Cyber Insurance Cost: What It Pays and What It Excludes

A customer's contract now requires it, or your broker has put it on the renewal, and the first thing you did was search for a number. Every page that comes back has one. They do not agree with each other, and several do not agree with themselves two screens apart.

That is not laziness. Premiums are set per applicant on facts an underwriter cannot know until it asks you, so nobody can post a rate card. What can be published is what real buyers were quoted or charged, and a few companies do publish that. Reading those numbers means knowing whose policies they describe, at what limit and deductible, and whether the figure came from a quote engine or a signed policy. That is the first half of this page. The second half is the part the price pages skip: the clauses that decide what the money actually covers.

How Much Does Cyber Insurance Cost?

Start with the figures that name both a publisher and the population they describe, because that is a much shorter list than the search results suggest.

Insureon, a small business insurance broker, publishes averages taken from policies its own customers bought: $129 a month, or $1,552 a year, with annual premiums running from around $400 to over $8,000. It says 41 percent of its customers pay less than $100 a month and another 26 percent pay between $100 and $200, on deductibles of $1,000 to $2,500 and limits of $1 million to $5 million. It also states who those customers are: most have fewer than five employees, revenue from under $50,000 to more than $200,000, and five years or less in business. That is a bound-policy average for very small companies, which is the most honest thing about it.

MoneyGeek publishes a lower headline for a tighter definition: $83 a month, or $999 a year, at a $1 million aggregate annual limit. Its 2026 analysis states the method, which almost nothing else here does. The benchmark is a modeled premium for a one to four employee business averaged across industries and states, drawn from quote data across 10 providers, 408 industries and 51 geographies, at a $1,000 deductible. Across that sample, monthly premiums run from $52 to $3,398.

Security.org gives a wider business range, saying its research "consistently shows policies ranging in price from $1,200 to $7,000 per year", and adds that larger enterprises can see $10,000 to well over $100,000 a year. It publishes no methodology, and its own recap gives a different small business figure of $1,000 to $7,500 for $1 million in coverage. Two ranges on one page is a fair measure of how soft this data is.

Notice what none of them covers. Every published US average describes a company with fewer than about 50 people, because mid-market and enterprise programs are layered, negotiated and confidential.

Why Published Cyber Insurance Prices Disagree

Four things separate one published average from another, and once you can name them the spread stops looking like a contradiction.

The population comes first. Insureon describes companies with under five staff that bought through Insureon. MoneyGeek models a similar size band but prices it across every state and industry rather than the mix that walked through one broker's door. Neither is describing a 200 person manufacturer.

The limit and the deductible come second, and they are why a monthly figure means nothing alone. A $999 a year premium at a $1 million aggregate and a $1,000 deductible is a different product from a $999 premium at $250,000 with a $25,000 retention, and only one of the three sources above states both numbers.

Third is quoted against bound. A quote model prices a hypothetical applicant; a book average prices the applicants who accepted. The companies that shopped and walked away are missing from the second number, and they are usually the ones who got the worst price.

The fourth is the biggest, and no consumer-facing page mentions it. "Cyber policy" names three products, and the NAIC now counts them separately. Primary policies were 41.6 percent of policies in force in 2024 but 65 percent of the premium. Endorsements, meaning cyber cover bolted onto another policy, were 55.1 percent of policies and 4 percent of the premium. Excess layers were 3.3 percent of policies and 31 percent of the premium. The most common cyber policy in America is a cheap endorsement, and it is cheap because it is thin.

Cover is priced on exposure per applicant, the same reason a SOC 2 audit has no list price, so the useful question is not what the average is. It is which way the market is moving, and that is measurable.

The softening has continued. Marsh's Q2 2026 Global Insurance Market Index, released on July 23, 2026, reported cyber rates down 4 percent globally, the twelfth consecutive quarterly decline, with the US down 2 percent. If your last renewal went up, the market is not the reason, and that is worth saying to your broker.

What Drives the Price of a Cyber Insurance Policy

Every carrier's application asks broadly the same things, and the answers move the quote in predictable directions.

Industry moves the number more than most buyers expect, and geography moves it less. Insureon reports IT businesses paying an average of $179 a month against $59 for finance businesses. MoneyGeek's tables put Tech and IT highest at $157 a month, and put the entire spread between the cheapest state, Wyoming at $71, and the most expensive, Washington DC at $103, at $32 a month. Where you are barely matters. What you hold, and who wants it, matters a great deal.

Sector risk also shows up as availability rather than price. The Government Accountability Office found in its May 2021 report on the cyber insurance market that the growing number of cyberattacks had led insurers to reduce coverage limits for some sectors, naming healthcare and education, while more than half of surveyed brokers reported clients seeing prices rise 10 to 30 percent in late 2020. The same report tracked take-up climbing from 26 percent of clients in 2016 to 47 percent in 2020. Demand grew while capacity narrowed, which is the hard market the 2024 figures finally reversed.

