Recovering from a cyberattack isn’t just about getting systems back online. It can also mean forensic investigations, customer notifications, regulators response, lawsuits defense, and revenue lost while your business was offline.
The FBI's Internet Crime Complaint Center reported nearly $21B in cybercrime losses in 2025. It was a 26% increase over 2024. When an incident hits, the financial and operational fallout can be huge.
Cyber Insurance exists to pay those costs. For ecommerce businesses, SaaS platforms, and any company running on digital infrastructure, Cyber Insurance allows you to investigate, respond, and recover without derailing growth or damaging customer trust.
Today, it’s a cost of doing business. Customer contracts are one of the most common reasons companies come to Vouch for Cyber coverage. If you're in a sales cycle with a larger company, you may have seen a requirement for it already. If you haven't yet, you likely will soon.
Key Takeaways
- Cyber Insurance covers risks that other policies may not, like breach response, ransomware, regulatory fines, and legal defense.
- First-party coverage protects your own costs and third-party liability covers claims from customers, partners, or regulators.
- Premiums scale by revenue, data exposure, and security posture.
- The right limits depend on revenue, PII volume, industry, and contract requirements.
What Is Cyber Insurance?
Cyber Insurance is a policy that pays for financial fallout from cyberattacks, data breaches, or system compromises. It can cover costs for your own response and recovery, along with claims and regulatory actions brought against you.
The name of the policy varies, sometimes called cyber liability insurance, cybersecurity insurance, or data breach insurance, but they describe the same category of coverage.
What Does Cyber Insurance Cover?
The protection you get from a Cyber Insurance policy depends on the part of the policy you’re talking about:
- First-party coverage responds to direct impacts on your operations, systems, and revenue from an incident.
- Third-party coverage responds when action is taken against you by customers, partners, employees, or regulators because of the incident.
Cyber Insurance Coverage Overview
When a customer contract requires a certain amount of cyber liability coverage, it's usually referring to your third-party limit, because that's the part that protects them.
Learn more about the differences between first- and third-party Cyber Insurance coverage.
First-Party Cyber Coverage
First-party coverage helps cover what happens directly to your business during and after a cyber incident. It supports:
Breach Response and Notification
When sensitive information is exposed, you’re obligated to meet certain breach notification requirements based on state, federal, and industry guidelines, including:
- Customer or employee notifications
- Credit monitoring and identity protection services for affected individuals
- Communication and call center support
This helps you move quickly, contain reputational damage, and maintain customer trust.
Digital Forensics and Incident Investigation
After an attack, forensic specialists help determine:
- How the threat entered your system
- Which accounts, systems, or data were affected
- Whether attackers still have access
This helps your business develop a response and shows regulators, customers, and partners that you understand what happened, how, and have taken appropriate steps to prevent future breaches.
Data Restoration and System Recovery
Cyber incidents may corrupt or destroy data. Data restoration and system recovery coverage can cover the costs to:
- Restore or rebuild data
- Repair or reconfigure systems
- Return operations to a safe and stable state
Business Interruption
Cyber incidents can halt or slow operations, costing you money. Business interruption coverage reimburses:
- Lost income
- Extra expenses to resume operations
Not every outage is treated equally. Many policies cover downtime caused by a security failure at the full business interruption limit but cover downtime from a non-malicious system failure (like failed software update) at a lower sublimit.
Cyber Extortion and Ransomware Response
If attackers threaten to release or destroy data, or if demand payment to restore systems, cyber extortion coverage helps with:
- Negotiation with threat actors
- System recovery and restoration
- Ransom payments when legally permissible and deemed appropriate
Ransomware remains one of the most disruptive forms of cyber attack, and the downtime, data restoration, and business interruption costs associated with it can be more expensive than the ransom itself.
Fraud and Social Engineering Losses
Many incidents involve manipulation rather than technical compromise. This coverage applies to losses caused by:
- Business email compromise (BEC)
- Fraudulent payment or wire transfers
- Invoice manipulation
- Impersonation
These are usually subject to a sublimit that's lower than the policy’s main limit. Check that the social engineering sublimit reflects the size of a realistic loss, and coordinate it with your Crime policy so the two don't leave a gap.
Third-Party Cyber Coverage
Third-party Cyber coverage protects your business when an incident affects customers, partners, or employees. When affected customers are notified, some may look at what the incident cost them and file a lawsuit. These can be expensive and time-consuming even if you’re found not liable.
