Cyber Insurance Is Getting Cheaper. Most Small Businesses Still Don’t Have It.
Here is a number that should make every owner pause: an estimated 10% to 20% of small businesses carry cyber insurance. Meanwhile, the FBI reported nearly $21 billion in cyber-related losses across the U.S. in 2025, and more than a million incidents.
A report out this week from the Insurance Information Institute (covered by Claims Journal on October 19) adds a twist: cyber insurance rates have now fallen four years in a row, about 5% so far in 2026 after a 13% drop in 2025. Coverage is getting cheaper. Risk is not. And small businesses are still the ones skipping it.
I talk to owners every week who assume, “We’re too small to be a target.” Attackers do not check your revenue first. They go after whoever is easiest to reach. So let’s talk about what cyber insurance actually does, what it doesn’t, and how to be ready if you buy it.
What cyber insurance actually covers
Think of it like fire insurance for your digital building. It does not stop the fire. It helps pay for the cleanup and the rebuild.
The costs it can help with
Depending on the policy, that can include forensic investigators, legal help, notifying customers, credit monitoring, lost income while you are down, and sometimes ransomware negotiation or payment. For a small shop, a single incident can run into tens of thousands of dollars. That is the kind of bill that closes doors.
What it usually does not fix
It will not restore your reputation, bring back a customer who lost trust, or make the attack unhappen. And policies have fine print. Some exclude certain events, cap payouts for things like wire fraud, or deny claims if you said you had protections you did not.
Insurance is the seatbelt, not the brakes
This is where I push back on the idea that a policy is a security plan. Insurance pays after something goes wrong. Prevention is what keeps it from going wrong at all. The same report points out that the strongest approach pairs prevention, preparedness, and insurance together.
It also matters because insurers are not charity. When you apply, most will ask whether you use multi-factor authentication, keep tested backups, run endpoint protection, and train your staff. If your answers are shaky, you may pay more, get less coverage, or get turned down. If you check the box and it later turns out to be untrue, a claim can be denied right when you need it.
That is good news in a way. The same steps that make you insurable also make you much harder to hit. Our small business cyber security solutions are built around exactly those basics.
What to get in place before you apply
Backups you have actually tested
Ransomware was involved in 48% of breaches in Verizon’s 2026 report. A clean, tested backup is often the difference between a bad week and a closed business. See our secure data backups.
Protection on every device
Laptops and desktops are where most attacks land. Modern endpoint protection is usually the first thing an underwriter asks about.
A trained team
One bad click is all it takes, as we covered in our post on what to do when ransomware hits. Regular cybersecurity awareness training is cheap compared to any claim, and a spam and virus filter stops many bad emails before your staff ever see them.
What you can do this week
- Find out if you already have coverage. Check your business owner’s policy. Many include little or no cyber protection.
- Turn on MFA for email, banking, and your accounting software.
- Test a restore of your backups. Pick one file and bring it back.
- List your devices and who uses them. Insurers will ask.
- Read the exclusions on any quote, especially for wire fraud and ransomware.
- Write down who to call first if something happens, including your IT provider and your insurer’s claims line.
The bottom line
Cheaper premiums are a good reason to look at coverage again. But do not let a policy become your plan. Get the basics right first, then insure what is left. That order saves money and gets you better terms.
Not sure if you’re ready to be insured?
We’ll walk through your setup, show you what an insurer would see, and point out the gaps, free.
More plain-English security reads are on our blog.
Send us a message
Sources: Claims Journal, “Cyber Rates Are Down, Risks Are Up but Small Businesses Slow to Adopt” (Oct. 19, 2026), citing the Insurance Information Institute, Swiss Re, FBI, and Verizon data.
— Nemuel Cruz, Incognito Cyber Security
