Small businesses are frequent targets of cyber attack, yet many assume they are too small to matter. Attackers automate their campaigns and treat weak defences as the opportunity, not the size of the firm. Cyber insurance closes the gap between the defences you can afford and the cost of a single breach.
Why small firms are targeted
Most attacks are sent at scale, not hand-picked. A phishing email or unpatched software flaw hits thousands of businesses at once. Small firms often lack a dedicated IT team, so a single click can encrypt every file or expose every customer record.
The financial hit lands harder on a small firm. A breach can mean notification costs, lost trading days, and lost trust from customers who expected you to protect their data.
What a small-business cyber policy includes
Standalone and packaged cyber cover for small firms usually pays:
- Ransom and recovery costs.
- Data breach notification and the legal steps that follow.
- Business interruption while systems are down.
- Liability if customer data is exposed.
- Access to a helpline and specialist firms from the moment an incident starts.
Many small-business policies include active incident response, so you are not managing the crisis alone. That support is often the most valuable part of the cover.
How much it costs and what drives the price
Premiums for small firms are modest compared with the potential loss, but they vary with your controls. Insurers price on:
- Whether you enforce multifactor authentication.
- Whether you hold and test backups.
- The volume of personal data you store.
- Your turnover and the number of people with system access.
Firms that meet the basics pay less and get broader terms. Those that cannot show basic controls face higher excesses or narrower cover.
How it fits with your other cover
Cyber is separate from public liability, professional indemnity, and your business insurance pack. Check whether your pack includes a cyber sub-limit before you buy a standalone policy, because a small built-in limit may not reflect your real exposure. Our guide to what a business insurance pack covers explains where each part sits.
If you are a small business and a claim is mishandled, you may be able to complain to the Financial Ombudsman Service. Read our guide to how to complain about an insurer or broker.
Sources
- Financial Conduct Authority (FCA) — expectations of firms handling customer data.
- Financial Ombudsman Service — complaints about insurance.
- National Cyber Security Centre (NCSC) — small business guidance.
- Association of British Insurers (ABI) — cyber insurance for smaller firms.