2026-04-11 · business, cyber
Updated: 2026-10-29
By InsuraFAQ Editorial Team · Reviewed for accuracy
Cyber Insurance
At a glance
Cyber insurance is commercial coverage that can help a business manage losses from a cyber incident. What is covered—and what is excluded—depends on the policy wording, limits, and endorsements.
- What it is: coverage a business can evaluate alongside its other policies and its incident-response plan.
- What it can cover: first-party incident costs and third-party liability, if the policy includes them and subject to its terms.
- What to compare: covered events, exclusions, sublimits, deductibles, defense language, and required security practices.
- Who may consider it: a business that holds sensitive information or relies on connected systems should assess its exposure with an insurance professional.
- Price: premiums and availability depend on the applicant and the insurer; obtain current quotes rather than relying on a general estimate.
Key takeaways
- Cyber insurance can help with cyber-incident losses, but the policy—not a general description—determines the result.
- The NAIC and FTC distinguish first-party coverage for a business’s own incident costs from third-party coverage for claims brought by others.
- Review limits, sublimits, exclusions, deductibles, and any security representations before buying or renewing.
- Security practices such as MFA can reduce account-compromise risk, but they do not guarantee insurance eligibility or coverage.
- Have an agent, broker, or qualified coverage adviser compare the cyber terms with your existing policies.
Overview
Cyber insurance is commercial coverage a business can use to manage some costs of a cyber incident. The National Association of Insurance Commissioners (NAIC) and Federal Trade Commission (FTC) recommend discussing whether first-party coverage, third-party coverage, or both fit the business’s needs. Their cyber-insurance guide lists questions to use when comparing coverage.
A policy is not a replacement for incident prevention or response planning. CISA explains that multifactor authentication (MFA) adds a second or additional authenticator beyond a password and can reduce the risk of unauthorized account access. Read CISA’s MFA guidance.
Use the declarations, insuring agreements, definitions, exclusions, endorsements, and application answers—not a checklist from another policy—to decide what protection you have.
What Cyber Insurance Covers
Cyber policies may address first-party coverage (costs your business incurs directly) and third-party coverage (liability to outside parties). Whether either applies, and the limits, sublimits, deductible, and conditions that apply, come from the specific contract. The NAIC and FTC recommend asking an insurer or broker about the policy’s coverage and exclusions before buying it.
First-Party Coverage
- Breach response costs. Forensics to figure out what happened, legal counsel to guide the response, and help meeting notification requirements.
- Data recovery. The expense of restoring data, rebuilding systems, and replacing compromised software or hardware where covered.
- Business interruption. Lost income and extra operating expenses while systems are down after a covered event.
- Ransomware and cyber extortion. Ransom payments (where legally permissible), negotiation support, and related response costs. Terms and conditions vary by policy.
- Notification and credit monitoring. The cost of notifying affected individuals and providing identity monitoring services, where included in the policy.
Third-Party Coverage
- Privacy and network security liability. Defense and damages when affected customers, employees, or partners sue over a breach.
- Regulatory defense and penalties. Legal costs and, where insurable, fines tied to privacy laws such as HIPAA, state breach notification statutes, or international rules like GDPR.
- Payment card industry (PCI) fines and assessments. Some policies respond to PCI DSS penalties after a card data compromise.
- Media liability. Claims arising from content a business publishes online, such as defamation or intellectual property infringement.
Crisis Management and PR
Some policies include funds for crisis communications, public relations, and call center support. Check the policy for the applicable terms and limits.
Common Exclusions
Cyber policy exclusions and conditions differ substantially. When comparing a form, ask the insurer or broker to identify how it treats the following areas rather than assuming a standard answer:
- Known vulnerabilities left unpatched. If your organization knew about a critical vulnerability and did not act on it, the insurer may deny the claim.
- Prior incidents discovered after the policy begins. Losses traced to a breach that occurred before the policy’s retroactive date are typically excluded.
- Acts of war and nation-state attacks. War exclusions have become a more contested area as insurers adjust their language in response to state-sponsored activity. Read this clause carefully.
