How much does cyber insurance cost small business in the USA right now? Most pay between $83 and $129 a month for solid $1 million coverage—roughly $999 to $1,552 a year—though the exact number swings hard based on your size, industry, and how tight your security is.
Here’s the quick snapshot you need:
- Typical range for U.S. small businesses in 2026 sits at $500–$3,000 annually for a $1M policy.
- Sole proprietors and low-risk shops often land under $700 a year; tech, healthcare, or e-commerce firms push higher.
- Strong controls like multi-factor authentication can shave 20–30% off the quote.
- A single breach routinely runs six figures—far more than the premium.
- Shopping multiple carriers and documenting your defenses is the fastest way to keep costs down.
For the bigger picture on how cyber insurance fits into your overall risk strategy, check the full guide on cyber insurance for small business in 2026.
The sticker shock most owners feel is usually temporary. Once you see the real numbers and the levers you control, the decision gets a lot clearer.
How much does cyber insurance cost small business by size and industry
Size is the biggest driver. More employees means more devices, more logins, and more ways something can go sideways. Industry comes next—anything touching health records, payment cards, or client data gets priced like a higher risk.
Here’s a practical 2026 snapshot based on marketplace data from major brokers and aggregators:
| Business Profile | Typical Annual Premium ($1M limit) | Monthly Equivalent | Notes |
|---|---|---|---|
| Sole proprietor / freelancer | $300–$700 | $25–$58 | Minimal data footprint |
| 1–10 employees, low-risk (retail, trades) | $500–$1,200 | $42–$100 | Baseline pricing |
| 5–25 employees, average risk | $1,000–$2,500 | $83–$208 | Most common small-business band |
| 11–50 employees, higher risk (tech, healthcare, e-commerce) | $1,500–$4,000+ | $125–$333+ | Data volume and regulation push rates up |
| BOP cyber endorsement only | $300–$800 | $25–$67 | Limited sublimits; not full standalone |
MoneyGeek’s 2026 modeled average for a $1 million aggregate policy lands at about $83 a month. Insureon’s book of actual small-business customers sits higher—around $129 a month—because their data includes a wider mix of industries and limits. Both numbers are useful. Treat them as bookends, not gospel.
How much does cyber insurance cost small business Healthcare clinics and tech firms regularly see 50–90% premiums above the baseline. Construction and light manufacturing often sit 20–30% below. Revenue matters too: under $1 million in sales keeps you in the lower tier; crossing $5–10 million starts to look more mid-market.
What actually drives the price up or down
Underwriters care about three things more than anything else: how much sensitive data you hold, how well you protect it, and whether you’ve had claims before.
Revenue and headcount set the floor. The number of customer records, payment card data, or protected health information pushes the rate higher. A marketing agency with 2,000 client emails pays less than a dental office sitting on 15,000 patient files.
How much does cyber insurance cost small business Security posture is the lever most owners still underuse. Carriers now ask specifically about multi-factor authentication, endpoint detection, immutable backups, and employee training. Skip MFA and you can watch the quote jump 25% or more—or get declined outright. Document those controls and the same risk can price 15–30% lower. I’ve seen clean applications with solid MFA and tested backups come in under the average even in tougher industries.
Coverage limits and deductibles work the usual way. Jumping from $1 million to $2 million or $5 million raises the premium, but not always linearly. Raising the deductible from $1,000 to $10,000 or $25,000 often drops the annual cost 15–25%. Most small businesses still stick with $1 million limits and $1,000–$5,000 deductibles because the math works for the majority of incidents.
How much does cyber insurance cost small business Prior claims or known vulnerabilities? Expect a surcharge or a hard no until you fix them. Geography plays a smaller role than it used to, though California and New York sometimes edge a bit higher on regulatory exposure.
Think of the premium like the cost of a good lock on a warehouse full of inventory. The more valuable the inventory and the more doors you leave unlocked, the higher the quote. Tighten the locks and the price comes down fast.
Step-by-step action plan to get accurate quotes and control cost
- Inventory your real exposure. List every place you store customer data, payment info, or employee records. Count approximate records. Note any third-party vendors with access.
- Lock down the basics before you shop. Turn on MFA everywhere it exists. Confirm backups are offline or immutable and that you’ve tested a restore in the last 90 days. Run a basic phishing test or short training session and keep the records.