Privacy Liability
Privacy liability covers claims alleging failure to protect personal or confidential information. That includes:
- Legal defense
- Settlements and judgments
- Potential compensation for affected individuals
Network Security Liability
Applies when someone alleges that your systems or actions caused a security failure that impacted them, including:
- Malware spreading from your environment
- Service disruptions that impact customers
- Security failures that cause financial loss
Network security liability helps manage downstream harm claims if your product connects to or runs inside customer systems.
Regulatory Investigations and Penalties
Cyber incidents can trigger inquiries from state, federal, or industry regulators. This coverage can help pay for:
- Legal guidance
- Responses to regulatory requests
- Certain fines or penalties
Regulatory involvement can be costly (and complex), so this coverage is essential particularly in regulated industries like healthcare and financial services.
Media and Content Liability
Cyber incidents can also lead to content-related claims when accounts are compromised or manipulated. Media and content liability coverage can include:
- Copyright infringement
- Defamation, libel, or slander
- Advertising injury
This is important if you publish content, run campaigns, or maintain user-facing and social platforms.
Because cyberattacks are frequent and increasingly sophisticated thanks to AI, insurers are seeing a rise in both first- and third-party claims. Understanding both facets of your policy helps you evaluate whether your limits match the risk your business actually faces.
What Doesn't Cyber Insurance Cover?
Cyber Insurance is broad, but it doesn’t cover every type of loss. Knowing the boundaries helps you build the right combination of policies.
Physical Property Damage or Bodily Injury
Cyber incidents can cause operational disruption but typically don’t cause physical harm or damage to property. Those are covered by:
- General Liability Insurance for bodily injury and third-party property damage
- Business Property Insurance for damage to your equipment or office
The exception to property replacement can be a hardware replacement endorsement that pays to replace hardware an attack has rendered unusable.
Technology or System Upgrades
Cyber Insurance doesn't pay to modernize your environment to protect against intrusions. It's meant to restore systems to their pre-incident state. Upgrades are treated as normal business expenses.
Incidents Underway Before Coverage Began
Pre-existing events are generally excluded in commercial insurance. Cyber Insurance doesn’t apply to attacks that were already in progress when your policy started, and known vulnerabilities that your company decided not to address might also not be covered.
Criminal or Intentional Acts by the Insured
Cyber Insurance won’t cover intentional wrongdoing by someone acting on behalf of your company. Some of those scenarios fall under Crime Insurance.
Certain Nation-State or Cyber Warfare Events
Similarly, cyber attacks tied to nation-state actors are usually excluded. Some carriers may offer carve-outs, but the wording varies and is worth reviewing.
Who Needs Cyber Insurance?
Any company holds customer data, stores their own data digitally, or moves money could benefit from Cyber Insurance. For many early-stage companies, a $1M Cyber policy costs a few thousand dollars a year. A serious incident can cost far more, and you may need a policy regardless if a contract is on the line.
- Customer contracts require it. Enterprise customers, partners, and investors often require Cyber Insurance. It’s one of the most common reasons Vouch advisors encounter in companies looking to buy Cyber coverage.
- You handle sensitive data. Holding PII, PHI, and financial information can put a target on your back from both regulators and bad actors.
- Your revenue depends on uptime. If customers pay you to be available, an outage is a revenue event (and usually a contract issue).
- You move money digitally. Wire transfers, payment flows, and invoicing are frequently targets of BEC and social engineering fraud.
Types of Cyber Insurance
Policies can be structured in different ways depending on your business model, data exposure, and contract requirements.
Combined
Cyber Insurance combined with Tech E&O coverage is a most common structure for tech companies. When they’re written on the same policy form, it helps prevent disputes about which policy (or carrier, if they’re separate) responds when a software error leads to a security incident since incidents often involve elements of both an errors and omissions claim and cyber claim.
The 2024 CrowdStrike outage is an example of this. It started a software update error that cascaded into a massive operational failure for thousands of customers. Pairing the coverages can remove a lot of ambiguity.
Standalone
Standalone Cyber coverage provides the highest coverage limits and the most specific terms by focusing solely on cyber risks. This is useful for companies with meaningful data exposure, enterprise relationships, or explicit contractual requirements.
