How Much Does Cyber Insurance Cost for a Small Business in 2026?

How much does cyber insurance cost for a small business? The short answer, from the largest dataset available in 2026, is a median of $129 a month — about $1,548 a year — for a standalone cyber policy. But that single number hides a range that runs from under $40 a month for a sole trader with almost no customer data to several hundred a month for a business that holds payment details, health records or client files. The price you actually pay depends on what you do, how much data you hold, and whether you have done the basic security work insurers now expect before they will cover you at all.

This guide works through the 2026 numbers by business size and industry, what the policy actually pays for, what it refuses to cover, and the five factors that move your quote up or down.

The Headline Number: $129 a Month

The $129-a-month figure comes from Insureon, an online insurance marketplace, whose 2026 cost data is drawn from more than 100,000 small-business policies sold through its platform. Its customers pay a median of $129 a month, or $1,548 a year, for a standalone cyber insurance policy, with most annual premiums falling between about $400 and over $8,000. Insureon updated the figure in April 2026, and its typical customer is small — fewer than five employees, annual revenue from under $50,000 to over $200,000, and five years or less in business.

The distribution behind the median is more useful than the median itself. Forty-one percent of Insureon’s cyber customers pay under $100 a month, and another 26% pay between $100 and $200. So two-thirds of small businesses pay $200 a month or less, while a minority with bigger exposures pull the average up.

Other sources land in the same neighbourhood. SeedPod Cyber, a specialist cyber insurer that prices from its own underwriting data, puts the median small-business premium at roughly $134 to $145 a month, or about $1,600 to $1,750 a year, for $1 million in coverage. MoneyGeek’s 2026 study, which models a premium for a one-to-four-employee business with a $1 million aggregate limit and a $1,000 deductible, averaged across industries and states, comes in lower at about $83 a month. The gap between MoneyGeek’s modelled $83 and Insureon’s observed $129 is the difference between a clean hypothetical business and the real mix of businesses actually buying cover — real businesses hold messier data and weaker controls than the model assumes.

One useful comparison point: The Hartford’s small-business customers pay about $27 a month, or around $320 a year, for data breach coverage. That is a narrower product than a full standalone cyber policy — closer to an add-on than a complete policy — which is why it costs so much less. If a quote looks suspiciously cheap, check whether it is a full cyber policy or a limited data-breach endorsement.

What Cyber Insurance Actually Pays For

A cyber policy pays for the costs of a data breach or cyberattack — the bills that arrive in the days and weeks after something goes wrong, not the attack itself. The standard list of covered costs is:

Forensic investigation — specialists who work out what happened, what was taken, and whether the attacker is still inside your systems.

Customer notification — the letters, emails and call-centre costs of telling affected customers, which many states legally require.

Data restoration — rebuilding or recovering lost or encrypted data and systems.

Lost income — revenue lost while your systems are down, for example during a ransomware shutdown. The Hartford’s small-business cyber policy, for instance, covers lost income from a ransomware shutdown.

Liability for other people’s data — legal costs and settlements if customers or partners sue over data you lost.

Regulatory inquiries — the cost of responding to regulators, and in some policies the fines themselves.

The scale of the problem explains why insurers price this line so carefully. IBM’s 2025 Cost of a Data Breach Report, the benchmark study the industry quotes, puts the average cost of a data breach in the millions for larger firms; small businesses face smaller absolute numbers but the same categories of cost, and a single incident can exceed a year’s revenue for a very small firm. That is the risk the $129 a month is buying protection against.

What It Costs by Business Size

Size is the single biggest driver after industry, because it tracks with how much data a business holds and how many people can click the wrong link. The 2026 benchmarks break down roughly like this:

Sole proprietor or micro business, low data: $33–$70 a month, $400–$850 a year, $500k–$1M limit.

Typical small business overall: $83–$129 a month, $999–$1,552 a year, $1M limit.

Small business, under 25 employees: $100–$300 a month, $1,200–$3,600 a year, $1M limit.

Small business, 25 to 99 employees: $250–$600 a month, $3,000–$7,200 a year, $1M limit.

Most small businesses buy $1 million in coverage — usually structured as $1 million per occurrence and $1 million aggregate, or $1 million per occurrence and $2 million aggregate. SeedPod’s data shows most small businesses pay $1,200 to $7,500 a year for $1 million in cyber coverage, which lines up with the size bands above once industry is factored in. A one-person consultancy with no customer database sits at the bottom of the range. A 40-person firm with a customer database and online payments sits near the top.

