Cyber Liability Insurance for Small Businesses
What small business cyber insurance covers, the difference between first-party and third-party coverage, common gaps like funds transfer fraud, and how to lower your risk.
Small businesses often assume hackers only go after big companies. In reality, small businesses are attractive targets because they tend to have fewer defenses. A single phishing email can lead to stolen funds, encrypted files or exposed customer data. Cyber liability insurance is designed to help with the costs of these events.
First-party coverage: your own costs
First-party coverage pays for losses your business suffers directly. Depending on the policy, this can include:
- Breach response: forensic investigators, legal advice and customer notification.
- Data restoration: recovering or recreating lost or corrupted data.
- Business interruption: lost income while systems are down.
- Cyber extortion: responding to ransomware demands, subject to the policy and applicable law.
- Credit monitoring for affected customers.
Third-party coverage: claims against you
Third-party coverage responds when others hold your business responsible, for example:
- Customers whose data was exposed.
- Regulatory investigations, where insurable.
- Payment card industry assessments after a card data breach.
- Claims that malware spread from your systems to a client's.
Breach notification laws
Every US state has a data breach notification law requiring businesses to notify affected people in certain situations. The rules differ on what counts as personal information, deadlines and who must be told. Legal guidance and notification costs can add up quickly, which is one reason breach response coverage is valuable.
Common gaps to check
| Scenario | What to ask |
|---|---|
| Employee tricked into wiring money | Is social engineering or funds transfer fraud covered, and at what limit? |
| Outage at a cloud provider you rely on | Is dependent (contingent) business interruption covered? |
| Unpatched systems | Are there conditions requiring security controls like multi-factor authentication? |
| Prior incidents | Is there a retroactive date that excludes earlier breaches? |
Lowering your cyber risk
- Turn on multi-factor authentication for email, banking and key accounts.
- Keep devices and software updated.
- Back up important data regularly, with at least one copy offline or separate.
- Train staff to recognize phishing and to verify payment changes by phone.
- Collect and keep only the customer data you actually need.
Many insurers now ask about these controls on the application, and having them can affect eligibility and price.
Frequently asked questions
Do small businesses really need cyber insurance?
Any business that uses email, accepts card payments, stores customer information or relies on computers faces cyber risk. Whether a policy is worth it depends on how much data you handle and how much a disruption would cost you.
Does general liability cover a data breach?
Generally not in a meaningful way. Many general liability policies exclude or sharply limit data-related claims, which is why separate cyber coverage exists.
Is a fake invoice or email scam covered by cyber insurance?
It depends. Social engineering fraud, where an employee is tricked into sending money, is often covered only through a specific insuring agreement or endorsement, sometimes with a lower limit.