Cyber insurance used to be one of those boxes you checked and forgot about. Not anymore. Insurers want to see real security in place before they’ll write you a policy, and the fine print decides what gets paid if something goes wrong. Here’s what a typical policy covers, what it doesn’t, what insurers are asking for these days, and how to tell if your current coverage still holds up.
What Is Cyber Insurance for Small Business?
Cyber insurance, sometimes called cyber liability insurance, helps cover the cost of a data breach, ransomware attack, or other cyber incident. Instead of your business eating the whole bill, the policy helps pay for things like breach response, legal fees, and lost income while you get back up and running.
Small businesses buy it because attackers don’t only go after big companies. In a lot of cases, smaller businesses have less protection in place, which makes them an easier target. A healthcare office with twenty employees can lose just as much patient data as a hospital system, and it costs just as much to clean up.
Why Are Insurers Asking for More Now?
Ransomware claims piled up for years, and insurers ended up paying out a lot more than they planned for. So they changed how they underwrite policies. They stopped taking your word for it. Now the application asks detailed questions about MFA, backups, and endpoint protection, and some carriers even run a scan of your network before they’ll quote a price.
Show them real security controls and you’ll usually get a better rate. Can’t show them much, and you’re either paying more or getting turned down. That’s the part catching a lot of small businesses off guard at renewal. The coverage that worked fine last year might not cut it this time around.
What Does Cyber Insurance Cover?
Most policies protect against a handful of core costs:
- Ransomware payments and negotiation costs, if your business decides to pay to get systems back.
- Business interruption, covering the income you lose while systems are down.
- Breach notification costs, including credit monitoring for affected customers.
- Legal fees and regulatory fines, which matter a lot in industries like healthcare with strict data rules.
- Data recovery costs, for rebuilding or restoring systems after an attack.
Curious what these costs look like without insurance backing you up? The real cost of a data breach for a small business walks through real numbers.
What Cyber Insurance Doesn’t Cover
Here’s where a lot of business owners get caught off guard. Every policy has exclusions, and they tend to surface right when you need the coverage most.
A few of the most common:
- Known vulnerabilities you never patched. If an insurer can show you knew about a flaw and sat on it, that claim can get denied.
- War and nation-state attacks. Plenty of policies carry a war exclusion clause, and it’s already been tested in court after a few major attacks tied to state actors.
- Reputational damage. The business you lose after a breach, from customers who don’t trust you anymore, almost never gets covered, even though it’s often the biggest cost.
- Missing controls the policy required. If you told your insurer you had MFA or encrypted backups and you didn’t, they can deny the claim outright.
That last one trips up more small businesses than any other.
What Security Controls Do Insurers Require Now?
Getting a policy used to mean filling out a form and paying a premium. These days, insurers want proof first. Most carriers now expect to see:
- Enforced multi-factor authentication (MFA) on email, VPN, remote access, and admin accounts. If MFA is optional instead of required, it usually doesn’t count.
- Endpoint detection and response (EDR) on every device, watched around the clock. If you’re not sure what that means for your business, our guide to endpoint detection and response breaks it down in plain terms.
- Encrypted, tested backups. Not backups that just sit there, ones you’ve restored from before.
- Regular patch management, so known holes get closed before someone finds them.
- Limited admin rights, so one compromised login can’t take down your whole network. It’s part of a bigger shift toward zero trust security, which more insurers expect to see in some form.
- Employee security training. Phishing is still how most attackers get their foot in the door.
- A written incident response plan, so your team knows what to do in the first hour, not the third day.
Insurers want to see screenshots, policies, training logs, and audit results. If your business has never been through a formal review, our breakdown of what to expect from an IT compliance audit is a solid place to start.
How to Tell If Your Current Coverage Is Enough
Plenty of small businesses bought a policy years ago and never looked at it again. Here’s how to check if yours still makes sense:
- Does it name ransomware payments specifically? Older policies sometimes treat ransomware differently than a standard breach.
- What’s your deductible compared to your revenue? A high deductible can make a policy almost useless for a small business.
- Does it cover regulatory fines in your industry? Healthcare and financial businesses usually need higher limits here.
- When did an underwriter last look at your security setup? If it’s been over a year, your policy may not match what insurers require anymore, or what your business needs today.
- Have you checked for warning signs already? These 5 signs your business may be at risk are worth reading before renewal, not after a claim gets denied.
People Also Ask
Does my small business need cyber insurance?
If you store customer data, take payments, or depend on your network to complete daily business, yes. Small businesses get targeted plenty, and one bad incident can cost far more than a policy ever would.
Does cyber insurance cover ransomware?
Usually, yes, but the details vary quite a bit. Some policies cover the ransom itself, others only cover recovery costs, so it’s worth reading the fine print.
What’s not covered by cyber insurance?
Known vulnerabilities you never patched, reputational damage, and missing controls your policy required are the exclusions that trip people up most.
How do insurers verify my security controls?
Through applications, security questionnaires, and sometimes a scan of your network before they’ll issue or renew a policy.
Will my premium go up if I don’t have MFA or EDR in place?
Probably. Missing controls can mean a higher premium, an exclusion for anything related to that gap, or a denied application, depending on the carrier.
Talk to Someone Before You Renew
This covers the basics, but every policy and every business is a little different. Talk with a licensed insurance broker about your specific coverage, and talk with an IT provider about whether your security would hold up if an insurer came asking. Scipio Technologies can help with that second part.
