Most small businesses pay somewhere between $1,000 and $2,500 a year for cyber insurance with a $1 million limit, and the median in 2026 sits around $1,740. That’s the short answer to what cyber insurance cost looks like right now. The longer answer is that your own number depends on a handful of things you can actually influence, from your revenue to whether you have multifactor authentication turned on.
This guide breaks down the real 2026 cost of cyber insurance for a small business: the typical ranges, what drives your price up or down, what you’ll pay by company size and by industry, and the practical moves that lower your premium. No scare tactics, just the numbers.
What cyber insurance costs in 2026
For a typical small business, a standalone cyber policy with a $1 million limit runs about $1,000 to $2,500 a year, or roughly $85 to $210 a month. Plenty of small businesses land near the low end, with average annual premiums often quoted between $1,000 and $1,740 depending on the source and the year.
A few reference points worth knowing:
- The median annual premium for a business with fewer than 250 employees is about $1,740 in 2026, down from around $2,100 in 2024 as pricing has settled.
- Standalone coverage with a $1 million limit often starts near $1,500 a year.
- A typical deductible sits around $2,500, though you can often raise it to lower your premium.
Prices had climbed hard for a few years, but 2026 rates are mostly flat, and many businesses with solid security are seeing renewals hold steady or even dip. So if you were quoted a scary number a couple of years ago, it’s worth looking again.
The 6 things that drive your cyber insurance cost
Two businesses on the same street can get very different quotes. Here’s what moves the needle.
1. Your annual revenue
Insurers use revenue as a rough proxy for how much you’d lose in an attack and how much data you probably hold. More revenue usually means a higher premium.
2. Your industry
Some industries are simply targeted more and hold more sensitive data. A tech company or a medical clinic pays more than a landscaping business for the same coverage.
3. How much sensitive data you hold
Storing customer payment details, health records, or Social Security numbers raises your risk profile, and your price, compared to a business that barely touches personal data.
4. Your security controls
This is the big one you control. Missing basics like multifactor authentication or endpoint protection can add 25 to 50 percent to a quote, or get you declined outright. Strong controls pull the price the other way.
5. The coverage limit and deductible you pick
A higher limit costs more. A higher deductible costs less, because you’re agreeing to cover more of a claim yourself before the policy kicks in.
6. Your claims history
A past breach or prior claim signals risk, and it can push your premium up or narrow your options at renewal.
Cyber insurance cost by business size
Bigger businesses pay more, mostly because they have more revenue and more data at stake. These are typical 2026 annual ranges for a $1 million policy. Your quote will vary with industry and security.
| Annual revenue | Typical annual premium ($1M limit) |
|---|---|
| Under $1 million | $1,000 to $2,400 |
| $1 million to $10 million | $2,000 to $5,000 |
| $10 million to $50 million | $5,000 to $15,000 |
A solo operator or a small shop with light data will usually sit at the bottom of the under $1 million row, sometimes near $1,000 a year. That’s often less than the cost of a single day of downtime after an attack.
Cyber insurance cost by industry
Industry is one of the largest swings in price. Businesses that hold a lot of sensitive data or get attacked more pay well above average, while lower risk trades pay below it.
| Industry | Relative cost | Why |
|---|---|---|
| Technology and IT | Highest (well above average) | High value target, holds client data and system access |
| Healthcare and clinics | Higher ($2,500 to $5,000) | Protected health information, heavy ransomware target |
| Professional services | Higher ($2,500 to $5,000) | Client records, wire transfers, confidentiality duties |
| Retail and ecommerce | Mid range | Payment card data and online sales exposure |
| Construction and trades | Lower ($1,000 to $2,000) | Less sensitive data, though wire fraud is still a risk |
| Recreation and hospitality | Lowest (well below average) | Lower data volume and attack frequency |
These are general patterns, not promises. Two healthcare clinics can still pay very different premiums based on their size and security. If you want a real number for your situation, you can compare quotes for a business like yours rather than relying on averages.
What your cyber insurance premium actually buys
It helps to remember what you’re paying for. A cyber policy is built to cover the whole event, not just one piece, so most of that premium goes toward two buckets: first party costs, the money you spend recovering, and third party costs, the claims others bring against you.
On the first party side, a policy usually covers breach response (forensics, legal guidance, and customer notification), ransomware and extortion, business interruption for the income you lose while you’re down, and data restoration to rebuild your systems. On the third party side, it covers liability, regulatory fines, and legal defense when a breach affects your customers.
The headline limit isn’t the whole story either, since specific pieces like extortion often carry a smaller sublimit. For a full breakdown of what’s included and what’s left out, see our guide on what cyber insurance covers. Knowing what the premium buys makes it much easier to judge whether a low quote is a real deal or a thin one.
How to lower your cyber insurance cost
The good news: most of the levers that cut your premium also make you safer. Insurers reward businesses that are harder to attack.
- Turn on multifactor authentication for email, remote access, and admin accounts. It’s the single most requested control, and skipping it is the fastest way to a higher price or a declined application.
- Keep tested, isolated backups so you can recover without paying a ransom. Insurers ask about this directly.
- Add endpoint detection and response so attacks get caught early instead of spreading.
- Write a simple incident response plan so you’re not improvising in the first hour of an attack.
- Raise your deductible if your cash flow can absorb it. Taking on more of a small claim lowers your ongoing premium.
- Bundle or work with a broker who can shop several carriers, since quotes for the same business vary a lot.
Read our full breakdown of the security controls insurers require before you apply, so you walk in with the answers that earn a better rate.
Is cyber insurance worth the cost?
For most small businesses that hold customer data, take payments, or depend on their systems to operate, yes. The average cyber insurance claim paid in 2025 was about $116,000, and a serious breach can run far higher once you add downtime, recovery, and legal costs. Against that, a premium of $1,000 to $2,500 a year is a small, predictable number.
The trick is buying the right coverage, not just the cheapest. A bargain policy with tiny sublimits and strict exclusions can leave you exposed exactly when you need it. Match your limit to what a bad day would actually cost you, then use the moves above to bring the price down.
Key takeaways
- Cyber insurance cost for a typical small business runs about $1,000 to $2,500 a year for a $1 million policy, with a 2026 median near $1,740.
- Your price is driven by revenue, industry, the data you hold, your security controls, your limit and deductible, and your claims history.
- Tech and healthcare pay the most; trades and recreation pay the least.
- Multifactor authentication and tested backups are the fastest ways to lower your premium, and missing them can add 25 to 50 percent or get you declined.
- Against an average claim near $116,000, the premium is usually a small price for real protection.
Frequently asked questions
How much does cyber insurance cost per month?
Most small businesses pay roughly $85 to $210 a month for a $1 million policy, and many land near the low end. Your monthly cost depends on your revenue, industry, and security controls.
What is the cheapest cyber insurance for a small business?
The lowest quotes, sometimes near $1,000 a year, usually go to small, low data businesses with good security in place. The cheapest policy isn’t always the best value, so check the limits and exclusions before you buy on price alone.
How much does cyber insurance cost for a sole proprietor?
A one person business with light data often sits at the bottom of the range, frequently around $1,000 to $1,500 a year for a $1 million limit, especially with multifactor authentication turned on.
Does my general liability policy include cyber cost?
Almost never. Standard general liability and business owner policies usually exclude cyber events, so the cost of a breach comes out of pocket unless you carry dedicated cyber insurance.
How do I get an accurate cyber insurance cost for my business?
Averages only get you close. To see a real number, get a quote based on your revenue, industry, and the security controls you have in place, then compare a few carriers since prices for the same business vary widely.