Bundled
Bundled Cyber coverage can appear as a sublimit inside a Business Owners Policy (BOP). The sublimit is usually small compared to the cost of a severe incident and typically not enough for most tech companies.
How Does Cyber Insurance Work?
From applying to filing, here's how Cyber Insurance works in practice.
1. Apply for Coverage
You'll complete an application. Important factors in Cyber Insurance include revenue, employee count, industry, data types and count, and security practices.
2. Underwriting and Binding
Once your application is submitted, underwriting evaluates your risk profile to help determine a cost based on coverage limits and deductibles. If your business or exposure change materially during the policy year, you can usually request a mid-term adjustment.
3. File a Claim
Report a suspected incident to your broker or carrier as soon as possible. Most policies include a breach response hotline and access to pre-approved firms, counsel, and vendors. Delays in reporting can affect coverage, and the first 24 to 72 hours after discovery are critical for containing an incident and preserving evidence.
What Do Insurers Look For?
Cyber Insurance risk is evaluated by looking at your security controls, data practices, and history of incidents. The areas that can affect your quote the most include:
- Multi-Factor Authentication (MFA). Expect underwriters to ask whether MFA is enforced on all access, email, and administrative systems. Some policies exclude claims if you fail to maintain the security controls described on your application.
- Endpoint Detection and Response (EDR). This shows you're running active threat detection on devices to detect anomalies before they become full breaches.
- Encrypted Backups Stored Offline. This protects your ability to restore your systems without paying ransom. Underwriters want to know about backup frequency and restoration testing.
- Incident Response Plan. You don't necessarily need a lengthy document, but named contacts, a comms protocol, and a clear decision tree are helpful.
- Patch Cadence. The 2026 Verizon Data Breach Investigations Report found that vulnerability exploitation is now the most common initial access vector for breaches. Underwriters will ask about how quickly you patch critical vulnerabilities.
- Vendor Risk Management. If vendors have access to your data or systems, your exposure extends beyond your own business.
Documented security work, such as SOC 2 progress or recent penetration test results, helps give your broker something concrete to bring to underwriters when negotiating price and terms.
How Much Does Cyber Insurance Cost?
Median annual Cyber Insurance cost is around $2,755. The actual cost to your business will depend on your specific company. Below is an example of how Cyber premiums scale with company size.
Median Annual Cyber Premium by Revenue
Annual premiums reflect median pricing for standalone Cyber Insurance Policies. Premiums may be rounded. Actual pricing varies based on industry, location, claims history, company stage, and selected coverage limits.
What Affects Your Premium
- Company Size and Revenue: Revenue is a primary underwriting variable. Cyber policies are priced off projected next-12-month revenue.
- Data Sensitivity: Companies handling PII and other sensitive data typically pay more than companies with limited PII exposure.
- Coverage Limits: Higher limits cost more. Most early-stage companies begin to increase limits with revenue growth or contract requirements.
- Industry: Healthcare, fintech, and other companies in heavily regulated sectors generally carry higher data sensitivity.
- Security Controls: Stronger security programs improve your risk profile and can meaningfully affect your quote.
- Prior Incidents: A history of claims may increase your premium. Undisclosed incidents can void your coverage.
Learn more about how much Cyber Insurance costs.
How Much Cyber Insurance Do You Need?
The right coverage amount depends on your data exposure, industry, technology dependence, and contract requirements. Use this table as a starting point:
Recommended Coverage Limits by PII Records, Industry, and Revenue
Limits expressed as First-Party / Third-Party. Your own contract requirements, regulatory exposure, and your growth trajectory all affect the right number.
Learn more about how much Cyber Insurance you need.
What Drives Your Limits Decision
Industry and Threat Environment
Tech, fintech, and healthtech companies carry heightened exposure and should set limits with the realistic cost of a breach in mind. According to IBM's 2026 Cost of a Data Breach Report, the average cost of a data breach reached a record $4.99M.
Data Exposure and Record Volume
Breach costs scale with the number of records affected because notification, monitoring, and regulatory penalties all add up.
Technology Dependence
Business interruption exposure rises the more your revenue depends on digital systems being available. A SaaS company operating under uptime SLAs has more to lose than other companies.
