Cyber insurance for small business: what it actually pays for
A small-business cyber policy typically covers incident response costs, business interruption from system outages, cyber crime (including social-engineering fraud, often sublimited), privacy liability for exposed client data, and ransomware response where insurable. Underwriters now expect MFA and offline backups as table stakes.
Cyber claims at small businesses rarely look like the movies. They look like an accountant wiring a supplier payment to a fraudster’s account, a booking system down for nine days, or a client file walking out through a phished inbox.
The five coverage parts, in claim order
- Incident response — forensics, legal counsel, notification. The first phone call the policy pays for.
- Cyber crime — funds-transfer and social-engineering fraud. Watch the sublimit; it is often far below the headline limit.
- Business interruption — income lost while systems are down, after a waiting period measured in hours.
- Privacy liability — claims and regulatory exposure from exposed personal information.
- Extortion / ransomware — response costs and, where lawful and insurable, payments.
What underwriters ask now
Multi-factor authentication on email and remote access, offline or immutable backups, and basic staff phishing awareness. Answers to those questions move both price and insurability — several markets simply decline without MFA. The good news: the same controls that get you covered are the ones that prevent the claim.
Frequently asked
Does my CGL policy cover cyber events?
Is social-engineering fraud covered by default?
How much does small-business cyber cost?
This article is general information, not insurance advice. Insurance Genie is not an insurer, brokerage or agency. Coverage is defined by the policy wording issued by the insurer and confirmed by the licensed organization that places it.
Keep reading
Understanding business liability limits
$2M vs $5M, and what your contracts are quietly requiring of you.
Certificates of insurance: what GCs actually check
The fastest way to lose a Friday start date is a certificate that does not match the contract. Here is what the compliance desk reads.
From Insurance Genie
Recent policy purchases
Explore recent policy purchases shared through our participating insurance professionals.
Recent policies will appear here when the Insurance Genie CRM feed is connected.
