Do small businesses need cyber insurance?

Most small businesses that run on email, card payments and cloud software should carry cyber insurance, and three kinds need it now: businesses that take card payments, businesses that keep personal information about customers, clients or patients, and businesses that send or receive money based on what an email says. That last group is bigger than it sounds, since it takes in every contractor who invoices by email, every bookkeeper who pays bills for clients and every real estate or title office that handles a wire, and, if you send invoices by email at all, probably you. What you’re buying is help in the worst week: someone to investigate, letters to the people affected, your data back and a lawyer if they sue, all typically covered and all subject to the policy’s terms, limits and exclusions.

A few businesses can reasonably wait. But they’re rarer than their owners tend to think, and the test for being one of them is narrower than it looks.

Who needs it now, and who can wait

Here’s where we come down. If any of these describe you, buy cyber coverage this year:

• You take card payments, especially if you key in card numbers, store them or run payments through your own website.
• You keep personal data: client tax returns, Social Security numbers, health or insurance information, bank details, driver’s license scans, or simply a large customer list with addresses and birthdays.
• Money moves based on email: you send invoices with payment instructions, pay suppliers by wire or ACH, or handle client funds.

Who can wait? A sole proprietor who takes every payment through a hosted processor that never shows them a card number, keeps no client files beyond names and email addresses, and never pays or gets paid based on instructions in an email has a much smaller exposure. That business can reasonably put cyber behind general or professional liability for now. Still, look hard at the third condition before you decide it fits, because almost every business sends invoices, and an invoice with payment details in it is exactly the document an email scam copies.

What the FBI’s numbers say, and what they leave out

The FBI’s Internet Crime Complaint Center counted 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558. Divided out, that’s roughly $123,000 per complaint on average. A few huge losses pull that average up, but even so, it tells you these scams go after real payments, the kind a small business can’t shrug off.

The ransomware numbers need more care. They mislead. IC3 received more than 3,600 ransomware complaints in 2025 with losses of more than $32 million, which looks modest next to email fraud. The report itself says why that figure runs low: it doesn’t normally include lost business, time, wages, files or equipment, or the cost of outside help to recover, and some victims report no loss amount at all. For a small business, those left-out costs are often the whole bill, since the ransom is only one line in a week of being closed.

“We’re too small to be a target”

Owners often give this as the reason to skip cyber insurance, but it misreads how the attacks work. Think about phishing: the same message goes to thousands of inboxes, the criminal works with whoever clicks, and a small business with no IT staff and a shared password is easier to get into than a bank. Size doesn’t hide you. It makes you easier.

What size does change is how well you can absorb the hit, because a large company has a security team and the cash to hire a forensic firm on the first morning, and a small one usually doesn’t. A ten-person firm has an owner, a weekend and a credit card.

What a cyber policy pays for

Most owners picture a cyber policy paying the ransom. That’s only one part of it, and often not the biggest, and the policy is easier to understand once you split it into two halves, the same way the FTC does in its guidance on cyber insurance. First-party coverageFirst-party coverageFirst-party coverage pays for losses your own business suffers, like damage to your property or lost income, rather than claims other people make against you.Read the definition pays for your own losses and response costs, while third-party coverageThird-party coverageThird-party coverage is insurance that protects your business against claims from other people, such as customers or clients, who say you caused them injury, damage or financial loss.Read the definition pays when someone else, such as a customer whose card number was stolen, brings a claim against you, and most small business cyber policies include some of both. The FTC lists the kinds of costs each half can include:

That’s the menu. Not every policy includes every row, and each row is subject to limits, sublimits and exclusions. The notification row matters more than it looks. The FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of breaches involving personal information, and the rules differ by state, so a business with customers in several states may face several sets of rules at once. For what to do in the first days, see what to do after a data breach.

Six lines to read before you buy

Now for the part that’s easy to skip. A policy that looks right on a quote page can still miss the claim you’re most likely to have, because the headline limit tells you very little about what’s inside it, so read these parts of the quote or policy, in this order:

1. Social engineering or funds transfer fraud. This is the email-payment-scam coverage. It’s often offered at a sublimitSublimitA sublimit is a smaller cap within a policy’s overall limit that applies to one specific type of loss or coverage, and it doesn’t add to the overall limit.Read the definition much lower than the main limit, and sometimes not at all. If your business moves money by email, this line matters more than the headline limit.
2. Ransomware and extortion. Check whether it’s covered, and whether it’s subject to its own sublimit or conditions.
3. Business interruption. Look for the waiting periodWaiting periodA waiting period is the stretch of time after a covered loss before coverage, such as business income, starts paying, working like a deductible measured in hours or days.Read the definition, often measured in hours, before lost income is covered, and whether an outage at a vendor you depend on counts.
4. Breach response. The FTC suggests asking whether the insurer will defend you in a lawsuit or regulatory investigation, which is often called “duty to defend” wording, and whether it offers a breach hotline that’s available at all hours every day of the year. Then ask the order of operations, since some policies only pay for lawyers and forensic firms the insurer approves, or need its consent before you hire anyone or pay a ransom, so call the hotline first.
5. The application. Insurers often ask pointed questions, such as whether multi-factor sign-in protects email, remote access and admin accounts, and whether backups are kept separate from your network. Answer accurately, because a wrong answer can create a coverage problem later.
6. Claims-made terms. Most cyber policies are claims-made, so check the retroactive dateRetroactive dateA retroactive date is the earliest date of work or events a claims-made policy covers, so anything that happened before it isn’t covered, even if the claim is new.Read the definition and keep it when you renew.

Doesn’t my other insurance already cover this?

Usually not. General liability policies typically exclude data breaches and the loss of electronic data, and they’re built for injuries and physical damage. Professional liability covers claims that a mistake in your professional work cost a client money, but it’s generally not written to pay for forensics, notification letters or a ransom. For a bookkeeper or an IT consultant, though, the overlap is real: a client may claim under your professional liability for the mistake and under your cyber policy for the breach, so ask how the two would split a claim that’s both. A property policy usually stops at the damaged hardware. And the FTC’s own advice is to make sure any cyber policy you consider will provide coverage in excess of other applicable insurance you already have.

Insurance also works best on top of basics, though, and CISA’s guidance for small businesses stresses requiring multi-factor authentication through technical controls, keeping systems patched and regularly testing restores from backup, and insurers tend to ask about the same things. With Corgi, you can get a quote online in about five minutes, and an underwriter, not a broker, can tell you what a sublimit does and doesn’t cover.