Do I Need Cyber Insurance in the US?

The quick answer

If your US business handles customer data, processes payments online, operates in healthcare or finance, or has 11+ employees, you almost certainly need cyber insurance. The question is not "do I need it?" but "how much coverage and what limits make sense for my risk profile?"

You probably need cyber insurance if...

• You store customer personal data (names, emails, addresses, Social Security numbers, payment info)
• You process credit or debit card payments (PCI DSS compliance requires insurance)
• You hold healthcare records (HIPAA-covered entities must have cyber cover)
• You operate in a regulated state like California, New York, or handle regulated data
• Your business would stop if your IT systems went down for 24+ hours
• You use cloud services (Microsoft 365, Google Workspace, AWS, Salesforce)
• You have more than 10 employees or generate more than $1M in annual revenue
• You're in financial services, healthcare, legal, technology, or e-commerce
• You have remote or hybrid workers accessing company systems
• Larger clients require proof of cyber insurance as a contract condition

The US breach landscape

43% of cyber attacks target small businesses with fewer than 1,000 employees. This myth that "we're too small to be targeted" costs businesses hundreds of thousands of dollars every year.

The average cost of a breach in the US is now $165,000 per 1,000 records exposed. A breach affecting 10,000 customer records — entirely plausible for a retail business — costs $1.65 million in forensics, legal defence, notification, credit monitoring, and regulatory fines.

60% of small businesses that suffer a major cyber attack close within 6 months. It's not just the direct costs — it's the operational disruption, customer trust loss, and cash flow impact.

Regulatory obligations that make insurance essential

The US regulatory framework is fragmented across federal, state, and industry levels. All 50 states have data breach notification laws, but several specific regimes drive insurance requirements:

• HIPAA (federal): Healthcare providers, insurers, and business associates must protect patient data and report breaches within 60 days. Breach notification costs alone can exceed $100K. Insurance is effectively mandatory.
• CCPA/CPRA (California): Applies to for-profit companies handling California residents' data. Requires data breach notification within 30–45 days and $2,500–$7,500 per violation civil liability. Cyber insurance reduces exposure significantly.
• NYDFS Cybersecurity Requirements (New York): Applies to financial services companies. Mandates MFA, encryption, incident reporting within 72 hours, and cybersecurity audits. New York companies face higher cyber insurance premiums due to compliance burden.
• SEC Rules (public companies): Public companies must disclose material cybersecurity incidents to shareholders. The reputational and legal costs create additional liability.
• PCI DSS (payment processors): Any company processing payment cards must comply with PCI DSS standards. Non-compliance triggers card network fines and reputational damage.

Operating in California, New York, or handling healthcare data? You're in a high-compliance environment where cyber insurance isn't optional — it's a business necessity.

Industries where cyber insurance is critical in the US

What happens without cyber insurance?

If you're hit by a breach and don't have coverage, you pay all costs out of pocket:

• Incident response and forensics: $15,000–$50,000+ to investigate and recover
• Legal defence: Customers filing lawsuits over identity theft or data loss, defence costs $25,000–$100,000+
• Notification and credit monitoring: $50–$200 per affected individual. A 10,000-person breach costs $500,000–$2M
• Regulatory fines: State Attorney General investigations, HIPAA fines, CCPA penalties all come directly from your cash flow
• Business interruption: Lost revenue while systems are down or compromised — potentially weeks without income
• Reputational and PR costs: Managing crisis communications, customer retention efforts
• Director and officer liability: Personal liability for company leadership when breaches involve negligence

When cyber insurance might be optional (rarely)

There are narrow, specific situations where you might consider deferring cyber insurance, but these are increasingly uncommon:

• True solo practitioners with zero customer data: If you're a freelancer handling no sensitive information and storing nothing digitally, risk is lower. But can you really say you hold zero data?
• Very early stage pre-revenue startups: A startup with no customers and minimal systems has lower risk. But the moment you sign a customer, get this coverage before they ask for it.

Even if one of these applies to you today, your situation changes quickly. The time to buy insurance is before you need it, not after a breach.

How to get started

If you've recognised yourself in the checklist above, the next steps are straightforward:

1. Identify what you protect: What customer data do you hold? Are you in a regulated industry? What systems are critical to operations?
2. Understand your regulatory obligations: Do HIPAA, CCPA, NYDFS, PCI DSS, or state-specific rules apply to you?
3. Assess breach impact: What would a breach cost in notification, legal defence, and business interruption?
4. Talk to a specialist broker: Get advice from someone who understands your industry and the US regulatory environment.