Cyber Insurance for Small Business in the US

Why small businesses are targeted

Small businesses are not collateral damage in cyber attacks. They are targeted because attackers know SMBs typically have weaker defenses than enterprises but hold valuable customer data. The statistics are sobering: 43% of all cyberattacks target small and medium-sized businesses.

A typical ransomware attack costs a small business $120,000–$150,000 in recovery, downtime, and related expenses. More devastating: 60% of small businesses close within six months of a major cyberattack. Not because the technical damage is irreversible, but because they lack cash reserves and expertise to recover. Cyber insurance bridges that critical gap.

What it costs in the US

US small business cyber insurance is more affordable than many owners assume. Pricing varies by revenue, employees, and industry:

• Micro-business: Under $500K revenue, 1–5 staff: $500–$1,200/year
• Small business: $500K–$5M revenue, 6–25 staff: $1,200–$2,500/year
• Growing: $5M–$20M revenue, 26–50 staff: $2,500–$3,500/year

Most small businesses can get robust cyber insurance for under $150 per month. Compare that to a single ransomware attack or week of downtime.

What small business cyber insurance covers

• Ransomware recovery. Covers incident response, forensic investigation, and recovery costs. Some policies negotiate ransom payment on case-by-case basis.
• Business interruption. Covers lost revenue while systems are offline. Critical for businesses with no cash reserves.
• Data breach notification. Covers customer notification costs, credit monitoring, and legal defense.
• Incident response. Immediate access to forensic investigators and recovery specialists you could never afford alone.
• Legal defense. Covers solicitor fees if customers sue or regulators investigate.

Top cyber risks for US small businesses

These are the attacks actually targeting SMBs right now:

• Phishing and email compromise. 90%+ of attacks start with a phishing email. Someone clicks a fake invoice or password reset. The attacker gains network access.
• Ransomware. Once inside, attackers deploy ransomware to encrypt your data. Small businesses are hit hard because they have few offline backups.
• Invoice fraud. Attackers compromise email and send fake invoices. You pay the attacker instead of your supplier.
• Employee error. Your team misconfigures cloud storage, accidentally emails sensitive data, or uses weak passwords.
• Supply chain compromise. You are breached not through your systems, but through a vendor or supplier's network.

SBA and government support for small business cyber protection

The US government provides free and low-cost resources for small business cybersecurity:

• CISA Cybersecurity Assessments. The Cybersecurity and Infrastructure Security Agency offers free vulnerability assessments to small businesses.
• SBA free counseling. The SBA partners with SCORE to provide free cybersecurity counseling to small business owners.
• State cyber subsidies. Several states (California, New York, Texas) offer free or subsidized cyber insurance for small businesses under 50 employees.
• NIST Cybersecurity Framework. Free guidance aligned with small business needs, not just enterprise requirements.

What insurers expect from small businesses

• Multi-factor authentication (MFA). Enable MFA on email and critical cloud applications.
• Endpoint protection. Use antivirus or EDR on all computers and mobile devices.
• Regular backups. Back up critical data daily and store at least one backup offline.
• Email security. Use email filtering to block phishing.
• Security training. Train staff to spot phishing and report suspicious activity.

These are table stakes. The good news: all are achievable for small businesses at minimal or no cost.