Cyber Liability Insurance for Small Businesses: What It Covers

A ransomware attack locks your files on a Monday morning. Your bookkeeper wires $40,000 to a “vendor” whose email was spoofed. A laptop with customer records goes missing. For a small business, any of these can mean weeks of disruption, legal bills and notification costs that a general liability policy usually won’t touch.

Cyber liability insurance exists to cover those costs. But policies vary widely, and the exclusions matter as much as the coverage. This guide explains what cyber insurance covers, what it often doesn’t, how to choose the right type of policy and what insurers expect from you before they’ll offer coverage.

This is general information, not legal or insurance advice. Policy wording controls what’s covered, so read your specific policy and work with a licensed agent or broker.

What cyber liability insurance is

Cyber liability insurance, often just called cyber insurance, covers financial losses from cyber incidents and data breaches. That includes attacks like ransomware, business email compromise and hacking, as well as accidental incidents like a lost device or misdirected email containing personal data.

Most cyber policies combine 2 kinds of protection, as the FTC’s small business guidance explains:

• First-party coverage pays for your own losses and response costs.
• Third-party coverage protects you when customers, partners or regulators make claims against you.

Strictly speaking, “cyber liability” refers to the third-party side, but in everyday use the term covers the whole package.

What first-party and third-party coverage include

Some policies also offer social engineering or funds transfer fraud coverage, dependent business interruption (when a vendor you rely on gets hit) and bricking coverage for hardware that becomes unusable after an attack. These are often optional and may carry lower limits.

Common exclusions and gaps

The fine print is where small businesses get surprised. Common exclusions and limits include:

• Social engineering and wire fraud. The NAIC’s 2026 report on the cyber insurance market advises buyers to check whether social engineering and funds transfer fraud are excluded, subject to a sublimit or handled under a separate crime policy. Since business email compromise is one of the most common ways small businesses lose money, this gap matters.
• Failure to maintain security. Some policies limit or deny coverage if you didn’t keep up the security controls you described on your application, such as multifactor authentication or backups.
• War and state-backed attacks. Lloyd’s of London required its syndicates to include exclusions for state-backed cyberattacks in standalone cyber policies starting March 31, 2023, and many other insurers have revised similar wording. How these clauses apply to a given attack depends on the policy.
• Prior known incidents. Breaches that started before the policy began, or that you knew about, are usually excluded.
• Infrastructure failures. Outages of power grids, internet backbone or telecom providers are often excluded.
• Betterment. Policies typically restore systems to their prior state, not pay for upgrades.
• Bodily injury and property damage. Usually excluded from cyber policies and handled by other insurance.
• Intentional acts. Deliberate wrongdoing by owners or executives is generally excluded.
• Sublimits. Specific coverages, such as ransomware or regulatory fines, may have limits far below the headline policy limit.

Key takeaway: Read the exclusions and sublimits before you compare prices. A cheaper policy that excludes wire fraud or caps ransomware at a fraction of the limit may leave your biggest risks uncovered.

Standalone policy vs add-on endorsement

You can buy cyber coverage in 2 main ways:

For very small businesses with little customer data, an endorsement may be a reasonable start. Businesses that store sensitive data, take card payments, depend on systems to operate or handle health or financial information usually need a standalone policy.

Also check how your cyber policy fits with your other insurance. General liability usually excludes data breaches, and a separate commercial crime policy may be the better home for funds transfer fraud.

What insurers require before covering you

Underwriters have become much more selective. Many now expect a set of baseline security controls before they’ll quote, and some will decline or limit coverage without them. Common requirements include:

• Multifactor authentication on email, remote access and admin accounts
• Endpoint detection and response on computers and servers
• Regular backups stored offline or immutable, and tested
• Prompt patching of critical vulnerabilities
• Email filtering and employee phishing training
• A written incident response plan

We cover each control, what “yes” really means on the application and how to document it, in our guide to cyber insurance requirements. For a broader baseline, see our small business cybersecurity checklist.

Answer applications accurately. Overstating your controls can give an insurer grounds to deny a claim later.

How cyber insurance is priced

Premiums depend on your industry, revenue, the amount and type of data you hold, your security controls, claims history and the limits and deductible you choose. Prices vary widely, so get quotes rather than relying on averages.

The market has shifted in buyers’ favor recently. The NAIC’s 2026 report found that cyber prices continued to decline in 2025 even as the number of claims rose, and it noted that many small and midsize businesses still don’t have coverage. Strong security controls remain the best lever for better terms.

When comparing quotes, look at:

• Aggregate limit and any sublimits for ransomware, social engineering and regulatory fines
• Retention (deductible) and any waiting period before business interruption coverage starts
• Panel requirements: whether you must use the insurer’s lawyers and forensics firms
• Duty to defend: the FTC suggests asking whether the insurer will defend you in a lawsuit or regulatory investigation
• 24/7 breach hotline access
• Retroactive date for incidents that started before the policy

What to do if you have an incident

1. Call the insurer’s breach hotline first, before hiring your own vendors. Many policies require you to use approved providers to be covered.
2. Don’t pay a ransom or negotiate without guidance from the insurer and breach counsel.
3. Preserve evidence: don’t wipe machines before forensics.
4. Follow notification deadlines under state breach laws and any industry rules, such as the FTC Safeguards Rule for covered financial businesses.
5. Document costs for your claim.

Our guide on what to do if your business is hacked walks through the first 24 hours.

Where to start: buying cyber coverage in 6 steps

1. List your risks. What data do you hold, how long could you operate without your systems, and how do you move money?
2. Check existing policies for any cyber endorsements and what they exclude.
3. Put core controls in place: MFA, endpoint protection, tested backups and patching. See our guide to ransomware protection.
4. Work with a broker who places cyber coverage regularly and can compare wording, not just price.
5. Compare exclusions and sublimits side by side, especially social engineering, ransomware and regulatory coverage.
6. Review every year as your business, data and the insurance market change.

Conclusion

Cyber liability insurance can be the difference between a bad week and a business-ending event. A good policy pays for incident response, data recovery, notification, lost income and the lawsuits or regulatory actions that may follow. The value lies in the details: know your exclusions and sublimits, choose between an endorsement and a standalone policy based on your real risk, and keep the security controls insurers expect. Insurance helps you recover, but it doesn’t replace good security.

This is general information, not legal or insurance advice. Coverage depends on the exact policy wording, so review it with a licensed broker.

Sources

• FTC: Cyber Insurance (Cybersecurity for Small Business) — first-party and third-party coverage and questions to ask insurers
• NAIC: 2026 Report on the Cybersecurity Insurance Market — 2025 pricing and claims trends, endorsements vs standalone policies, social engineering and funds transfer fraud exclusions
• Lloyd’s Market Bulletin Y5381: State backed cyber-attack exclusions — requirement for state-backed attack exclusions from March 31, 2023