Cost guide
How Much Does Cyber Liability Insurance Cost?
Cyber liability premiums are typically driven by revenue, the volume and sensitivity of data handled, industry, and the strength of security controls in place.
Cyber liability premium depends on revenue, how much sensitive data you hold, your industry, and the security controls you can document. Carriers now price heavily on multi-factor authentication, tested backups, and endpoint monitoring — businesses without them pay more or get declined. Small businesses with light data exposure often land in the low four figures or less annually.
Cyber liability insurance helps cover the costs of a data breach, ransomware attack, or other cyber incident, including notification expenses, forensic investigation, legal fees, and sometimes ransom payments. Because the threat landscape changes quickly, underwriting for this coverage has become more detailed than it was even a few years ago.
Pricing typically starts with revenue and industry, since businesses handling large volumes of sensitive customer data, such as healthcare providers or financial firms, generally present a bigger target and higher potential loss than a small service business with limited digital footprint. From there, underwriters usually apply a detailed questionnaire covering security controls like multi-factor authentication, backup practices, and employee training.
Many small businesses with modest revenue and reasonable security controls pay a few hundred to a couple thousand dollars annually, while larger businesses or those in higher-risk industries, especially without strong controls in place, can see premiums climb substantially or face coverage restrictions.
Average cost benchmarks
- Small businesses under $1M in revenue with basic controls often pay between $500 and $2,000 annually.
- Mid-sized businesses handling customer payment or health data commonly range from $1,500 to $6,000 per year.
- Businesses without multi-factor authentication in place frequently see higher premiums or coverage restrictions until it is implemented.
- Ransomware coverage sublimits are common, and many carriers now cap ransom payment coverage separately from the overall limit.
- Healthcare, financial services, and law firms typically pay above-average rates given the sensitivity of the data they hold.
Benchmarks are illustrative and not a quote. Your premium depends on your state, carrier, limits, and loss history.
What drives your premium
Revenue and business size
Larger businesses generally handle more data and transactions, which usually increases both the likelihood and potential cost of an incident, making revenue one of the primary rating factors underwriters consider.
Type and volume of data handled
Businesses storing significant volumes of personally identifiable information, payment card data, or protected health information typically face higher rates than those with minimal sensitive data exposure.
Security controls in place
Multi-factor authentication, endpoint detection software, regular data backups, and employee phishing training are commonly reviewed in underwriting, and their absence often results in higher premium or declined coverage.
Industry classification
Healthcare, financial services, legal, and retail businesses that process significant customer data typically see higher base rates than industries with lower digital exposure, such as many trades or manufacturing operations.
Claims and incident history
A prior breach or ransomware event, even a small one, generally signals elevated future risk to underwriters and often results in higher premium or more restrictive terms at renewal.
Limits and retention selected
Higher coverage limits and lower retentions generally increase premium, and many businesses work with their agent to balance adequate protection against the cost of the policy.
Third-party vendor exposure
Businesses that rely on outside vendors for payment processing, cloud storage, or IT support often face additional scrutiny, since a breach at a vendor can still trigger notification obligations and liability.
Examples by business size
| Business profile | Estimated annual premium |
|---|---|
Small e-commerce shop $500K revenue, basic security controls, limited customer data Modest limits appropriate for smaller transaction volume. | $600 – $1,500 / yr |
Professional services firm $2M revenue, client financial records, MFA enabled Strong controls in place help offset sensitive data exposure. | $1,800 – $4,000 / yr |
Medical practice $3M revenue, electronic health records, moderate staff size Protected health information typically drives higher base rate. | $3,000 – $8,000 / yr |
Regional retailer $10M revenue, payment card processing across locations Larger transaction volume and multiple locations increase exposure. | $7,000 – $18,000+ / yr |
Ways to lower what you pay
Implement multi-factor authentication
Requiring MFA across email, remote access, and administrative accounts is one of the most commonly requested controls, and its absence often leads to higher pricing or coverage declines.
Maintain regular, tested data backups
Offline or immutable backups that are regularly tested can reduce the impact of a ransomware attack, which underwriters often view favorably when quoting coverage.
Provide ongoing employee security training
Regular phishing simulation and security awareness training can reduce the likelihood of a successful social engineering attack, a leading cause of cyber claims.
Limit and monitor data retention
Reducing the volume of sensitive data stored, and only retaining what is necessary, can lower your overall exposure and sometimes support more favorable underwriting.
Vet third-party vendors carefully
Reviewing the security practices of payment processors, cloud providers, and IT vendors can reduce indirect exposure that might otherwise be reflected in your premium.
Work with an agent experienced in cyber coverage
Because underwriting requirements and available markets change frequently in this line, comparing carriers through an agent familiar with current cyber standards often improves both terms and pricing.
Frequently asked questions
Ready to see your options?
One application. Up to 10 competing quotes. Answer a few questions and we will shop your business to our A-rated carrier network, then a licensed agent walks you through the options.