Ask a business owner whether they have cyber insurance, and the answer is usually yes.
Look at the policy and, more often than not, it is a small line on another policy, with a limit smaller than the losses it is meant to cover.
Most small businesses never bought it. We are not insurance people. We look after the computers, the email and the security for businesses like yours. But cyber insurance keeps coming up, because more and more of what an insurer asks about is our work. So I went looking at the numbers, and they surprised me.
Who buys cyber insurance
Business owners who say they buy it, US, 2026
The reason is rarely that they decided against it. Among small business owners without it, 29% said they do not know enough about cyber insurance, and 24% did not know it was available.
Many who have it, barely do. Most cyber coverage sold today is an add-on, an endorsement, to the business policy that already covers the building and liability. It is convenient and cheap, often a few hundred dollars a year, and it usually comes without anyone checking your security. It also comes with a small limit.
Most cyber policies are add-ons. They carry almost none of the coverage.
Share of US cyber policies in force, and of cyber premium, 2025
The limit is where it bites. The most common claim for a small business is a fake invoice or a hacked mailbox that ends with money wired to the wrong account. Those losses are larger than most add-ons pay.
A typical add-on, against the losses it is meant to cover
Thousands of dollars
Saying "I have cyber" and having coverage for the thing most likely to happen are not the same.
The real policy asks for proof. A real cyber policy is underwritten. Before it is written, and at every renewal, the insurer asks what you have in place. Answer too hopefully, and the policy can be voided after a claim. That is what happened in a 2022 case, Travelers v. ICS, when the application said MFA was in use and it was not everywhere. The questions are close to the same everywhere:
Three questions for your broker. I am not an insurance agent, and nothing here is insurance advice. Your broker is the right person for that. These are the questions I would ask them.
- Is my cyber coverage its own policy, or a line on my business policy? If it is a line, ask what it covers and what it leaves out.
- What is my limit for a fake invoice or a wire sent to the wrong account? This is often a smaller limit inside the policy, and it is the most likely claim.
- What will you ask me to prove at renewal? Get the questions early, so the answers are true when you sign.
Where we come in. We do not sell insurance. We do the work the insurer asks about: the second step at sign-in, the tested backups, the protection on every computer, and the record that proves it. When the form arrives, the answers are already true, and already written down. Here is what insurers usually ask for.
Nothing in this note is insurance or legal advice.
