Last updated: November 2026 · Reading time: about 13 minutes
What this guide covers
Why your general liability policy does not cover this
The most important thing to understand about cyber insurance is why it exists as a separate product. A standard general liability policy covers physical damage and bodily injury. A business owner’s policy covers physical property and some liability exposure. Neither was designed for the costs that follow a data breach, a ransomware attack, or a funds transfer fraud. Most explicitly exclude cyber losses .
That means a business that suffers a ransomware attack with only a general liability policy is on its own for the forensic investigation, the ransom negotiation, the system restoration, the breach notification, and any regulatory fines or third-party claims that follow. Those costs can reach six figures for a small business and well into seven figures for a mid-market company .
The exposure is not theoretical. 81% of small businesses reported a security or data breach in the last year, according to the Identity Theft Resource Center’s 2025 Business Impact Report . 63% of breached small businesses lost $250,000 or more . And 60% of small businesses that suffer a significant cyber incident close within six months .
Yet adoption remains low. Only 10% to 20% of SMEs carry a dedicated cyber policy . Among US business insurance buyers, 70% now carry cyber cover — but among small businesses in that group, only 50% do . Half of the small businesses that already buy commercial insurance and already talk to a broker still have no cyber cover .
What 2026 policies actually cover
Cyber policies are organised around two categories of coverage. Most standalone policies include both, but they are often subject to different limits and conditions within the same policy .
| First-party coverage (your losses) | Third-party coverage (what you owe others) |
|---|---|
| Breach response and forensics, including investigation and legal counsel | Network security and privacy liability, including defence and settlements when customers sue |
| Data and system restoration | Regulatory defence and fines, where the policy covers them |
| Business interruption — lost income while systems are down | PCI assessments and fines |
| Cyber extortion and ransomware | Media liability, such as defamation, copyright or trademark claims |
| Funds-transfer and social engineering fraud | |
| Public relations and crisis management costs | |
| Customer notification and credit monitoring |
Two of these come up more than any others for small businesses.
Business email compromise (BEC). Criminals take over or fake an email account and trick someone into sending money. The FBI logged $3.05 billion in BEC losses across 24,768 complaints in 2025, and the National Association of Insurance Commissioners says BEC drives a significant share of cyber claims . One insurer’s claim report put BEC and funds-transfer fraud at 60% of its claims, with an average claim of $15,000 .
Ransomware. The FBI received more than 3,600 ransomware complaints in 2025 with about $32 million in reported losses — a figure the FBI says is low because it excludes downtime and cleanup costs . In IBM’s 2026 study, 39% of breached organisations reported ransomware, and 41% of those attacks included threats to damage the company’s reputation . Average ransomware claims reached $269,000 in 2025, according to Coalition’s 2026 Cyber Claims Report .
The sublimit problem: your $1M limit is rarely $1M
This is the single most important thing to understand before buying a policy, and it is routinely underexplained at the point of sale.
A sublimit is a cap on what the insurer will pay for a specific type of loss, set below the overall policy limit. If your policy has a $1 million aggregate limit with a $250,000 sublimit on ransomware, your insurer will pay no more than $250,000 toward a ransom demand regardless of what the total limit says. The remaining $750,000 is still available for other covered losses, but it cannot be redirected to cover the gap on the sublimited line .
Sublimits exist because certain loss categories carry concentrated risk that insurers price separately. Ransomware, funds transfer fraud and social engineering have each generated enormous aggregate claim volumes, and sublimits let carriers offer broad policies at manageable premiums while controlling their exposure on the highest-frequency, highest-severity lines .
| Coverage line | Typical 2026 sublimit on a $1M policy | Why it matters |
|---|---|---|
| Ransomware and cyber extortion | Often $250,000 or less; some policies apply the sublimit only to the ransom payment, others to the full event including restoration | Average ransomware claims reached $269,000 in 2025 — the sublimit may be below the average claim |
| Funds transfer fraud / social engineering | Around $250,000 on most policies | Actual losses frequently exceed the sublimit, especially with AI-generated voice cloning and deepfakes |
| Business interruption (dependent) | Often restricted to IT-related third parties with shared computer systems | A SaaS vendor ransomware attack that halts payroll for three weeks may not be covered |
Three questions to ask on any quote:
- Does the ransomware sublimit apply only to the ransom payment, or to the full event including restoration? The difference matters enormously when systems are down .
