What Cyber Insurance Covers (and What It Actually Costs)

What Cyber Insurance Covers (and What It Actually Costs)

Cyber insurance covers two broad things. First-party coverage pays your own costs after an incident: incident response and forensics, data restoration, business interruption while systems are down, ransom payments where lawful, and customer notification. Third-party coverage pays for claims other people bring against you: lawsuits from customers or partners whose data was exposed, regulatory defense costs, and contractual penalties. Most policies bundle both, with separate limits and deductibles for each piece.

On cost: for a small business, a policy with a million dollars in limits commonly lands somewhere in the low four figures per year, while larger firms, higher limits, and higher-risk industries pay considerably more. Those are market ranges, not quotes — premiums move with your revenue, your industry, your security controls, and the claims market itself, so the only real number is the one on a current quote.

First-party coverage: your own losses

• Incident response. Forensics to figure out what happened, legal counsel (often called breach counsel), and crisis PR. Many carriers provide a response panel — using their approved vendors is frequently a condition of coverage.
• Data restoration. Rebuilding systems and recovering data after ransomware or destructive attacks.
• Business interruption. Lost income and extra expenses while you are down — often the largest real-world loss for a small business. Watch the waiting period (a set number of hours before coverage starts) and how the policy calculates lost income. Some policies extend this to outages at your key vendors, called contingent business interruption.
• Cyber extortion. Ransom negotiation and payment where legal, plus the specialists who handle it.
• Notification and monitoring. Legally required breach notifications, call-center costs, and credit monitoring for affected people.

Third-party coverage: claims against you

• Privacy and network liability. Defense and damages when customers, patients, or business partners sue over exposed data or over an attack that spread from your systems to theirs.
• Regulatory proceedings. Defense costs for investigations under HIPAA, state privacy laws, and similar regimes, and fines where the law allows them to be insured.
• Payment card penalties. PCI-related fines and assessments after a card-data breach, usually as a specific coverage part.

The endorsement that bites: social engineering

Wire fraud — an attacker impersonating a vendor or executive and talking your team into sending money — is one of the most common losses small businesses actually suffer, and base cyber policies often exclude it or cap it with a small sublimit. If you pay vendors electronically, ask specifically about social engineering / funds transfer fraud coverage and read the sublimit. A policy with a large headline limit and a tiny social-engineering sublimit can leave the most likely loss mostly uninsured.

What drives your premium

• Revenue and industry. Healthcare, finance, legal, and anyone holding large volumes of personal data pay more.
• Records and data types. More records, and more sensitive ones, mean bigger potential notification and liability costs.
• Security controls. MFA everywhere, EDR on endpoints, tested offline backups, security awareness training, and an incident response plan directly lower premiums — and their absence increasingly means declined applications rather than just higher prices.
• Limits and retention. Higher limits cost more; a higher deductible (retention) brings premiums down in exchange for more risk on your side.
• Claims history. A prior incident follows you for years of renewals.

Common exclusions and gotchas

• Failure to maintain controls. If the application said MFA was deployed everywhere and the entry point was an account without it, the carrier can contest the claim. The application is a warranty, not a survey.
• Known prior incidents. Anything that started before the policy period is out.
• War and state-sponsored attacks. Carriers have tightened these exclusions; wording varies a lot between policies and matters more than it looks.
• Unsupported systems. Some policies exclude or limit losses traced to end-of-life software that no longer receives patches.
• Betterment. The policy restores what you had; it does not buy you the upgraded environment you should have had.

How to buy it well

Work with a broker who writes cyber regularly, and size limits from a realistic incident scenario — days of downtime plus response costs plus notification — rather than a round number. Answer the application truthfully with your IT team or provider in the room, because the technical questions are precise and wrong answers void coverage exactly when you need it. And before you apply, get the controls in place: we covered the specific checklist carriers now demand in our guide to cyber insurance requirements in 2026. Better controls do double duty — fewer incidents and a cheaper, smoother renewal.

Equal Tech Solutions helps businesses in Cleveland, Chattanooga, and across the Southeast US get insurance-ready: implementing the required controls, completing the technical side of applications accurately, and documenting it all for the carrier. Our cybersecurity services map directly to what underwriters ask for. Contact Equal Tech Solutions before your next application or renewal — and confirm any tax treatment of premiums with your CPA.