A Guide to Cyber Insurance for Small Businesses

Cyber insurance has quickly shifted from a niche product to an essential safeguard for any small or medium-sized enterprise (SME) in the UK. As our reliance on digital systems grows, threats like ransomware, data breaches, and phishing attacks are no longer just a concern for large corporations. For a small business, the financial and reputational fallout from a cyber incident can be devastating, making a specialist insurance policy a critical part of your risk management strategy.

This guide explains what cyber insurance is, what it covers, and why it’s crucial for protecting your business. We’ll also look at how you can take practical steps to reduce your cyber risks - and potentially lower the cost of your insurance premium.

Why Do Small Businesses Need Cyber Insurance?

Cybercriminals often view smaller businesses as attractive targets, assuming they lack the sophisticated security budgets and resources of larger companies. The government’s most recent statistics show this perception is borne out by reality. The Cyber Security Breaches Survey 2026 found that 46% of small businesses identified a cyber security breach or attack in the previous 12 months.

The financial impact of an attack can be severe, with the average cost of a claim for an SME running to around £40,000. This doesn’t account for the disruption to your business, damage to your reputation, or potential regulatory action. Under the UK’s data protection laws, the Information Commissioner’s Office (ICO) has the power to issue fines of up to £17.5 million or 4% of global turnover for serious failures. Whilst insurance policies cannot cover regulatory fines, they can often cover the significant legal and defence costs associated with an investigation.

What Does Cyber Insurance Typically Cover?

A good cyber insurance policy provides a comprehensive response to an incident, covering both the immediate crisis and the longer-term financial consequences. Policies vary, but core cover usually includes:

• Incident Response: Immediate, 24/7 access to a team of experts, including IT forensic investigators, legal advisors, and public relations specialists to help you manage the incident, contain the threat, and mitigate the damage.

• Data Recovery and System Restoration: The cost of repairing, restoring, or replacing your data and IT systems that have been damaged, corrupted, or compromised.

• Business Interruption: Compensation for the income you lose and the increased costs of working if a cyber attack prevents your business from trading as normal.

• Cyber Extortion and Ransomware: Cover for the costs of specialist negotiators to handle a ransomware demand and, where it is legal to do so, the ransom payment itself.

• Legal and Regulatory Costs: The legal fees involved in defending your business against claims or regulatory investigations following a data breach.

• Cybercrime Cover: Protection against direct financial losses resulting from online fraud, such as phishing, social engineering, or fraudulent payment instructions.

First-Party vs Third-Party Cover

Cyber policies are usually structured with two main components: first-party and third-party cover.

• First-party cover addresses the direct losses your own business suffers. This includes the costs of data recovery, business interruption, and responding to an extortion demand.

• Third-party cover protects you against claims made by others who have been affected by a cyber incident originating with your business. This could be customers, suppliers, or partners. It covers your legal liability for damages and the cost of defending yourself. This type of liability cover is distinct from other policies you may hold; our guide ‘What Is Professional Indemnity Insurance?’ explains the differences in more detail.

Common Policy Exclusions

It’s vital to read your policy documents and understand what is not covered. Common exclusions include:

• Known Vulnerabilities: Insurers are unlikely to pay out for losses that result from your failure to apply a critical security patch that was widely available before the incident occurred.

• State-Sponsored Attacks: Following a mandate from the insurance market, many policies now include clauses that exclude losses from cyber attacks attributed to a nation-state. Lloyd’s of London has provided guidance on this to ensure clarity for policyholders.

• Social Engineering: Losses from scams like invoice fraud may not be covered as standard and often require a specific extension or endorsement to your policy.

• Reputational Damage: While policies often include PR support to help manage your reputation, they do not typically offer direct financial compensation for loss of brand value or customer trust.

How to Reduce Your Cyber Risk and Premiums

When you apply for cover, insurers will assess your business’s cyber security posture to determine your risk profile and calculate your premium. By taking proactive steps to improve your security, you not only reduce the chance of an attack but can also earn premium reductions of between 10-40%.

Achieve Cyber Essentials Certification

The government’s Cyber Essentials scheme is a fantastic starting point. It provides a clear framework for basic cyber hygiene. As an added incentive, many UK-domiciled businesses with a turnover under £20 million that achieve certification through the official partner, IASME, automatically receive free cyber liability insurance with a £25,000 indemnity limit.

Implement Basic Security Controls

Insurers expect to see fundamental security measures in place. According to the government’s latest survey, most businesses are already doing this, with 81% using malware protection and 74% maintaining cloud backups. Regular staff training on phishing awareness is also crucial, as human error remains a factor in a high percentage of breaches. Finally, enforcing strong password policies and implementing multi-factor authentication (MFA) wherever possible adds a critical layer of defence that insurers look for.

How Much Does Cyber Insurance Cost?

The cost of cyber insurance for a small business in the UK varies based on your annual revenue, industry, the volume of data you handle, and your existing security controls. Based on market data from leading insurers like Hiscox, a micro-business with good security can find cover starting from around £130 per year. Most SMEs can expect to pay between £350 and £5,000 annually for a standalone policy. For sole traders with minimal data risk, entry-level policies can be found for as little as £6 to £15 per month.

Is Cyber Insurance Worth It?

In an increasingly digital world, cyber insurance is no longer a ‘nice-to-have’ but a fundamental part of a robust risk management strategy. The potential costs of an attack - from financial loss and operational downtime to reputational damage and regulatory scrutiny - can be crippling for a small business. By understanding the threats, implementing strong security measures, and securing the right insurance cover, you can give your business the resilience it needs to trade with confidence.