How much does cyber insurance cost for a small business in 2026?

Roughly $500 to $3,500 per year for a $1M limit for most small businesses, based on 2026 industry estimates. Sub-$1M-revenue firms with strong controls (MFA, EDR, tested backups) sit at the low end; data-heavy industries and weak controls push costs up. Mid-market firms typically pay $3,000-$8,000+.

What security controls do cyber insurers require?

The big three are multi-factor authentication on email, remote access, and admin accounts; endpoint detection and response (EDR); and offline, tested backups. Missing controls can double premiums or lead to declined applications.

Is cyber insurance worth it for a small business?

Reported U.S. cybercrime losses hit $20.9 billion in 2025 per the FBI's IC3, with business email compromise at $3.0 billion. A single funds-transfer fraud or ransomware event can exceed years of premium; the coverage also buys access to breach counsel and incident-response teams most small firms could not retain alone.

Does a cyber policy limit of $1M cost twice as much as $500K?

No — limit increases are not linear. Going from $500K to $1M typically adds well under double the premium, which is why $1M has become the standard small-business limit, and why many contracts now require it.

How Much Does Cyber Insurance Cost in 2026? (Small Business Rates by Revenue)

Quick answer: In 2026, most small businesses pay roughly $500 to $3,500 per year for a $1M cyber policy — the low end for sub-$1M-revenue firms with good security controls, the high end for multi-million-revenue firms, data-heavy industries, or weak controls. Mid-market firms ($5M–$20M revenue) typically run $3,000–$8,000+. The three biggest price levers you control: multi-factor authentication, endpoint detection, and tested offline backups.

Cyber is one of the few insurance lines where your own IT hygiene directly and immediately moves the premium. Underwriters price off an application that reads like a security audit — and after several brutal loss years, they check. Here is how the pricing actually works in 2026.

Typical annual premiums by revenue (industry estimates, $1M limit)

Annual revenue	Typical range	What pushes you high in band
Under $1M	$500 – $1,500	Storing customer PII/payment data; no MFA
$1M – $5M	$1,200 – $3,500	Healthcare, legal, finance data; prior incidents
$5M – $20M	$3,000 – $8,000	Large employee count, weak email controls, no EDR
$20M+	$8,000 – $25,000+	Complex networks, vendor dependencies, higher limits

Illustrative 2026 industry estimates for a $1M aggregate limit with a modest retention; actual quotes vary widely by industry, data volume, claims history, and — above all — security controls.

What actually sets your price

Security controls. The big three underwriters test for: MFA on email, remote access, and admin accounts; endpoint detection and response (EDR); and offline, tested backups. Missing any of these can double a quote — or get the application declined. Our requirements guide covers the full checklist.
Industry and data. A contractor with a small office network prices very differently from a medical group holding patient records or a firm processing card payments.
Revenue and headcount — proxies for attack surface and business-interruption exposure.
Limits and retention. $1M is the common small-business limit; contracts increasingly demand it. Doubling the limit does not double the price, and taking a higher retention meaningfully cuts premium for firms with cash cushion.
Claims history. A prior ransomware or funds-transfer loss follows you for years.

Why premiums track the threat data

The FBI's Internet Crime Complaint Center logged $20.9 billion in reported cybercrime losses in 2025 — up 26% in a year — with business email compromise alone at $3.0 billion (IC3 2025 Annual Report). Insurers price to that reality: businesses that make the common attacks hard get the good rates. What the policy actually pays for when those attacks land is its own topic — see what cyber insurance covers (and excludes).

Five ways to lower your premium

Turn on MFA everywhere that matters before you apply — it is the single highest-leverage hour of IT work in insurance terms.
Deploy a reputable EDR product on every endpoint; several carriers give explicit credits for named tools.
Keep offline (or immutable) backups and actually test a restore; document it.
Run security-awareness training with records — phishing is still the front door.
Have a written funds-transfer verification procedure (callback on any banking change). It targets the single most expensive loss type.

Want a real number for your business? We broker cyber coverage nationwide, know what underwriters ask, and can tell you which security controls actually move your premium.

Call (818) 356-8150 or start online.

Get a Cyber Insurance Quote

Cyber Policy Quotes is a division of Thrive Risk Management (CA License #6012320). This article is general information, not a quote or a contract. Premium ranges are illustrative 2026 industry estimates and vary by risk, carrier, and state. Coverage is subject to the terms of the issued policy.