Cyber Insurance for Small Business: Cost, Coverage and Requirements (2026)

Ordered by yearly cost (our arithmetic for monthly prices). Each figure is the insurer’s own published starting price or customer average, checked October 24, 2026; none is a quote for your business. ERGO NEXT says its starting prices reflect active policies as of April 1, 2026, and The Hartford calls its figures estimates.

Coverage gaps small businesses should check

Small business cyber policies most often fall short on limits, patching conditions and sub-limits, so check those before you compare prices. Cyber insurance pays for your own costs after an attack (first-party) and for claims against you (third-party); our guide to what cyber insurance covers lists both sides.

• Low limits on add-ons: ERGO NEXT’s add-on tops out at $250,000.
• Patching conditions: Chubb’s Neglected Software Exploit Endorsement gives 45 days to patch a published vulnerability, after which you carry more of the loss.
• Sub-limits: The Hartford sells extortion cover as a sub-limit.
• The FTC’s checks: “duty to defend” wording, a breach hotline open around the clock, and cover for your data held by vendors.

Read the policy wording for each of these, and ask a licensed agent what it means for your business.

Cyber insurance for small business: what it costs

Cyber insurance premiums for small businesses range from about $400 to over $8,000 a year among Insureon’s customers, whose figures come from policies sold to about 100,000 small business owners, most with fewer than five employees. Among its customers, 41% pay less than $100 a month.

• Industry: IT businesses pay an average of $179 a month and finance businesses $59, per Insureon.
• Deductible: typically $1,000 to $2,500 for Insureon customers; a higher deductible means a lower premium.
• Coverage parts: The Hartford’s average annual premiums are $140 for response expense (first-party), $128 for defense and liability (third-party) and $9 for an extortion sub-limit.
• Limits, revenue and data held: higher limits, more revenue and more sensitive records all raise the price.

Cyber insurance requirements

Cyber insurance requirements center on five controls: multifactor authentication (MFA), regular backups, endpoint detection and response (EDR), consistent patching and employee training. The Hartford says insurers often look for exactly these. Coalition lists MFA, security training, good backups, identity and access management, and limiting each user’s access to what the job needs as its five essential requirements, with antivirus or EDR, firewalls and strong passwords as further checks that can win better rates.

Expect the application to ask where MFA is turned on (email, remote access, admin accounts), whether backups are kept offline and tested, and how fast you patch. Our 10-step small business security guide covers MFA, backups and updates.

Cyber liability insurance vs a cyber add-on

A cyber add-on (an endorsement on another policy) is cheaper than a standalone cyber liability policy because it carries much lower limits. ERGO NEXT’s add-on starts at $4 a month with limits up to $250,000, while Insureon says standalone cyber policies typically carry limits of $1 million to $5 million.

Endorsements are now the most common form: the NAIC found that cyber endorsements to other commercial policies make up nearly two-thirds of the 5.84 million US cyber policies in force in 2025. ERGO NEXT lists businesses that take card payments or store sensitive client data among those that need cyber cover most. Whether an add-on’s limit is enough for yours is a question for a licensed agent.

Do small businesses need cyber insurance?

Whether a small business needs cyber insurance depends on its contracts, data and risk, but the losses these policies cover are common. The FBI’s IC3 received 24,768 business email compromise complaints in 2025, with $3.05 billion in reported losses, and 3,611 ransomware complaints with $32.3 million in losses, a figure IC3 says leaves out lost business and recovery costs. Insurers reported 56,323 cyber claims in 2025, up 20% on the year, according to the NAIC.

Check your client contracts too: Progressive notes that some partner contracts require set coverage limits. Whether you need a policy, and how much cover, is a question for a licensed insurance agent who has seen your contracts and data.

Where small businesses buy cyber insurance

Small businesses buy cyber insurance online direct, through a marketplace, or from a carrier through an agent. Listed A to Z within each channel, unranked:

Get at least two quotes with the same limit and deductible so the prices compare. If an insurer or client asks for a security test, our guide to penetration testing services compares firms by published price.