- Is there a separate sublimit on cyber extortion threats beyond file encryption, such as threats to publish stolen data?
- When was the sublimit last reviewed against current average ransom demands in my industry? A policy purchased when ransomware demands were lower may carry a sublimit that no longer reflects the threat .
The exclusions that deny claims
Over 40% of cyber insurance claims in 2026 result in no payout, and exclusions are the most common reason . These are the ones a US small business is most likely to encounter.
1. Prior known incidents and circumstances
If you knew about a security incident, breach or vulnerability before the policy’s inception date and did not disclose it, your claim can be denied. “Prior known” does not only mean a confirmed breach — an open phishing investigation, a ransomware event you thought you contained, or a third-party notification about stolen credentials can all qualify .
What to do: before binding or renewing, conduct an honest review of any open security issues, incidents in the past 12 to 24 months, and third-party notifications. Disclose proactively. Non-disclosure is the fastest path to a denied claim .
2. Failure to maintain security controls
Carriers underwrite the policy based on the security posture you represent at application. If you attest that you have MFA enforced on all remote access and admin accounts, and a claim arises from an account that lacked MFA, coverage may be denied or significantly reduced. Carriers increasingly use external scan data and post-loss forensics to verify that the controls you attested to were actually in place .
Common misrepresentation issues: MFA, EDR deployment, RDP exposure, patch management, and immutable backup status . Treat your cyber insurance application as a binding representation of your security posture, not a checkbox .
3. Known unpatched vulnerabilities
Policies increasingly exclude incidents attributable to known vulnerabilities that the insured had reasonable grounds to patch. If a breach exploits a CVE that was publicly disclosed and patchable six months before the incident, coverage may be denied. This makes patch management a direct insurance obligation, not just a security best practice .
4. Nation-state and war exclusions
Most policies exclude attacks attributed to nation-state actors, and war exclusions have been tightened across the market . This is a material gap for any business whose supply chain touches critical infrastructure or defence-adjacent sectors.
5. Third-party vendor incidents
One of the most common gaps is a service provider’s breach disrupting your operations. Cyber policies may restrict dependent business interruption coverage to IT-related third parties with shared computer systems, rather than extending broadly to all supply chain vendors. If your cloud payroll provider is hit and payroll stops for three weeks, the policy may not respond .
6. Emerging AI exclusions
Carriers are actively adding AI-related endorsements, exclusions and sublimits. Review policy language across all applicable lines for AI-related limitations that could create coverage gaps . This is a moving target in 2026 and worth asking about directly at renewal.
What underwriters require in 2026
The underwriting bar has risen sharply. After $7.8 billion in cyber claims paid in 2025, insurers tightened requirements, and 73% of small businesses now fail their cyber insurance assessment — either receiving outright denials or penalty pricing more than 300% above market .
The controls that now determine whether you qualify are not optional:
| Control | Why underwriters require it |
|---|---|
| Multi-factor authentication (MFA) | No longer a discount lever — a mandatory prerequisite. Absence is a denial or surcharge trigger . |
| Endpoint detection and response (EDR) | Deployed on all devices; carriers scan applicants before issuing quotes . |
| Tested, immutable backups | Backups must be tested and immutable, not merely present . |
| Patch management | Known unpatched vulnerabilities are an exclusion, so patching is a coverage condition . |
| Documented security training | Required for qualification and increasingly verified at claim stage . |
Businesses with MFA on all accounts, EDR on all devices, and tested backup and recovery procedures qualify for materially better rates — the difference can be 20% to 30% on the annual premium . The gap between a prepared business and an unprepared one is now reflected in premiums that differ by 300% to 500% for identical coverage limits .
What small businesses actually pay
Premiums are more accessible than most owners expect, but the range is wide because industry, revenue and security controls all move the price.
| Business size | Annual revenue | Typical annual premium | Typical monthly cost |
|---|---|---|---|
| Micro business | Under $1M | $500 – $1,500 | $42 – $125 |
| Small business | $1M – $5M | $1,200 – $3,000 | $100 – $250 |
| Small business | $5M – $10M | $2,500 – $5,000 | $210 – $415 |
| Lower mid-market | $10M – $25M | $5,000 – $12,000 | $415 – $1,000 |
The median small business cyber premium runs approximately $134 to $145 per month based on Insureon and TechInsurance data . A $1 million policy for a very small business with minimal customer data and basic controls can be obtained for roughly $52 to $80 per month .