- Social engineering and wire transfer fraud. Many policies exclude or sublimit funds transfer fraud unless you add a specific endorsement.
- Failure to maintain security standards. Not keeping agreed-upon controls (for example, multi-factor authentication or backups) can limit or void coverage.
- Bodily injury and property damage. These losses usually belong under general liability or property policies, not cyber.
Always compare exclusions and endorsements when you shop, and do not assume two policies behave the same way just because they both say “cyber.”
Who Needs Cyber Insurance?
Cyber insurance is relevant for almost any business that uses a computer, stores customer information, or depends on the internet to operate. That includes organizations most people would not immediately think of as “tech companies”:
- Retailers and e-commerce sellers that process card payments and store customer records.
- Healthcare providers, clinics, and practices that handle protected health information under HIPAA.
- Professional services firms (accountants, law firms, architects, consultants) that store sensitive client documents and often handle wire transfers.
- Nonprofits, schools, and municipalities that hold donor, student, or citizen data and often have limited in-house security resources.
- Manufacturers and logistics firms that rely on connected systems and cannot afford prolonged downtime.
Small businesses can also experience cyber incidents; assess the potential impact on your own operations and data. For a broader look at how cyber coverage fits alongside other business policies, see our business owners policy guide.
How Much Does Cyber Insurance Cost?
There is no universal price tag for cyber insurance. Quotes can vary between insurers for the same business, so use current quotes and compare the protection offered—not just the premium. An insurer may ask about your operations, data, security controls, claims history, and the limits and deductibles you request. Ask each insurer which factors it uses; the effect on a quote or eligibility is not guaranteed.
For a deeper look at the variables that influence pricing across business policies, see our guide on insurance cost drivers.
Security Practices and Your Application
Security controls can reduce cyber risk, but they do not guarantee a particular premium, eligibility decision, or coverage outcome. CISA explains how multifactor authentication can protect accounts. Consider backups, software updates, employee training, and an incident response plan as part of your security program. Ask each insurer which controls it requires, document your answers accurately, and review any policy conditions with your broker. Requirements and their effect on coverage vary by insurer and policy.
Before comparing quotes, review our guide on how to compare insurance quotes so you can evaluate coverage apples to apples instead of chasing the lowest headline premium.
Cyber Insurance vs. General Liability
A business should not assume that a general liability policy or standard business owners policy will respond to a cyber event. Compare the actual policy forms and endorsements with the cyber risks the business wants to insure.
General liability, property, and business owners policies have their own terms and may not cover a particular cyber event. A cyber endorsement or standalone policy may offer different coverage and limits. Compare the actual forms and endorsements with an agent or broker; see our general liability insurance guide.
Conclusion
Cyber insurance can be one part of a business’s risk-management plan; it does not prevent an attack or replace security and response planning. Pair a review of the actual policy with a realistic view of your data exposure and the controls your business can maintain. Review coverage before renewal, confirm application answers remain accurate, and revisit limits as the business changes.
Frequently asked questions
What does cyber insurance actually cover?
Cyber policies may offer first-party coverage for the business’s own incident costs and third-party coverage for claims by others. What is included depends on the policy, limits, exclusions, and conditions.
Does my general liability policy cover a data breach?
Do not assume it does. Ask your insurer or broker to review the actual policy and any cyber endorsement against your business’s risks.
What does cyber insurance NOT cover?
Exclusions vary. Ask how the policy treats prior incidents, war, fraud, and security-control conditions, and review the wording and endorsements before buying.
Do small businesses really need cyber insurance?
It depends on the business’s exposure, financial resources, contracts, and existing coverage. An agent or broker can help compare the available protection with the costs of an incident.
How much does a small-business cyber policy cost?
There is no universal price. Ask for current quotes that state the limits, deductible, included coverages, sublimits, exclusions, and conditions. Insurers may consider the business’s industry, revenue, data, security controls, claims history, and selected limits.
What security controls do insurers require before they will bind coverage?
Requirements vary by insurer and applicant. Ask for the current application and any policy conditions, and verify which controls you must maintain. MFA, backups, updates, training, and response planning are practices to discuss, not universal requirements or guarantees of coverage.