How much does cyber liability insurance cost?

Your own losses and other people’s claims

A cyber policy has two halves, and they are priced separately.

• First-party coverage pays your own costs after a breach or attack. Insureon calls it data breach insurance. It pays for an incident investigation, for notifying affected customers and for related expenses. Insureon says most small businesses need it⁠¹. The Hartford calls this part “response expense”⁠².
• Third-party coverage pays your defense and any damages when someone else sues you over a breach, for example a client claiming you failed to prevent a data breach. The Hartford calls this part “defense and liability”⁠². Insureon notes that tech companies and consultants usually need it. They often buy it bundled with errors and omissions cover as technology E&O ⁠¹.

The Hartford publishes a separate average for each half, which is rare. After its $320 data breach average, it lists “the average annual cost for other core cyber coverages”:

The four averages add up to $320 (our calculation: 140 + 128 + 9 + 43 = 320), the same as the data breach headline, but The Hartford presents them as additional coverages and does not say that they make up the $320 or how many customers buy each one⁠².

What sellers report businesses pay

Insurer- and broker-reported figures from each company’s own customers, as published on its website; not a random sample of all businesses. Figures are rounded as published.

The two published headline numbers differ by a factor of almost five: Insureon’s $1,552 a year against The Hartford’s $320 (our calculation: 1,552 ÷ 320 = 4.85). They measure different things:

1. A median versus an average

   Insureon’s page says “average”, but it states that its figures “are calculated using the median cost of policies sold”⁠¹. The Hartford’s $320 is an average⁠². With a skewed price spread, a median and an average from the same book would also differ. Here the books differ as well.

2. A full policy versus data breach coverage

   Insureon’s figure covers cyber policies its customers bought from several insurers⁠¹. The Hartford’s figure is for what it calls data breach coverage. It also suggests adding cyber to an existing business owner’s policy or general liability policy⁠². The Hartford does not say whether its $320 is for add-on or standalone cover. If it is mostly add-on cover, it belongs with the low-premium endorsement business in the NAIC data below.

3. Different customers and limits

   Insureon’s data comes from about 100,000 small-business buyers, most with fewer than five employees and five years or less in business. Insureon says cyber policy limits typically range from $1 million to $5 million, and deductibles for its customers from $1,000 to $2,500⁠¹. The Hartford gives no sample size, limit or date window⁠².

Within Insureon’s book, 41% of customers pay under $100 a month and 26% pay $100 to $200. That leaves about a third paying $200 a month or more (our calculation: 100% − 41% − 26% = 33%). Annual premiums run from around $400 to over $8,000⁠¹. Business type moves the price more than almost anything else. Insureon reports $179 a month for IT businesses, which usually need tech E&O, against $59 for finance businesses⁠¹. Firms whose work is technology should read the technology companies and consultants pages.

Ransomware and the extortion sublimit

A sublimit caps what the policy pays for one kind of loss, inside the overall limit. The Hartford lists an “Extortion Sub-Limit” as a separately priced coverage, at an average of $9 a year, the smallest of its four coverage averages, and does not publish the sublimit amount behind it⁠². Before relying on a policy for ransomware, read three numbers on the declarations page: the extortion sublimit, the overall aggregate and the retention.

Paying a ransom carries its own rules, apart from the insurance:

• Sanctions risk. New York’s Department of Financial Services (DFS) “recommends against making ransom payments.” It notes that, under 2020 guidance from the Treasury’s Office of Foreign Assets Control (OFAC), intermediaries, insurers included, can be liable for payments to sanctioned entities. Because the attacker is hard to identify during an incident, DFS says “insurers and their policyholders risk violating OFAC sanctions when paying a ransom”⁠⁶.
• Reporting the payment. Businesses licensed by DFS must report any extortion payment within 24 hours. Within 30 days they must file a written explanation of why the payment was necessary⁠⁷.

DFS also named ransomware as the biggest driver of rising cyber underwriting risk. In a 2020 DFS survey, ransomware insurance claims rose 180% from early 2018 to late 2019, and the average cost of a ransomware claim rose 150%⁠⁶. Those are old figures. They show why insurers treat extortion separately, not what it costs in 2026.

Standalone policy or endorsement

You can buy cyber cover in two ways. A standalone (primary) policy covers only cyber risk. An endorsement adds cyber cover to another policy, such as a BOP. From the 2024 data year, the NAIC’s Cyber Supplement splits the market into primary, excess and endorsement business, replacing the old “stand-alone/packaged” split⁠³. The 2024 figures show how differently the two sell:

More than half of all cyber policies are endorsements, and together they bring in 4% of premium. Spread over the policy counts, the average primary policy carries roughly 20 times the premium of the average endorsement (our calculation: (65 ÷ 41.6) ÷ (4 ÷ 55.1) ≈ 21.5). The NAIC does not say whether both percentage splits cover exactly the same insurers, so read the ratio as an order of magnitude⁠³. The NAIC sums it up: endorsements are “high-volume but low-premium products”, and excess layers the opposite⁠³.