Industry moves the price independently of revenue. Healthcare-adjacent businesses, financial services firms and technology companies pay more than professional services, retail or trades at the same revenue level because of data sensitivity, regulatory exposure and claims frequency .
How to read a policy before you sign
Five checks, in this order. The first three determine whether the policy will actually pay.
- Find every sublimit. Ask for the schedule of sublimits, not just the declarations page. Ransomware, funds transfer fraud, social engineering and dependent business interruption are the four lines most likely to be capped below the headline limit .
- Read the exclusions section line by line. Confirm the policy’s position on prior known incidents, known unpatched vulnerabilities, nation-state attacks, third-party vendor incidents and AI-related losses .
- Match your security posture to your application. Every control you attest to — MFA, EDR, backups, patching — is a coverage condition. If forensics finds a gap between what you represented and what was in place, the exclusion applies .
- Confirm the incident response access. The policy limit is only part of the value. Immediate access to the carrier’s pre-approved forensics firms and breach counsel is where coverage proves its worth — but only if you know how to activate it. Test the contact list before you need it .
- Check whether a contract requires it. A growing number of customer contracts, lender requirements and vendor questionnaires ask for proof of cyber coverage before a deal closes. The decision may already have been made for you by a procurement team .
If any of the first three checks produces an unclear answer, do not bind. A policy that pays $250,000 on a $1 million limit, or denies a claim because an unpatched CVE was exploited, is not the coverage you thought you bought.
Frequently asked questions
Does general liability insurance cover cyber attacks?
No. General liability covers physical damage and bodily injury. Business owner’s policies cover physical property and some liability. Neither was designed for data breach, ransomware or funds transfer fraud, and most explicitly exclude cyber losses . Standalone cyber insurance is the only coverage structure designed for these losses.
How much does cyber insurance cost for a small business in 2026?
Micro businesses under $1M in revenue typically pay $500–$1,500 per year. Businesses with $1M–$5M in revenue pay $1,200–$3,000. The median small business premium is approximately $134–$145 per month . A basic $1 million policy can start around $52–$80 per month for a very small business with minimal data and strong controls .
Why did my cyber claim pay less than my policy limit?
Because of a sublimit. A $1 million policy may cap ransomware at $250,000 and funds transfer fraud at a similar figure. The remaining limit is available for other covered losses but cannot be redirected to the sublimited line . This is the most common and most preventable coverage surprise in cyber insurance .
What are the most common exclusions in cyber insurance?
Prior known incidents, failure to maintain the security controls you attested to, known unpatched vulnerabilities, nation-state and war attacks, third-party vendor incidents outside IT with shared systems, and increasingly AI-related losses . Over 40% of 2026 claims result in no payout, and exclusions are the most common reason .
Can I get cyber insurance without MFA or EDR?
You can apply, but you are likely to be denied or charged a penalty premium of 300% or more. MFA, EDR, tested immutable backups and patch management are now mandatory prerequisites rather than discount levers. 73% of small businesses fail their cyber insurance assessment in 2026 .
Does cyber insurance cover ransomware payments?
It can, but three limits apply. First, ransomware is almost always sublimited. Second, paying a ransom is legally complex — US OFAC sanctions apply to payments to certain threat actor groups, and legal counsel is essential before any payment decision . Third, some policies cover the ransom payment but not the full remediation event, or vice versa .
Does cyber insurance cover business email compromise?
Most policies include BEC and funds transfer fraud, but usually under a sublimit around $250,000 — and actual losses frequently exceed that threshold . BEC accounted for $3.05 billion in FBI-reported losses in 2025 , and one insurer reported BEC and funds transfer fraud at 60% of its claims . Check the sublimit, not just the coverage grant.
Is cyber insurance worth it for a very small business?
If the business stores customer data, processes payments, uses business email, or depends on cloud software, the exposure exists regardless of size. 81% of small businesses reported a breach in the last year, and 60% of those that suffer a significant incident close within six months . The relevant question is not whether the risk exists, but whether the policy’s sublimits and exclusions match the losses the business is most likely to suffer.
Related reading on Dedon Tech: InsurTech vs traditional insurance: what actually matters for UK policyholders · AI in insurance: what it actually does to your premium and claim · best telematics car insurance for UK young drivers · full site map
0 Comments: