Costs
Small Business Cyber Insurance: Budget Lines Beyond the Premium
Illustrative premium ranges, deductibles, sublimits, waiting periods and control costs a 10 to 25 person U.S. business should budget for cyber coverage.
What to take away
- A 10 to 25 person U.S. business can expect an illustrative annual cyber liability premium of $800 to $8,000 before deductibles and required controls.
- Deductibles, legal retainers, and control upgrades often add $2,000 to $15,000 in the first year.
- Carriers price state breach notice costs and industry risk into the quote, so the same revenue can produce different rates in different states.
- Coverage should fill gaps left by general liability and property policies, not duplicate them.
- Review the policy every 12 to 18 months because ransomware sublimits and exclusions move faster than other commercial lines.
A cyber insurance quote is a price for a set of promises, and the fine print decides what those promises are worth after an incident.
What the range covers
The premium range covers third-party claims, breach response, and some business interruption. It does not cover every loss. A policy for a 10 person marketing firm looks different from one for a 40 person clinic. Revenue, records count, industry, and state rules all shift the number. Third-party liability pays legal defense and settlements when customers or partners sue. First-party coverage pays your own forensics, notification, and crisis communications. Ransomware coverage sits in a sublimit, not the full policy limit.
Before you compare quotes, read a grounded overview of Backup and recovery because carriers now ask how fast you can restore from offline copies. The FTC's cybersecurity basics for small businesses explains the controls that show up in most applications.
Line by line
| Budget line | One-off or recurring | Illustrative annual range (USD) |
|---|---|---|
| Cyber liability premium, 10 to 25 employees, low-risk services | Recurring | $800 to $2,500 |
| Cyber liability premium, retail, healthcare, or financial services | Recurring | $2,500 to $8,000 |
| Deductible or retention, per incident | Recurring event cost | $1,000 to $25,000 |
| Breach response retainer, legal and forensics | One-off setup, then recurring if used | $5,000 to $15,000 |
| MFA, endpoint protection, and offline backup baseline | Recurring | $1,200 to $6,000 |
The premium is the visible line. The deductible hurts. A $2,500 premium with a $25,000 retention can leave a small firm paying most of a ransomware event out of pocket.
Cyber Insurance Budget Lines
Budget line
- Low-risk services premium
- Recurring
- Retail/health/finance premium
- Recurring
- Deductible per incident
- Recurring event
- Breach response retainer
- One-off, then recurring
- MFA, endpoint, backup
- Recurring
One-off or recurring
- Low-risk services premium
- $800-$2,500
- Retail/health/finance premium
- $2,500-$8,000
- Deductible per incident
- $1,000-$25,000
- Breach response retainer
- $5,000-$15,000
- MFA, endpoint, backup
- $1,200-$6,000
Annual range
- Low-risk services premium
- Retail/health/finance premium
- Deductible per incident
- Breach response retainer
- MFA, endpoint, backup
Carriers require controls before they bind. Those controls have their own cost. A business email compromise claim often turns on payment verification, so choose business email compromise software that catches what it can and know its limits.
Fixed against variable
Premiums are fixed for the policy term. Deductibles, coinsurance, and sublimits are variable because they depend on the incident. A fixed premium buys a limit, but the limit may not apply to every loss type. Ransomware, social engineering, and funds transfer fraud often have separate sublimits. That structure means two policies with the same headline limit can behave very differently. Ask for the sublimit schedule in writing before you compare price.
Multi-factor authentication is one control that many carriers reward with lower rates. CISA's MFA guidance shows how to set it up without locking out your staff.
What the tools do not include
Security tools and insurance policies do not cover poor contracts, unencrypted devices, or prior acts. Most policies exclude war, infrastructure failure, and intentional acts. They also exclude fines where insuring them is against public policy. A policy will not fix a missing offboarding process. If a departing employee keeps access, the insurer may treat the loss as a control failure. A formal exit checklist costs time rather than money, and it closes a gap many carriers ask about.
Where budgets leak
Budgets leak through deductibles, sublimits, and waiting periods. A business interruption waiting period of 8 to 24 hours can wipe out a small claim. Forensic costs above the sublimit land on you. Credit monitoring for 1,000 records can run from $5,000 to $20,000, and many policies cap that benefit. State breach notification rules trigger legal review and notice letters. Those costs often exceed the ransom demand. Track these items as part of the annual budget, not as surprises.
Where Cyber Budgets Leak
- Business interruption waiting period8-24 hours
- Credit monitoring for 1,000 records$5,000-$20,000
- Deductible per incident$1,000-$25,000
- Breach response retainer$5,000-$15,000
If your access rules are messy, read about identity and access migration because carriers will ask how you revoke access after someone leaves.
- Confirm the ransomware sublimit and whether it includes negotiation and recovery.
- Check the business interruption waiting period in hours.
- Ask whether breach notice and credit monitoring sit inside or outside the limit.
- Get the retention amount in writing for each coverage part.
A low premium with a high retention is a loan, not insurance.
Common questions
Does a small business need cyber insurance if it has general liability?
How much does a ransomware deductible add to the annual cost?
Which exclusions surprise small business owners most?
Can I lower the premium by improving security?
Further reading: What is cyber insurance for small businesses and what does it cover? (nav.com).
