Last Updated on October 16, 2026 by Syed Sarim Naqvi
Cyber liability insurance pays for the costs of a data breach, ransomware attack or funds-transfer fraud, combining first-party cover for your own losses with third-party cover for claims from customers and regulators. Reported small-business averages run from about $129 a month ($1,552 a year) at Insureon to $145 a month ($1,740 a year) in other guides, and the exclusions, not the limit, decide whether a claim is paid.
Key Takeaways
- First-party cover pays your own breach response, recovery and extortion costs, while third-party cover pays claims others bring against you
- Insureon reports an average of $129 a month ($1,552 a year), with 41% of customers paying under $100 a month, while other guides cite $145 a month ($1,740 a year) for $1 million of cover
- Broker ranges are wide: $500 to $2,500 a year at Heffernan and $500 to $5,000 attributed to Insureon by Nav
- Standard business owner’s policies often exclude cyber incidents or add only a thin endorsement
- Policies commonly exclude losses from known vulnerabilities and negligence, so security controls matter
What Is Cyber Liability Insurance?
Nav describes cyber insurance, also sold as cyber liability or cybersecurity insurance, as a business policy that pays for the costs of a cyberattack or data breach, including breach response, business interruption and liability to customers and regulators. Heffernan Insurance Brokers adds that it protects against incidents such as hacking, ransomware, data breaches and business email compromise. Insureon notes that first-party cover is sometimes sold on its own as data breach insurance.
What Do First-Party and Third-Party Cover Pay For?
| Type | What It Covers |
|---|---|
| First-party (your losses) | Breach response and forensics, legal counsel, data recovery, extortion and ransomware payments, PR and business interruption |
| Third-party (what you owe others) | Legal fees, settlements and regulatory fines when a customer or authority sues you after a breach |
The table follows Merchant Maverick’s breakdown. Insureon adds that first-party cover sometimes includes media liability, and that third-party cover can be combined with an errors and omissions policy into technology E&O. TechInsurance says first-party cover is recommended for most small businesses, while third-party cover is designed more for tech professionals who handle cybersecurity or recommend software to clients.
How Much Does Cyber Insurance Cost?
Insureon reports that its small business customers pay an average of $129 a month, or $1,552 a year, with 41% paying under $100 a month and 26% paying between $100 and $200. Merchant Maverick and Windes cite around $145 a month, or $1,740 a year, for $1 million of coverage. Heffernan says most small businesses pay between $500 and $2,500 a year, and Nav lists Insureon at $500 to $5,000 a year, noting that a $1 million policy may run roughly $50 to $200 or more per month. Because the figures differ by method and provider, treat them as ranges. As an illustration only, $129 a month adds up to about $1,548 over twelve months, which matches Insureon’s $1,552 annual figure.
- Industry and data handled: a Beancount analysis suggests $1,000 to $2,000 a year for lower-risk trades versus $2,500 to $5,000 for professional services, healthcare or firms holding sensitive client data, for the same $1 million limit
- Revenue and location: Nav says Insureon reports revenue and location affect cost
- Controls and size: Windes says businesses under 50 employees average about $1,740 a year
Is a Business Owner’s Policy Enough?
Generally not. Beancount explains that standard BOPs either exclude cyber incidents outright or bolt on a thin cyber endorsement with a ceiling far below the cost of an actual breach, and that many owners wrongly assume general liability already covers this. Insureon positions cyber as a separate policy, which is why reading the endorsement limits matters before you rely on any add-on.
What Is Not Covered?
Heffernan says cyber liability policies generally exclude certain losses, and urges buyers to review limits and exclusions before signing. Windes warns that exclusions can void coverage for known vulnerabilities and negligence, for example failing to patch software or ignoring required controls. Beancount also says ransomware coverage is not automatic even with a policy, so confirm that extortion payments and restoration costs are included.
Who Needs It?
Nav says many small businesses need it, especially those that handle payment data, personal information or client records, and asks whether your business could absorb the cost of an incident on its own. Merchant Maverick lists the same test: consider cyber cover if your business stores sensitive data, relies on online systems or processes payments.
How Does This Connect to the Rest of Specialty Insurance?
Cyber cover sits beside the other business policies in this series. See the AI-fraud angle in Deepfake Insurance Explained, the professional-error side in Professional Liability (E&O) Insurance Explained, and income protection in Business Interruption Insurance Explained. For related personal exposures, read Identity Theft Insurance Explained, and for brand damage after an incident, Reputational Risk Insurance Explained.
FAQ
What is cyber liability insurance?
Cover for the costs of a cyberattack or data breach, including response, recovery, extortion and claims from customers and regulators.
What is the difference between first-party and third-party cyber cover?
First-party pays your own losses; third-party pays claims others bring against you.
How much does cyber insurance cost for a small business?
Reported averages run from about $129 to $145 a month, with broker ranges of $500 to $2,500 or more a year.
Does a business owner’s policy cover cyberattacks?
Often not. Many BOPs exclude cyber incidents or include only a small endorsement.
Does it cover ransomware?
Many policies include extortion and ransomware cover, but it is not automatic, so confirm it in the wording.
What can void coverage?
Exclusions for known vulnerabilities and negligence, such as unpatched systems, can lead to denied claims.
What is tech E&O?
A policy combining third-party cyber cover with errors and omissions insurance, used by technology professionals.
Glossary
- First-Party Coverage: cover for your own costs after a cyber incident.
- Third-Party Coverage: cover for claims others bring against you.
- Ransomware: malware that locks data until a payment is made.
- Business Email Compromise: fraud where attackers impersonate a trusted party to redirect payments.
- Tech E&O: combined technology errors and omissions and cyber liability cover.
- Breach Response: forensics, notification and legal costs after a breach.
Sources
- Nav: What Is Cyber Insurance for Small Businesses? (definition, cost ranges, who needs it)
- Insureon: Cyber Insurance FAQ (average cost, first-party versus third-party, tech E&O)
- Merchant Maverick: The Complete Guide to Cybersecurity Insurance for Small Business (coverage table, average cost)
- TechInsurance: Cyber Liability Insurance (average cost, who needs third-party cover)
- Heffernan Insurance Brokers: Cyber Liability Insurance for Small Business (cost range, exclusions)
- Windes: Cyber Liability Insurance, Cost, Coverage and Necessities (average cost for under 50 employees, exclusions)
- Beancount: Cyber Insurance for Small Businesses, The Coverage Gaps (BOP gaps, ransomware, industry pricing)
Related reading: Product Liability Insurance Explained · Workers’ Compensation Insurance Explained · Key Person Insurance Explained
Published October 2026. Prices, limits and exclusions vary by insurer and industry and change often; always read the ransomware wording and security-control exclusions, and refresh this article periodically.
Leave a Reply