What It Costs by Industry

Industry matters because some businesses hold data that is worth more to criminals, and some face stricter regulation when it leaks. Insureon’s industry breakdown puts IT and technology firms at a median of $179 a month — the highest of the small-business categories it publishes — because technology firms hold client systems and data as their core business. Retailers that store payment card data, healthcare-adjacent businesses that touch patient information, and professional services firms that hold client financial records all price above the median. A local trades business with a booking system and almost no stored customer data prices below it.

The practical consequence is that two businesses of the same size can get quotes $100 a month apart for the same $1 million limit, purely because of what they do. If your quote looks high, the first question to ask is whether the insurer has classified your industry correctly — a misclassification can cost you real money every month.

The Five Things That Move Your Quote

Underwriters price cyber cover on five factors, and four of them are within your control:

1. Revenue. Bigger revenue means a bigger target and a bigger potential loss. It is the simplest driver and the hardest to change.

2. Industry. As above, data-rich and regulated industries pay more.

3. Volume and sensitivity of data. How many customer records do you hold, and what is in them? Names and email addresses are one thing. Payment card numbers, health information and Social Security numbers are another.

4. Employee count. Every employee is a potential entry point for a phishing email or a misdirected file. More people means more risk, and insurers price it.

5. Security controls. This is the one that has changed most in the last two years. Insurers increasingly require basic security — multi-factor authentication in particular — before they will offer cover at all. Encrypted backups, patched systems and employee training also move the price. A business with multi-factor authentication switched on everywhere and tested backups can pay meaningfully less than an identical business without them, because the insurer’s expected loss is genuinely lower.

Rates in this line are also less settled than in older insurance markets. Carriers raised rates substantially in 2021 to 2023 in response to ransomware claim severity, and rates have moderated since — but they remain volatile compared with general liability or property cover. Cyber is the one policy type where shopping the market at every renewal materially affects the price, because underwriting appetite changes year to year.

What It Does Not Cover

A cyber policy is not a blank cheque, and the exclusions are where disappointed claims come from. The common ones:

Incidents that started before the policy. If the attacker was already in your systems when you bought cover, the claim is not covered.

Known vulnerabilities you never fixed. If you knew about a critical unpatched flaw and ignored it, the insurer may decline the claim.

Social engineering above the sublimit. Fraudulent wire transfers and invoice scams are often covered only up to a much lower sublimit than the headline $1 million — sometimes as little as $25,000 or $50,000.

Reputational harm and future lost profits. The policy covers the income lost while systems are down, not the customers who never come back.

Property damage and bodily injury. Those belong to other policies, although some cyber policies now include limited cover for physical damage caused by a cyber event.

Read the sublimits, not just the headline limit. A $1 million policy with a $25,000 social engineering sublimit is a very different product from one with a $250,000 sublimit, and the price difference between them is usually small.

How to Get a Quote You Can Live With

Start with the security controls, because they are the cheapest premium reduction available. Switch on multi-factor authentication on every account that offers it — email first, then banking, then cloud storage. Make sure your backups are encrypted, stored offsite or in the cloud, and actually tested: a backup nobody has ever restored from is a hope, not a control. Patch promptly, and train staff to spot phishing emails, which remain the most common way attackers get in.

Then get three quotes, and make sure they are for the same limits, the same deductible and the same sublimits. A $1,000 deductible is a common choice for small businesses; a higher deductible lowers the premium, but only take one you could actually pay in the week of an incident. Ask each insurer what security controls they require and what discount each control earns, then implement the cheap ones before you bind the policy. Finally, diary the renewal. Cyber is the line where loyalty costs money, because the insurer that wanted your business last year may not want it this year, and the one that declined you may have changed its appetite.

The bottom line: a typical small business should budget roughly $129 a month — about $1,550 a year — for $1 million of standalone cyber cover, with the real range running from under $50 a month for the smallest, lowest-data businesses to $300 or more for larger firms and data-heavy industries. The price is not fixed. Put multi-factor authentication and tested backups in place before you ask for a quote, shop the market every year, and check the sublimits before you sign — the cheapest policy is rarely the one with the lowest headline premium.

A policy pays for the damage, but the cheapest claim is the one that never happens — start with these cybersecurity basics for small business.