What Is Cyber Insurance? Coverage, Costs, and Why Businesses Need It

The Growing Need for Cyber Insurance

In an era when a single ransomware attack can cost a mid-sized company millions of dollars, and when data breaches expose sensitive customer information at enterprises of every size, cyber insurance has evolved from a niche specialty product into a mainstream business necessity. The average cost of a data breach reached $4.45 million globally in 2023, according to IBM's Cost of a Data Breach Report — an all-time high. For small and medium businesses, a major cyber incident can be existential.

Cyber insurance — also called cyber liability insurance or cybersecurity insurance — is a type of commercial insurance policy designed to protect organizations from the financial consequences of cyberattacks, data breaches, and related technology failures. Unlike general liability or property insurance, cyber insurance is specifically designed to address the unique and evolving risks of the digital environment: the theft or exposure of digital data, the disruption of digital operations, legal liability to affected parties, and the costs of incident response and recovery.

The cyber insurance market has grown rapidly in response to escalating cyber threats. Global cyber insurance premiums were estimated at approximately $12 billion in 2022 and are projected to reach $30–40 billion by 2030. At the same time, insurers have significantly tightened underwriting standards and raised premiums in response to increasing claim frequency and severity — making it more important than ever for businesses to understand what they are buying.

What Cyber Insurance Covers

Cyber insurance policies typically provide two broad categories of coverage: first-party coverage (losses the policyholder incurs directly) and third-party coverage (liability to external parties).

First-Party Coverage

Third-Party (Liability) Coverage

What Cyber Insurance Does NOT Cover

Understanding exclusions is as important as understanding coverage. Common exclusions in cyber insurance policies include:

Pre-existing incidents: Most policies exclude incidents that began before the policy inception date, even if discovered during the policy period.

Acts of war and nation-state attacks: Many policies exclude cyber events attributed to acts of war, including nation-state cyberattacks — an exclusion that has become contentious given the blurring of cybercrime and geopolitical conflict. Several high-profile coverage disputes have arisen over this exclusion (the NotPetya attack in 2017 generated some of the most significant litigation in cyber insurance history).

Insider threats and employee misconduct: Intentional malicious acts by employees may be excluded under some policies, though coverage varies.

Infrastructure failures: Power grid outages, cloud provider failures, or internet backbone disruptions that were not the result of a cyberattack against the policyholder may be excluded.

Systemic cyber events: Some policies now include sublimits or exclusions for "systemic" events — widespread simultaneous cyber incidents affecting many organizations, such as a major software vulnerability exploited at scale — due to concerns about correlated losses.

Physical damage: Physical destruction caused by a cyberattack (e.g., a cyberattack destroying industrial equipment) may fall into a gap between cyber and property insurance; careful policy review is needed.

How Much Does Cyber Insurance Cost?

Cyber insurance premiums vary enormously based on multiple factors. The market has hardened significantly since 2020, with average premiums rising 50–100% in 2021 and continuing to increase as claim frequency rose with ransomware proliferation.

As a rough benchmark: a small business with $5 million in revenue, good security practices, and $1 million in coverage might pay $5,000–$15,000 per year. A healthcare organization with $100 million in revenue and extensive patient data might pay $100,000–$500,000 or more. A large enterprise seeking $50 million or more in coverage may find the market extremely expensive or require excess layers from multiple insurers.

What Insurers Now Require: Cybersecurity Baseline Controls

The cyber insurance market has fundamentally changed underwriting practices in response to rising claims. Insurers now conduct rigorous technical assessments and require documentation of specific security controls before offering coverage — or offering favorable terms. Organizations that cannot demonstrate these controls may be denied coverage or face significantly higher premiums.

The most commonly required controls include:

Multi-factor authentication (MFA): MFA for all email accounts, remote access (VPN), and privileged administrator accounts is now essentially a universal requirement. Its absence is among the top reasons for declined applications.

Endpoint Detection and Response (EDR): Insurers increasingly require deployment of EDR solutions — which provide real-time monitoring, threat detection, and automated response across endpoints — as opposed to traditional antivirus alone.

Offline or immutable backups: Ransomware has made robust backup practices a central underwriting concern. Insurers typically require regular backups stored offline or in an immutable format (where data cannot be altered or deleted) to enable recovery without paying ransom.

Privileged Access Management (PAM): Controls over privileged (administrator) accounts, including least-privilege principles and just-in-time access, reduce the blast radius of a breach.

Patch management: Documented processes for timely application of security patches to operating systems and critical software.

Email security: Anti-phishing controls including DMARC, DKIM, and SPF records, along with spam filtering and security awareness training, address the most common initial attack vector.

Incident response plan: Many insurers now require evidence of a documented and tested incident response plan, including defined roles and external contacts (legal counsel, forensics firm).

The Claims Process: What Happens After an Incident

When a cyber incident occurs, policyholders should follow a structured notification and claims process to ensure coverage is not jeopardized.

Most cyber insurance policies include a panel of pre-approved vendors for incident response — forensic investigators, legal counsel specializing in privacy law, and public relations firms. Using non-panel vendors without prior insurer approval may result in reduced or denied reimbursement. Timely notification of the insurer is critical; most policies require notification "as soon as practicable" or within a specific window (e.g., 30 or 60 days) of discovering an incident.

The insurer will typically assign a claims handler and coordinate with panel vendors to manage the response. The policyholder should document all costs, preserve forensic evidence, and avoid making ransom payments without consulting the insurer — as many policies require pre-approval for ransom payments to be covered.

Does Your Business Need Cyber Insurance?

The practical answer for most businesses is yes — particularly those that:

• Store or process personal data of customers, patients, or employees (virtually all businesses do)
• Rely on digital systems for core operations (system outages would cause significant revenue loss)
• Accept payment cards (PCI DSS compliance obligations compound liability)
• Operate in regulated industries such as healthcare (HIPAA), finance (GLBA), or handle EU residents' data (GDPR)
• Have contractual obligations to clients requiring cyber liability coverage
• Are too small to absorb a multi-hundred-thousand-dollar incident out of pocket

Even very small businesses are not immune to cyberattacks. Criminals often target small businesses specifically because they tend to have weaker security postures than large enterprises while still holding valuable data. Ransomware attacks do not discriminate by company size.

Before purchasing, businesses should work with a knowledgeable insurance broker who specializes in cyber risk to assess coverage needs, compare policy forms carefully (cyber policies are not standardized), understand all exclusions, and ensure the coverage limit is adequate relative to plausible worst-case loss scenarios — including not just data breach costs but business interruption losses.

Cyber insurance is not a substitute for cybersecurity — insurers are increasingly requiring demonstrable security controls as a condition of coverage, and the best risk management strategy combines strong prevention with financial protection for residual risk.