Lower cost is not the only difference. The NAIC counts how claims were closed:

About a quarter of closed claims ended in a payment (our calculation: 9,941 ÷ 38,496 = 25.8%)⁠³. The NAIC does not give reasons for closing without payment. For excess policies, claims closed without payment outnumber paid ones by more than 20 to 1⁠³.

Before you rely on a policy that doesn’t mention cyber at all, note what regulators say about it. DFS calls cyber losses under policies that neither grant nor exclude cyber cover “silent” risk. It names general liability, errors and omissions, burglary and theft, and product liability policies as places it hides, and it told insurers to state clearly whether each policy covers or excludes cyber losses⁠⁶. In Q2 2026, Marsh reported that cyber exclusions “remained largely in place” in the property market⁠⁵. A GL or property policy is therefore not a substitute for cyber cover.

How underwriters price a cyber policy

Neither seller publishes a rating formula, but both list the same main factors: limits and deductible, the coverage parts chosen, industry, number of employees, the amount of sensitive data (card numbers, Social Security numbers, health records), security controls and claims history⁠¹⁠². The Hartford adds remote logins, admin permissions, vendor connections and cloud systems: “Each access point adds more complexity and opportunity for attackers”⁠². After a claim, The Hartford says insurers may raise the price, add exclusions or require higher retentions⁠².

The controls underwriters ask about

The Hartford names the controls insurers look for: “multifactor authentication features, regular backups, endpoint detection and response technology (EDR), consistent patching and employee training”. It says they “may help improve your pricing”⁠². Insureon lists firewalls, software updates, multi-factor authentication and a bring-your-own-device policy⁠¹. Neither publishes a discount for any single control.

The regulator’s view matches. DFS’s Cyber Insurance Risk Framework, written for every property/casualty insurer authorized in New York that writes cyber, tells insurers to assess each applicant’s “corporate governance and controls, vulnerability management, access controls, encryption, endpoint monitoring, boundary defenses, incident response planning and third-party security policies”. It also tells them to price “based on the effectiveness of each insured’s cybersecurity program”⁠⁶. In Q2 2026, Marsh reported that some insurers added clarifying AI language, most asking questions on AI exposure, use and controls. It also named third-party software and vendor risk among underwriters’ top concerns⁠⁵.

A worked example: sizing the limit a contract demands

Rhode Island’s standard terms for IT and cyber/privacy contracts set the limit by formula when the vendor handles protected health or personal information. The minimum is the projected number of people whose data you hold, multiplied by $25 per person in breach response expense, but never less than $5 million per occurrence and in the aggregate⁠¹⁰. Our calculation, on two assumptions:

1. A vendor holding records on 100,000 people

   100,000 × $25 = $2.5 million, below the floor, so the required limit is $5 million.

2. A vendor holding records on 300,000 people

   300,000 × $25 = $7.5 million per occurrence and aggregate.

Both sit at or above the top of the $1 million to $5 million range Insureon gives as typical for cyber limits⁠¹. Limit is one of the main drivers of price in both sellers’ lists, so a contract like this can set your premium more than your own risk does⁠¹⁠².

Contracts that require cyber limits

Public buyers write cyber limits into their contracts. Rhode Island’s Schedule A3, for information technology and cyber/privacy contracts, requires⁠¹⁰:

• Information technology/cyber privacy: $5 million per occurrence and $5 million aggregate. Vendors providing key back-office services need $10 million. Vendors handling protected health or personal information need the per-person formula above, at least $5 million. Vendors with access to mission-critical services, network architecture or the totality of confidential data need $20 million.
• Technology errors and omissions: at least $5 million per occurrence and $5 million aggregate.

California’s Department of General Services lists cyber liability among the additional coverages a state contract may require⁠¹¹.

Security laws that are not insurance mandates

Two rules come up often in cyber-insurance discussions. Neither requires you to buy a policy. Both require security controls and incident notices. The controls are the same ones underwriters ask about, and the notices are part of the response costs a policy pays.

