Cyber insurance is a policy that pays the costs of an incident your own controls did not stop: the investigation, the notifications, the lost revenue while you are down, and the lawyers if somebody sues. For a firm of twenty to a hundred people it is now close to standard, and the reason is less about ransomware than most owners expect.
What are the five reasons to carry cyber insurance?
Five things a policy pays for, in rough order of how often a firm of this size claims on them.
1. A payment that left the building. An email that looked like your supplier, a changed set of bank details, a wire that cleared before anybody queried it. This is the common one by a distance. Coalition’s 2026 Cyber Claims Report, drawn from more than 100,000 policyholders over calendar 2025, found that business email compromise and funds transfer fraud together accounted for 58% of all claims. The federal complaint data agrees: the FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints in its 2025 Internet Crime Report, carrying $3,046,598,558 in reported losses.
2. Ransomware recovery. The negotiation if it comes to that, and the rebuilding either way. It has its own section below, because the conditions attached to that cover are where most of the argument lives.
3. Revenue you did not earn while you were down. Business interruption is usually the largest single line on a claim, and the one firms underestimate, because it accrues quietly for every day the work cannot move.
4. Breach response. The forensic work to establish what happened, legal advice on who has to be told, the notifications themselves, and credit monitoring where it is required. These arrive as invoices within days, long before anybody has worked out the full picture.
5. Liability. Defense costs and settlements if a customer or a project partner sues over data that was yours to protect. This is the one that outlives the incident by years.
What a policy does not do is stop the incident happening. It pays afterward, and it prices on what you had in place beforehand, which is why buying cover and closing the gaps in your controls are one piece of work.
Is cyber insurance getting cheaper or harder to get?
Both, at the same time, and that is the part worth understanding before a renewal.
The National Association of Insurance Commissioners reported roughly $9.14 billion of United States cyber premium written in 2024, a 7% decrease from the $9.84 billion written in 2023. Over the same period the number of claims rose almost 40%, to nearly 50,000.
Premiums falling while claims climb is not generosity. It is competition among carriers for the accounts they consider safe, funded by getting stricter about which accounts those are. The softening shows up as a lower quote for firms that can evidence their controls, and as more conditions, higher retentions or a declined submission for firms that cannot.
Does cyber insurance cover ransomware?
Generally yes, and the more useful question is what your policy requires of you first.
Ransomware is the second reason above and not the first, which surprises people. The same FBI report counts 3,611 ransomware complaints carrying $32,320,105 in losses, against the $3 billion lost to business email compromise. Read quickly that makes ransomware look trivial, and it is not. A complaint form captures money that moved, not the days a firm spends rebuilding or the projects that slip while it does.
Sophos surveyed 2,158 IT and cybersecurity leaders across 17 countries for its State of Ransomware 2026 report and found that 56% of attacks succeeded in encrypting data, with only one in three smaller organizations stopping an attack before encryption. Carriers have read the same research. Backups that an attacker cannot delete, multifactor on remote access, and endpoint detection are now conditions of cover instead of discounts on it. An answer that was true when you signed and false at renewal becomes a problem at claim time.
What will the application ask you?
More than it used to, and in stricter wording. Multifactor authentication and where exactly it reaches. Endpoint detection and response. Backups, whether they are immutable, and when a restore was last tested. Email authentication. Who has administrative access and how that is controlled.
Each of those has a right answer and a truthful answer, and they are not always the same. The cyber insurance readiness page sets out the eleven controls carriers verify in 2026 and what a truthful yes requires for each one, which is the work that belongs before the form.
What do you do in the first hour of a funds transfer fraud?
This is the claim most likely to be yours, and the first hour decides how much comes back.
Call your bank and ask for a recall on the wire, by phone and not by email. Banks can sometimes freeze funds that have not yet been withdrawn from the receiving account, and that window is measured in hours. File a report with the Internet Crime Complaint Center the same day, because the recall process works through the receiving bank and a filed report is what starts it. Tell your carrier immediately as well: policies carry notification windows, and a late notice is one of the easier ways to turn a covered loss into an argument.
Then stop the second payment. Funds transfer fraud usually begins with a mailbox somebody else is reading, so the account that sent the instruction needs its password changed and its sessions revoked before anybody works out what happened.
How should a small business choose a policy?
Your broker prices and places it. Four things are worth settling with them before you need them.
Limits against your actual exposure. A firm whose largest risk is a misdirected payment needs a different shape of cover from one whose largest risk is a week of downtime.
The exclusions. Read them before a claim, particularly anything conditional on controls you are asserting you have.
The retention. What you carry yourself before the policy responds, which is often where a cheaper premium has gone.
Who signs the answers. Somebody has to attest that the description of your environment is accurate. Make sure that person has seen the environment.
Where to start
Work out what you would actually claim for, then find out whether you could answer the application honestly today. Most firms discover the gap is smaller than feared and takes longer to close than expected, which is an argument for starting before the renewal letter rather than after it.
If you would sooner have the application questions answered about your own environment first, that is what the readiness review is for.
Sources
- National Association of Insurance Commissioners, Report on the Cybersecurity Insurance Market, 2025.
- Coalition, 2026 Cyber Claims Report, covering more than 100,000 policyholders, calendar 2025.
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
- Sophos, The State of Ransomware 2026, 2,158 leaders across 17 countries.