What Cyber Insurance Covers

A cyber policy is two policies stapled together, and the halves behave differently at claim time.

The event that dominates first party claims is a ransomware attack, which touches almost every grant at once: forensics, restoration, business interruption, negotiation, and notification if data left on the way out. That is why insurers spent the hard market attaching conditions to it, and it is where the caps in the next section do most of their work.

What Cyber Insurance Does Not Cover

This is the half of the question the price pages skip, and the answers sit in documents you can read.

State-backed cyber attacks are excluded by design. Lloyd's of London issued Market Bulletin Y5381 on August 16, 2022, requiring that from March 31, 2023, at inception or renewal, all standalone cyber attack policies written through the Lloyd's market carry a state-backed cyber attack exclusion in addition to any war exclusion. That clause has to exclude losses from state-backed attacks that "significantly impair the ability of a state to function" or "significantly impair the security capabilities of a state", say whether computer systems outside the affected state are covered, and set out how an attack gets attributed to a state at all. Attribution is the part to read closely, because it decides who gets to declare that a criminal group was working for a government, and on what evidence.

Nor is that a Lloyd's quirk. The GAO reported in June 2022 that private insurers were limiting their exposure to systemic events by excluding losses from cyber warfare and infrastructure outages. A power or telecom failure that takes your systems down is usually outside the grant even though your loss is identical.

The limit on the declarations page is not the number the policy pays. Several things stand between an incident and a payment, and they compound.

The grant that surprises people most is fraudulent payment. Losing money to business email compromise is a transfer your own staff authorized, so it sits outside the core data breach coverage and is usually written as its own grant with its own, much smaller sublimit. Some wordings only respond when the fraudulent instruction arrived through a compromised mailbox of yours, which leaves a spoofed lookalike domain outside cover entirely. Read the trigger, not the heading.

Four more exclusions come up constantly and are worth checking by name on your own wording: betterment, so the policy restores the system you had rather than the upgrade you wish you had; prior known incidents, meaning anything you were aware of before the policy started; bodily injury and property damage, which belong to other policies even when a cyber event caused them; and contractual liability, meaning penalties you agreed to in a customer contract that you would not have owed at law.

Why Cyber Insurance Claims Get Denied

The regulator's own numbers here beat any anecdote, and they are not comforting on first reading. Across the policies reported to the NAIC for 2024, insurers closed 9,941 cyber claims with a payment and 28,555 without one, which the report describes as nearly three times as many closed without payment as with. On excess layers, where a claim has to burn through everything beneath it first, unpaid closures outnumbered paid ones by more than 20 to 1.

The reason that matters most is that a cyber application functions as a warranty. In 2022 Travelers moved to void a policy issued to International Control Services, an Illinois electronics manufacturer, after a ransomware attack, on the basis that ICS had answered the application question about multi-factor authentication affirmatively while running it only on its firewall. Insurance Journal reported that on August 26, 2022 the parties stipulated to rescission and the court declared the policy null and void from its inception, meaning no coverage for anything, not just that claim. Whoever fills in your application is making a binding statement about your controls, and the person who knows the true answer is not usually the one holding the pen.

How Much Cyber Insurance Do You Need?

There is no published table that maps headcount to a limit, and anyone who hands you one is guessing. Build the number instead from the costs a real event generates for a company your size.

Count the people whose data you hold, because notification and credit monitoring scale directly with that number and arrive first. Add the days you could not trade if your main system were unavailable, priced at your own gross profit per day. Add forensics and breach counsel, which start within hours at specialist rates. Add the regulatory exposure attached to your data classes, which is different for health records than for order histories. Then set the retention at what you could write a check for tomorrow without borrowing, because the retention is the part you have definitely agreed to pay.

How to Lower Your Cyber Insurance Premium

Controls move this price more reliably than shopping does, because they change the risk rather than the seller.

Companies that outsource monitoring should be specific about what they bought, because managed detection and response with 24 hour coverage answers a different application question than a help desk watching alerts during office hours.

Is Cyber Insurance Worth the Cost?

For most companies a contract or a lender has already decided. The useful version of the question is what to buy, and when.

How to Get a Cyber Insurance Quote

Comparable quotes need a written scope, the same way any other professional service does. Write down your revenue, headcount, the systems that hold data, the record counts and your honest control posture before the first call. Ask two or three brokers to quote the same limit and the same retention so the premiums mean something against each other. Then ask four questions about the wording rather than the price: the sublimits for extortion and funds transfer fraud, the business interruption waiting period, whether the panel counsel and forensics list can be extended to include your own firms, and how this particular state-backed attack exclusion defines attribution.

The panel question matters more if you already hold an incident response retainer, because a policy that pays only its own panel firms turns your retainer into a second bill rather than a discount. Sort that out at binding, not at 2am on the day it matters.