Cyber liability insurance pays for the costs a small business faces after a data breach, ransomware attack or similar incident: forensic investigators, legal advice, notifying customers, lost income while systems are down, and lawsuits or regulatory claims from people whose data was exposed. Standard business liability policies are not built for these losses, so cyber is bought as its own policy or endorsement. What it pays depends heavily on the wording, because cyber policies are far less standardised than other business lines.
Why a general liability policy is not enough
The NAIC’s small business insurance guide lists cyber liability as a separate coverage that “covers web-based businesses for damages caused by computer hackers and viruses,” distinct from commercial general liability. A general liability policy is built around bodily injury and physical property damage. Lost data, a frozen network and a customer notification bill are not physical damage, and most modern general liability forms add exclusions for data-related claims.
The scale of the threat is documented. The FBI’s 2024 Internet Crime Report recorded 859,532 complaints and $16.6 billion in reported losses, a 33 percent increase from 2023. Business email compromise alone accounted for 21,442 complaints and about $2.77 billion in losses, and ransomware generated 3,156 complaints. Those are reported incidents only; many go unreported.
What cyber liability insurance covers
The Federal Trade Commission’s small business page on cyber insurance splits cover into two halves, and it is the clearest way to read a quote.
| First-party (your own costs) | Third-party (claims against you) |
|---|---|
| Legal counsel to determine notification and regulatory obligations | Payments to consumers affected by the breach |
| Recovery and replacement of lost or stolen data | Claims and settlement expenses from disputes or lawsuits |
| Customer notification and call center services | Losses related to defamation and copyright or trademark infringement |
| Lost income due to business interruption | Costs for litigation and responding to regulators |
| Crisis management and public relations | Other settlements, damages and judgments |
| Cyber extortion, including ransomware, and fraud | Accounting costs |
| Forensic services to investigate the breach | |
| Fees, fines and penalties related to the incident |
The FTC suggests discussing with your agent whether you need first-party coverage, third-party coverage, or both. A shop that takes card payments, a clinic holding health records and a consultant who handles client files each have different weightings. “Fines and penalties” in particular are insurable only where the law allows, so read how your policy words that line.
Ransomware and extortion
The NAIC’s ransomware topic page says many policies cover ransom payments, extortion-related expenses and repair costs, but insurers “may impose limits on ransom coverage.” It also warns that insurers “typically require notification prior to payment; failure to comply may result in denial of coverage.” Paying first and asking later can cost you the claim.
There is a legal layer too. The Treasury Department’s Office of Foreign Assets Control issued an updated advisory on September 21, 2021, highlighting the sanctions risks of ransomware payments. That is one reason insurers and their response firms control the process rather than leaving it to you.
What cyber policies commonly exclude or limit
Exclusions vary by insurer. These are the areas to read most carefully, because they are where claims are most often disputed:
📨 Get Free Business Insurance Guides Alerts
Free · No spam · Unsubscribe anytime
- Social engineering and funds transfer fraud. A staff member tricked into wiring money is a business email compromise loss. Many policies cover it only by endorsement, with a sublimit lower than the main limit.
- Failure to maintain security controls. If your application said you used multi-factor authentication or kept backups and you did not, the insurer may contest the claim.
- Prior known incidents. A breach that began before the policy started, or that you knew about, is usually excluded.
- Vendor and cloud outages. Cover for an incident at a provider holding your data is not automatic. The FTC tells buyers to make sure the policy includes attacks on data held by vendors.
- War and state-sponsored attacks. Wording here changed across the market in recent years; the FTC suggests asking about terrorist acts specifically.
- Improving your systems afterwards. Restoring what you had is typically covered; upgrading it is not.
- Bodily injury and physical damage. Usually left to other policies.
Questions the FTC says to ask
The FTC lists questions to put to an insurer. Use them as a checklist when comparing quotes:
- Does the policy cover data breaches?
- Does it cover attacks on data held by vendors and other third parties?
- Does it cover network breaches and attacks anywhere in the world, not just in the United States?
- Does it cover terrorist acts?
- Will the insurer defend you in a lawsuit or regulatory investigation (look for “duty to defend” wording)?
- Does it provide coverage in excess of other applicable insurance you carry?
- Is there a breach hotline available every day of the year at all hours?
What underwriters will ask you
Applications for cyber cover focus on controls, because controls drive losses. No public government source sets a standard list, but expect questions about:
- Multi-factor authentication on email, remote access and admin accounts.
- Offline or separated backups, and whether you test restoring them.
- Software patching and supported operating systems.
- How many records you hold, and of what type (card data, Social Security numbers, health information).
- Staff training on phishing, and a call-back rule before changing payment details.
- An incident response plan.
CISA’s Cyber Essentials is written for leaders of small businesses who need to know where to start, and it maps well onto these questions. Answer the application accurately; an inaccurate answer is a common reason for a denied claim.
Limits, sublimits and retentions
A cyber quote usually shows an aggregate limit for the policy year, then separate sublimits for particular costs. Ransom, social engineering fraud, regulatory fines and business interruption are the lines most often capped below the headline number. A policy advertised at one limit can pay far less for the loss you actually suffer if that loss falls under a sublimit.
The retention is the amount you pay before the insurer contributes, similar to a deductible. Business interruption cover often adds a waiting period, measured in hours, before lost income counts. Read all three numbers together: the limit, the sublimit for the cost you fear most, and the retention or waiting period that applies to it. If the quote doesn’t show them on one page, ask the agent to list them in writing.
What it costs
No reliable public figure exists for a typical small-business cyber premium. Cyber policies differ widely in structure, and price is driven by revenue, industry, the number and type of records held, controls in place, the limit and retention you choose, and claims history. Our guide to what business insurance costs explains how those rating factors interact, and our guide to reading a business insurance quote shows where sublimits hide.
Before you need it
Write the insurer’s breach hotline number into your incident plan now, next to your IT contact, because many policies expect you to call the insurer before hiring your own responders. If an incident does happen, our small business data breach checklist walks through the first steps in order. A licensed agent or your state insurance department can explain how cyber products are regulated in your state.