Cyber Insurance for Small Businesses

Cyber insurance has become a practical necessity for small businesses, nonprofits, and local governments—often because a customer, lender, or grant program requires it. But the market is uneven. Two policies with the same headline limit can differ enormously in what they actually pay for. And 74% of claims are denied.

This page is a starting point for building a shortlist. Use the table to narrow candidates, then use the questions to ask to compare quotes on the terms that decide whether a claim gets paid.

For a comprehensive guide to cyber insurance coverage, exclusions, costs, and why claims fail, see Cyber Insurance for Small Businesses: Coverage, Exclusions, and Why Most Claims Are Denied.

Insurance Is Risk Transfer, Not Risk Reduction

This is the single most important thing to understand before buying. Insurance pays out after an incident. It does not make an incident less likely, and it does not restore your data, your reputation, or your customers' trust.

It also increasingly depends on controls you already have in place. Carriers now underwrite on your security posture, and most applications ask you to attest to specific controls—multi-factor authentication, tested backups, endpoint detection. Those answers are warranties. If you attest to MFA and a claim investigation finds it was not actually enforced, the carrier may deny the claim outright. Answer the application carefully and truthfully, and fix the gaps before you sign rather than after.

Treat insurance as a complement to a managed service provider and a written cybersecurity plan—never a substitute for either.

Know What You Are Buying

The companies below are not all the same kind of business. How you buy affects what you can negotiate:

• Traditional carrier — an established insurer writing cyber as one line among many. Usually purchased through an agent or broker, often bundled with your other business coverage.
• Insurtech carrier — a technology-first insurer that underwrites using continuous scanning of your external attack surface. Many bundle security monitoring or alerting with the policy, which can be genuine added value for an organization with no internal security staff.
• Digital broker — not an insurer. A broker shops multiple carriers on your behalf and places the policy. Useful when you want comparison without contacting carriers individually, but confirm which carrier actually ends up holding the risk.

Provider Comparison

Disclaimer: The companies listed below are provided solely as a convenience to small businesses, nonprofits, and local governments researching cyber coverage. CSFSafe is not an insurance agent, broker, or advisor, does not sell insurance, and receives no compensation from any company listed. Nothing here is insurance advice or a recommendation of any policy or carrier. Availability, appetite, policy terms, and pricing vary by state, industry, and account, and change frequently—confirm all details directly with the carrier or a licensed broker. Organizations should conduct their own due diligence and consult a licensed professional before purchasing coverage.

Showing 18 of 18 providers.

Questions to Ask Before You Buy

Comparing cyber quotes on price and headline limit alone is how organizations end up underinsured for the loss they actually suffer. Ask these, and get the answers from the policy wording—not the quote summary.

• What are the sublimits? This is the biggest practical gap. Social engineering and funds transfer fraud are usually sublimited far below the policy limit—a $1M policy may carry only $25K–$100K for a fraudulent wire. That is the loss small businesses most often actually experience.
• Is ransomware and extortion covered, and at what limit? Confirm whether ransom payments, negotiation, and the recovery work afterward are all covered, and whether extortion carries its own sublimit.
• Admitted or surplus lines? Admitted carriers are state-licensed and backed by the state guaranty fund if the insurer fails. Surplus lines are not, but offer more flexible terms. Know which you are buying.
• What is the business interruption waiting period? Many policies do not pay for the first 8–12 hours of downtime. If your outages typically resolve inside that window, the coverage may never trigger.
• Who handles the breach response? Most carriers require you to use their panel of forensics and legal vendors. Ask whether you can use your own MSP or counsel, and whether using them reduces or voids reimbursement.
• What controls are required to bind and keep coverage? Get the list in writing. Treat every control you attest to as a warranty you must actually maintain for the full policy term.
• How does the war and nation-state exclusion read? Carriers have tightened this considerably. Given that state-sponsored actors now routinely hit ordinary infrastructure, ask specifically how the exclusion would apply to an attack later attributed to a foreign government.
• Claims-made or occurrence, and what is the retroactive date? Most cyber policies are claims-made. A breach that began before the retroactive date may not be covered even if you discover it while insured.
• Is there a dependent business interruption clause? If your MSP, payment processor, or key SaaS vendor goes down and takes you with it, standard business interruption may not respond.

Strengthen Your Position Before You Apply

The controls carriers ask about on the application are the same ones that reduce your risk of needing to claim: enforced multi-factor authentication, tested and isolated backups, endpoint detection, patching discipline, and a written incident response plan. Organizations that can document these honestly get better terms and fewer coverage disputes. Building that documentation before you shop—rather than scrambling to answer an application—is the highest-leverage thing you can do.

What's Changing in 2026: AI Exclusions and New Requirements

The cyber insurance market shifted significantly in 2026. Insurers are adding new exclusions and requirements that directly affect your coverage:

• AI exclusions are now standard. 42% of companies report AI-related exclusions in their cyber policies. Insurers are excluding losses related to shadow AI (unauthorized AI tools) and autonomous AI agents. If your organization uses AI tools, ask your carrier explicitly whether the policy covers losses involving AI.
• EDR/XDR is increasingly required. Carriers now require endpoint detection and response (EDR) or extended detection and response (XDR) monitoring as a condition of coverage, often with proof of 24/7 monitoring by a Security Operations Center.
• Premium increases are closing the window. S&P forecasts 15–20% increases in premiums in 2026. If you are considering renewal or new coverage, locking in rates now is advantageous.
• AI security credits are available. Conversely, 80% of companies using AI-powered defenses now receive premium credits and reductions. Demonstrating active, defended use of AI for security can lower your costs.

Last updated: August 31, 2026