- Decide on limits and must-have coverages. Most small businesses start with $1 million. Confirm you need first-party costs (forensics, notification, business interruption) plus third-party liability. If you just need a light endorsement on a business owners policy, say so—it costs less but covers less.
- Get three to five quotes. Use a broker who places cyber regularly or online marketplaces that include specialists. Provide the same security details to every carrier so you’re comparing apples to apples.
- Ask specifically about credits. “What’s the impact if we implement or already have MFA, EDR, and quarterly tabletop exercises?” Write the answers down.
- Review the policy form, not just the premium. Check sublimits on ransomware, social engineering, and regulatory fines. Make sure the waiting period for business interruption is realistic.
- Bind the policy and calendar the renewal. Six months out, review any new systems or data growth so you’re not surprised next year.
Do this sequence once and you’ll know exactly where you stand. Most owners who skip the security cleanup end up overpaying or getting declined.
Common mistakes that inflate how much does cyber insurance cost small business—and how to fix them
Mistake one: treating a cheap BOP endorsement as real cyber coverage. Those endorsements often cap at $50,000–$250,000 and exclude key first-party costs. Fix: if you handle any meaningful customer data, buy a standalone policy.
Mistake two: applying with zero documentation of controls. Carriers now require attestations. Vague answers get you the high end of the range or a decline. Fix: prepare a one-page security summary before the first application.
Mistake three: shopping only on price. The cheapest quote sometimes carries the tightest exclusions or the highest ransomware sublimit. Fix: compare coverage breadth side by side. A $200 difference in annual premium is irrelevant if one policy actually pays the claim.
Mistake four: ignoring employee training and access controls. Human error still drives most incidents. Fix: short, repeated training plus least-privilege access beats expensive tools you never configure.
Mistake five: waiting until a client or lender demands the certificate. Then you’re rushed and overpay. Fix: treat it like general liability—get it in place and keep the certificate ready.
How the numbers stack up against the real cost of a breach
A typical small-business cyber claim still lands in the low-to-mid six figures once you add forensics, notification, credit monitoring, legal fees, and downtime. Some recent analyses put average small-business claim costs around $120,000–$264,000 depending on the data set. Against a $1,200–$2,000 annual premium, the coverage pays for itself after one moderate incident.
That’s the practical math. You’re not buying a lottery ticket. You’re transferring a low-probability, high-severity risk that can wipe out a year’s profit—or the business itself—for the price of a couple of employees’ monthly software licenses.
If you want a clearer view of exactly what those policies pay for when things go wrong, the breakdown of what cyber insurance actually covers is worth ten minutes.
Key Takeaways
- Most U.S. small businesses pay $83–$129 per month ($999–$1,552 a year) for $1 million in cyber coverage in 2026.
- Sole props and low-data operations can come in under $700 annually; regulated or high-data industries pay more.
- Security controls—especially MFA, tested backups, and endpoint protection—are the strongest levers for lowering the premium.
- Standalone policies usually deliver better protection than cheap endorsements on a business owners policy.
- Get multiple quotes only after you document your current controls; apples-to-apples comparisons save real money.
- The average cost of even a moderate breach still dwarfs several years of premiums for most small firms.
- Review limits and sublimits carefully—ransomware and social-engineering coverage vary widely between carriers.
Shop the coverage the same way you’d evaluate any other critical business expense. Know your exposure, tighten the obvious gaps, then force the carriers to compete on both price and terms. Do that and how much does cyber insurance cost small business becomes a controllable line item instead of a surprise.
Next step: pull your current security controls into a one-page summary this week and request three quotes. You’ll have real numbers in hand before the month is out.
FAQs
How much does cyber insurance cost small business if I only need basic coverage?
Light endorsements on a business owners policy can start around $300–$800 a year, but they usually carry low sublimits. Full standalone policies for most small firms begin closer to $999–$1,500 for $1 million limits.
Does employee count change how much does cyber insurance cost small business more than revenue?
Both matter, but headcount often moves the needle faster because it tracks the number of potential entry points and human-error risk. A 25-person firm with modest revenue typically prices higher than a five-person firm with the same sales.
Can I lower how much does cyber insurance cost small business without cutting coverage?
Yes. Implementing and documenting multi-factor authentication, regular backups with tested restores, and basic employee training consistently produces the largest credits. Raising the deductible also reduces the premium if you can absorb a larger first loss.
