What cyber insurance costs, and how to pay less for better cover

The short answer

As of 2026, Insureon reports that its small business customers pay a median of about $129 a month, or roughly $1,552 a year, for cyber insurance. Annual premiums in its data range from about $400 to more than $8,000. Those figures come mostly from very small businesses, many with fewer than five employees, so a company with 25 to 100 people, more records or higher limits should expect to pay more. Your actual price depends on your industry, revenue, the amount of sensitive data you hold, the limits and deductible you choose and, increasingly, the security controls you can prove.

The good news for buyers: according to Marsh, U.S. cyber insurance rates fell 2 percent in the second quarter of 2026, part of a decline that began in 2023. Prices are stable, but underwriters still ask hard questions.

Published cost figures, in context

• Median premium: about $129 a month ($1,552 a year), from Insureon’s data on roughly 100,000 small business customers, updated April 2026.
• Spread: 41 percent of those customers pay under $100 a month and 26 percent pay $100 to $200.
• Industry gap: Insureon’s IT customers average $179 a month, while finance customers average $59. Industry risk and the type of data you hold move the price a lot.
• Typical deductibles: $1,000 to $2,500 for Insureon customers.
• Typical limits: $1 million to $5 million.
• Market direction: Marsh’s Global Insurance Market Index showed U.S. cyber rates down 2 percent in Q2 2026 and global cyber rates down 4 percent, the twelfth straight quarterly decline.

Treat these as reference points, not a quote. Insureon is a broker reporting its own book of business, and rates vary by carrier and state.

What drives your premium

1. Revenue and size. Larger businesses have more to lose in an outage and more records to notify.
2. Industry. Healthcare, legal, financial and professional services hold sensitive data and pay more. So do IT firms that could pass an incident on to clients.
3. Records held. The number of Social Security numbers, patient files and card numbers you store drives breach response costs.
4. Limits and deductible. A $2 million limit costs more than $1 million. A higher deductible lowers the premium, but only choose one you can pay during a crisis.
5. Coverage options. Social engineering and funds transfer fraud, business interruption and dependent business interruption from a vendor outage all add cost.
6. Claims history. A prior ransomware event or wire fraud loss raises prices or narrows terms.
7. Security controls. Carriers use your application, and often an external scan of your internet-facing systems, to price risk.

The controls that lower your price

Underwriters focus on the controls that stop the most expensive claims, ransomware and email fraud. Having these in place, and being able to show them, is the most reliable way to get better terms:

• Multi-factor authentication on email, remote access, admin accounts and cloud apps
• Endpoint protection, ideally with detection and response, on every computer and server
• Backups that are separate from your network, monitored and tested with real restores
• Prompt security updates, especially on firewalls, VPNs and other internet-facing systems
• Email filtering plus SPF, DKIM and DMARC on your domain
• A callback rule for any change to payment instructions
• Security awareness training and phishing tests
• A written incident response plan
• Quick removal of former employees’ access

Patching matters more than ever to insurers. Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities were the most common way attackers first got in, at 31 percent of breaches. Our separate guide to cyber insurance requirements in 2026 walks through what applications ask for in detail.

Want to see how your controls look to an underwriter? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, business continuity and technology spending, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

What you are paying for

When comparing quotes, check which of these parts are included and at what limit:

How to estimate your own budget

There is no reliable published average for a 25 to 100 person business, because carriers price each one individually. You can still get a realistic range before you talk to a broker.

1. Count your records. Add up current and former customers, patients and employees whose personal data you still hold. This drives breach response cost.
2. Estimate outage cost. Work out what one week without email, files and your main software would cost in lost revenue and overtime. This sets your business interruption limit.
3. Check contract requirements. Clients, landlords and lenders sometimes require a minimum cyber limit.
4. Pick two or three limit options, such as $1 million, $2 million and $3 million, and ask for each.
5. List your controls honestly using the checklist above. Gaps raise the price or limit coverage, so close the easy ones first.

Then ask your broker for quotes at each limit with the same deductible so the numbers are comparable. Revisit the estimate each year as you add people, locations or new kinds of data.

How to compare quotes fairly

1. Line up limits and sublimits. A cheap policy with a $100,000 ransomware or fraud sublimit is not the same product as one with full limits.
2. Compare retentions. Look at the deductible and any waiting period for business interruption, often measured in hours.
3. Check the vendor panel. Many carriers require you to use their approved breach lawyers and forensic firms.
4. Read the exclusions. Look for war and state-backed attack language, unpatched system exclusions and failure-to-maintain-controls clauses.
5. Ask about retroactive dates. An incident that began before the policy start may not be covered.

Ways to lower cost without losing protection

• Fix gaps before you apply or renew. Carriers often price or decline based on missing MFA and backups.
• Answer the application accurately. A cheaper premium based on overstated controls can cost you the claim.
• Choose a deductible you could actually pay next week.
• Work with a broker who places cyber regularly and can shop several carriers.
• Keep proof of controls ready: MFA reports, backup test records, update status.

JLB USA does not sell insurance. Our cybersecurity services put the controls insurers ask about in place, and we help clients answer cyber-insurance questionnaires accurately. Policy terms vary, so confirm coverage details with your broker or insurer.

Keep reading

• Cyber insurance claim denied? Why it happens and how to prevent it
• User access review process: how to run quarterly reviews in a small business
• Is dark web monitoring worth it for a small business?
• Backup and disaster recovery for small business: a practical plan

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026