is for its narrower data breach coverage, split into about $140 for first-party response expense and $128 for third-party defense and liability. A small office with little stored data should expect the low end; a firm holding client financial or health records, or one that needs $2 million or more in limits, should budget well above the median. Prices are easing: the Council of Insurance Agents & Brokers reported cyber premiums fell an average of 3.2% in the second quarter of 2026.

What moves your price

Limits and deductible: Insureon customers typically buy $1 million to $5 million.
Industry: Insureon reports IT businesses pay about $179 a month and finance and accounting firms about $59.
How much sensitive data you hold, such as Social Security, payment card or health information.
Number of employees, since each inbox is a phishing target.
Security controls: The Hartford says multifactor authentication, regular software updates and staff training can lower costs.
Which parts you buy, such as cyber extortion, business interruption or funds transfer cover.
Prior cyber incidents and claims.

Who it’s for

Who needs cyber liability insurance

An email that redirects a payment

Business email compromise drew 24,768 complaints and about $3.05 billion in reported losses in 2025, the FBI’s Internet Crime Complaint Center reports, second only to investment fraud. A spoofed vendor or owner email that changes wiring instructions is the classic small-business loss, and it is often covered only through an add-on.

Ransomware at a professional or trade firm

The FBI received more than 3,600 ransomware complaints in 2025. Among businesses outside critical infrastructure, legal services made up 18% of complaints and contracting services such as electricians and general contractors 17%. A cyber policy can pay for forensics, restoration, the extortion demand and lost income.

Customer records are exposed

Every state requires businesses to notify residents whose personal information is breached, according to the NCSL. Breach response coverage pays for the investigation, legal advice, notification letters and the credit monitoring the FTC suggests offering, costs that arrive before any lawsuit.

Clients sue or a regulator asks questions

Customers or clients whose data was exposed can sue for failing to protect it. Third-party cyber coverage pays defense costs, settlements and judgments, and The Hartford’s policy also responds to regulatory inquiries, including fines and defense.

Your other policies stay silent

The NAIC notes that most commercial property and general liability policies do not cover cyber risks. A business with only a business owner’s policy usually has no help paying for a breach, a ransom or the income lost while systems are down.

Coverage

What cyber liability insurance covers

Breach response

Pays incident response costs after a breach: legal advice, a forensic investigation, public relations, notifying affected customers and credit monitoring for them.

Cyber extortion and ransomware

Covers responding to an extortion threat, including negotiation and ransom payments. The Hartford writes extortion as a sublimit, so check how much of your limit applies.

Data recovery and system restoration

Pays to recover lost or corrupted data and restore a damaged computer system or network after a covered cyber event.

Business interruption

Replaces income lost while a cyber event or network outage stops your operations, and Insureon notes it can pay for extra staff or rented equipment to keep working.

Network security and privacy liability

Third-party coverage for lawsuits claiming you failed to protect someone’s data: legal defense, settlements and court-ordered judgments.

Regulatory defense and fines

Covers responding to a regulator’s inquiry after a breach. The Hartford’s policy includes regulatory fines and defense costs.

Funds transfer and social engineering fraud

Some policies, often through an add-on, cover money sent to a fraudster after a compromised email. Embroker notes these losses can be excluded if you lack callback verification procedures.

What it doesn’t cover

Incidents you knew about before the policy started.
Mistakes in your professional services, which professional liability covers.
Hardware damaged by fire, power surges or natural disasters.
Bodily injury and property damage claims, which general liability covers.
Employee claims of harassment, discrimination or wrongful termination, which EPLI covers.
Acts of war and many state-sponsored attacks.
Losses from illegal or fraudulent acts you knowingly commit.
Social engineering losses where the policy’s verification conditions were not met.

Rules

Requirements and filings

Breach notification laws set the deadlines and notices that a cyber policy’s breach response coverage pays to meet. The rules follow the people affected, so check each state where your customers live. These are examples, not a complete list.

Requirement	Applies to	What it means
State breach notification laws	Businesses holding personal information about residents of any state	All 50 states, DC, Guam, Puerto Rico and the Virgin Islands require notice to affected individuals, per the NCSL; definitions, timing and content vary by state.
Florida Statutes 501.171	Businesses holding Florida residents’ personal information	Notify individuals within 30 days of determining a breach; notify the Department of Legal Affairs within 30 days if 500 or more Floridians are affected.
Texas breach reporting to the Attorney General	Businesses whose breach affects 250 or more Texans	Report to the Texas Attorney General no later than 30 days after discovery and notify affected consumers, per the Attorney General’s office.
HIPAA Breach Notification Rule (45 CFR 164.404 and 164.408)	HIPAA covered entities such as health care providers and health plans	Notify individuals within 60 calendar days of discovery. Report breaches of 500 or more people to HHS at the same time; smaller breaches within 60 days after year-end.
FTC Safeguards Rule notification	Non-bank financial institutions such as tax preparers, mortgage brokers and collection agencies	Notify the FTC within 30 days of discovering a breach of unencrypted information on 500 or more consumers; in effect since May 2024.

Compare cyber liability insurance options.

One application, quotes from several insurers, reviewed by a licensed agent. Start with your email and finish later if you need to.

Pay less

How to lower the cost

Turn on multifactor authentication for email, VPN and admin accounts and keep software patched; the FBI recommends both, and The Hartford says such controls can lower costs.
Keep encrypted offline or immutable backups and test restoring them, as the FBI advises, so ransomware becomes a recovery rather than a ransom.
Require a phone callback to a known number before changing any payment instructions; it prevents losses and can keep funds transfer cover in force.
Hold less sensitive data: delete old records and avoid storing Social Security or full card numbers you do not need.
Choose a deductible you could pay during an outage; Insureon customers usually pick $1,000–$2,500.
Compare quotes, since cyber appetite varies widely. Florin is an independent broker that compares options from several insurers.

Before you start

What underwriters ask for

Annual revenue and number of employees.
How many records you hold and what kind: customer, payment card, health or Social Security data.
Security controls: multifactor authentication, backups, endpoint protection and patching.
How you approve wire transfers and changes to payment instructions.
Vendors that store or process your data, such as payment processors and cloud services.
Any past cyber incidents, ransom demands or claims.
Limits and terms your client contracts require.

Common questions

Cyber liability insurance: questions

Does general liability cover a data breach?

Usually not. The NAIC notes that most commercial property and general liability policies do not cover cyber risks, so breach costs need a cyber policy or a cyber endorsement.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays your own costs, such as forensics, notification, ransom and lost income. Third-party coverage pays when others sue you over a breach, covering defense, settlements and judgments.

Does cyber insurance pay a ransom?

Many policies do. The Hartford lists ransom payments and negotiations among covered cyber extortion costs, usually under a sublimit, so check how much of your limit applies to extortion.

How much cyber coverage does a small business need?

Insureon reports its customers usually buy $1 million to $5 million. Base the limit on how many records you hold, what a week offline would cost and any minimum your client contracts set.

How fast do I have to notify customers after a breach?

It depends on the law. Florida requires notice to individuals within 30 days, HIPAA within 60 calendar days and Texas a report to its Attorney General within 30 days when 250 or more Texans are affected. Ask counsel; breach response coverage typically pays for that advice.

Is cyber insurance tax deductible?

The Hartford says cyber premiums are generally deductible as a business expense, like other business insurance. Confirm with your tax adviser.

Get covered.

Tell us about your business once. We compare options and a licensed agent follows up, usually the same day.

Sources (15)

Figures are published third-party estimates, not quotes. Coverage depends on policy terms and underwriting, and rules vary by state. Updated October 2026.