How Much Cyber Insurance Do I Need?

Start with the incident, not the policy menu. A cyber limit has to absorb the full cost of your worst plausible event, which usually stacks four components. Forensics and legal response, notification and credit monitoring for every person whose records you hold, the revenue lost while systems are down, and the claims or regulatory action that follows. Price a realistic scenario across all four and you have a defensible starting limit.

Contract requirements can override the math. When a client, lender, or vendor portal names a minimum cyber limit, that number is the floor regardless of your own estimate, and the highest active requirement wins. Between your incident math and your contract floor, carry the larger.

A cyber insurance limit sits over two families of coverage that draw down the same pool. First-party coverage pays your own costs after an incident, forensic investigation, breach counsel, customer notification, credit monitoring, data restoration, extortion response, and the income lost while systems are down. The Insurance Information Institute notes that standard business policies offer only limited cyber protection, which is why serious limits are written on a standalone policy.

Third-party coverage pays what you owe others, defense and settlements when customers or partners sue over compromised data, plus regulatory proceedings, with fines and penalties covered where the law allows. One incident routinely triggers both sides, so a limit sized against notification costs alone can run out midway through the liability claims. That is the classic coverage gap on cyber programs, a limit sized to one component of a multi-component loss.

Cyber underwriting is application-driven. These five factors move the premium more than anything else, and some of them are in your control before the quote.

There is no single honest number, because the premium is rated on the factors above rather than on a flat schedule. Published figures are hedged for the same reason. Progressive, for example, publishes example annual premiums between about $500 and $5,000 or more for small businesses, and is explicit that an average is hard to give because every business rates differently.

The retention you choose moves the price as much as the limit does. A retention is the amount of each claim you pay before the policy responds, the cyber market's version of a deductible. Raising it lowers the premium and keeps small incidents off your loss history, but it has to be an amount the business can genuinely absorb in a bad month.

The more useful question than any national average is whether your own premium sits in line for your revenue, industry, and controls. That is a price benchmarking exercise, comparing your premium against real transacted prices for similar businesses rather than against a headline figure.

Any business that stores personal data, takes payments, or depends on its systems to operate has the exposure cyber insurance covers, which is a wider net than most owners assume. A dental practice holds patient records. An online retailer processes cards. A contractor runs scheduling and billing in the cloud, and a week without either is a week without revenue. None of these is a technology company, and all three carry a real cyber exposure.

Security controls reduce the exposure but do not remove it. The Small Business Administration lists multifactor authentication and regular backups among its core cybersecurity practices for small businesses, and cyber underwriters ask about the same controls on the application. Good controls earn a better price. The residual risk that remains is what the policy is for.

Cyber limits increasingly arrive as someone else's requirement. Enterprise clients, lenders, and vendor onboarding portals now write a minimum cyber limit into contracts the same way they long have for general liability, and they verify it with a certificate before work starts. When a contract on your desk names a cyber limit, that number becomes the floor of your sizing decision.

If you are the one imposing requirements on vendors, the same logic runs in reverse. Decide what limit a vendor incident could realistically cost you, write that limit into the contract, and verify it.