• New York DFS, 23 NYCRR Part 500. Part 500 applies to “covered entities”: any person operating under a license, registration, charter or similar authorization under New York’s Banking, Insurance or Financial Services Law⁠⁷. That covers DFS-licensed banks, insurers, agencies and brokers, not New York businesses in general. Multi-factor authentication is required for anyone accessing a covered entity’s systems. The second amendment took effect November 1, 2023, and gave covered entities two years, until November 1, 2025, to comply with this expanded MFA rule⁠⁷. Smaller licensees can claim a limited exemption: fewer than 20 employees and contractors, under $7.5 million revenue in each of the last three years, or under $15 million in assets. They must still use MFA for remote access, for cloud applications holding nonpublic information and for privileged accounts, and they must still file notices⁠⁷⁠⁸. Cybersecurity incidents must be reported within 72 hours⁠⁷.
• FTC Safeguards Rule, 16 CFR Part 314. This rule applies to the financial institutions over which the FTC has jurisdiction. It names an accountant or other tax preparation service that completes income tax returns as a financial institution⁠⁹. It requires multi-factor authentication for anyone accessing an information system, unless the firm’s qualified individual approves an equivalent control in writing. If a notification event involves the information of at least 500 consumers, the firm must notify the FTC within 30 days of discovery⁠⁹. The exception for firms holding data on fewer than 5,000 consumers does not lift either requirement⁠⁹.

DFS’s insurance framework from 2021 is a separate document. It sets expectations for insurers that write cyber, not for the businesses they insure⁠⁶.

The 2024 market, from NAIC filings

The NAIC’s annual report on its Cyber Supplement filings gives market totals, not prices per business⁠³:

• Premium: about $9.14 billion written in 2024, including alien surplus lines insurers, down 7% from $9.84 billion in 2023. The NAIC calls it the market’s first-ever reduction. U.S.-domiciled insurers wrote $7.08 billion, down from $7.25 billion⁠³.
• Surplus lines dominate. Of domestic insurers’ premium, $4.35 billion was surplus lines and $2.74 billion admitted, about 61% surplus lines (our calculation). Counting alien insurers, the shares were 57% domestic surplus lines, 25% admitted and 18% alien surplus lines⁠³.
• Policies flat, claims up. 4,368,614 policies were in force, almost unchanged from 2023. Reported claims rose almost 40%, to nearly 50,000⁠³.
• Loss ratios vary widely by insurer. The NAIC publishes a loss ratio including defense costs for each of the 20 largest groups, not for the market as a whole. The two largest, Chubb and Travelers, ran 36.06% and 53.97%. The range ran from 9.24% for Beazley to 96.26% for Starr, and The Hartford’s was 11.53%⁠³. Those ratios cover each group’s whole cyber book, large accounts included. One year’s ratio for a group does not predict the quote a small business gets from it.

We found no NAIC report on 2025 data as of October 13, 2026.

Prices in 2026

Both 2026 broker surveys show cyber getting cheaper:

• CIAB: member brokers reported cyber renewal premiums down 3.2% on average in Q2 2026. That was a steeper fall than the 2.0% average across all account sizes; small accounts across all lines fell only 0.5%⁠⁴.
• Marsh: U.S. cyber rates fell 2% in Q2 2026, the same as the prior quarter, and have been declining since Q2 2023. Capacity stayed stable, but Marsh says winning reductions “increasingly required approaching a broader group of insurers”⁠⁵. Marsh’s index is its own measure of rate changes at renewal, not a market-wide survey.

Both are averages across renewals. A business with a recent claim, or without MFA and tested backups, can see a different outcome. For every line’s trend side by side, see market trends.

Sources

1. 1
   Insureon, Cyber insurance cost (updated April 24, 2026) Checked 13 Oct 2026 · Back to text ↑
2. 2
   The Hartford, How much does cyber insurance cost? (updated Feb. 25, 2026) Checked 13 Oct 2026 · Back to text ↑
3. 3
   National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025, data year 2024) Checked 13 Oct 2026 · Back to text ↑
4. 4
   The Council of Insurance Agents & Brokers (CIAB), Commercial Property/Casualty Market Index, Q2 2026 Checked 13 Oct 2026 · Back to text ↑
5. 5
   Marsh, Global Insurance Market Index: US insurance rates, Q2 2026 Checked 13 Oct 2026 · Back to text ↑
6. 6
   New York State Department of Financial Services, Insurance Circular Letter No. 2 (2021): Cyber Insurance Risk Framework (Feb. 4, 2021) Checked 13 Oct 2026 · Back to text ↑
7. 7
   New York State Department of Financial Services, 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies (as amended Nov. 1, 2023) Checked 13 Oct 2026 · Back to text ↑
8. 8
   New York State Department of Financial Services, Cybersecurity exemptions Checked 13 Oct 2026 · Back to text ↑
9. 9
   eCFR, Office of the Federal Register, 16 CFR Part 314, Standards for Safeguarding Customer Information Checked 13 Oct 2026 · Back to text ↑
10. 10
    Rhode Island Office of Accounts and Control, Risk Management, Standard insurance requirements (contracts and third-party vendors) Checked 13 Oct 2026 · Back to text ↑
11. 11
    California Department of General Services, Contract Insurance Requirements: when doing business with California state government Checked 13 Oct 2026 · Back to text ↑

Spotted an outdated figure? Report an error