Contractual Requirements
Most contract requirements Vouch sees for early-stage companies fall between $1M and $5M in Cyber coverage. Larger enterprise deals can ask for $10M or more. Requirements are often copied from templates and you may be able to negotiate the requirements in some contracts.
Learn more about Cyber Insurance for startups.
Location and Legal Obligations
GDPR, HIPAA, CCPA, and a growing list of state privacy laws impose mandatory notification requirements and potential fines based on not only your own location but the location of your clients.
Scale and Growth Trajectory
Limits that are right today may not be enough after your next fundraise, product launch, or contract. Build a habit of reviewing Cyber Insurance limits at least annually, and ideally whenever you hit a meaningful milestone.
Cyber Threats in the Age of AI
AI has expanded the scale and speed of cyber attacks. For a broader look at AI's impact on business liability, see Understanding AI Risks for High-Growth Companies.
AI-Powered Phishing and Social Engineering
Traditional phishing attacks are detectable by trained employees but AI-generated phishing is harder to catch. Attackers can use large language models to craft highly personalized messages that mimic the writing style of executives and reference real projects. That’s resulted in a new class of BEC attacks that are harder to spot than ever before. Cyber Insurance can cover funds transfer losses and legal defense costs from these attacks.
Deepfakes
LLMs help with written phishing schemes, but audio and video generation of executives are also being used to impersonate leadership and authorize fraudulent transfers. In a widely reported 2024 case, an employee at engineering firm Arup transferred roughly $25M after a video call with who he thought was company's executives. Cyber Insurance can cover the resulting funds transfer losses under social engineering coverage.
Model and Data Poisoning
Companies that actually build or deploy AI models, instead of just using them, face a distinct threat: manipulation of training data or model weights. A poisoned model can behave normally under standard conditions but produce subtly incorrect outputs in targeted scenarios. This can damage customers, create regulatory exposure, and compromise the integrity of outputs relied on for business decisions.
Agentic System Exposures
AI agents that take autonomous actions create new liability questions at the boundary between Cyber and Tech E&O. Generally, data exposure caused by unauthorized access is a Cyber issue, and financial loss from an error in an agent's decision-making falls under Tech E&O. Some Cyber policies may not address AI explicitly, so how a specific incident is handled depends on policy language. Having both coverages on the same policy form can close any gap.
Which AI Threats Cyber Policies Cover
Standard Cyber Insurance can help cover the financial consequences of AI-enabled attacks (forensic investigation, breach notification, third-party claims, and business interruption).
What it may not automatically cover is liability from errors in your own AI products. Tech E&O coverage can help cover errors, hallucinations, and harmful outputs from AI systems.
Common Misconceptions About Cyber Insurance
"We're Too Small to Be Targeted."
Attackers don't profile companies by size, but by vulnerability. Small companies are often targeted because they have less security infrastructure than large enterprises but still hold customer data, payment credentials, and employee records.
"We Don't Have Sensitive Data, So We're Not at Risk."
Companies that don't store PII still face ransomware and other attacks. Business interruption has financial consequences for any company dependent on uptime. And companies can still touch customer data in other ways, like through APIs, third-party integrations, or SaaS connections, even if they don't store it.
"Our Cloud Provider Handles Security for Us."
Platforms like AWS, Google Cloud, and Azure don't secure everything, and outsourcing hosting doesn't outsource responsibility. Customer data that gets exposed can still lead to your company being named in a claim.
"Strong Security Means We Don't Need Cyber Insurance."
Strong security can lower the likelihood of an incident (and your premiums) but it doesn't eliminate exposure. Security and insurance play different roles: one reduces probability, the other limits the fallout if prevention fails.
"Incidents Are Rare, So Coverage Isn't Necessary."
Cyberattacks aren’t as rare as you might think. The FBI's Internet Crime Complaint Center reported almost $21B in cybercrime losses in 2025. And according to Verizon, ransomware was present in 48% of all breaches, and breaches with third-party involvement also reached 48%.
Cyber Insurance vs. Other Types of Insurance
Cyber Insurance complements your existing coverage rather than replacing it. Here's how it compares to other lines you may already carry:
*Wire fraud and funds transfer losses can trigger both Cyber and Crime Insurance. The specific policy language determines which responds.
Cyber Insurance vs. General Liability Insurance
General Liability Insurance covers physical injuries, property damage, and advertising injury, not breach notification, forensic investigation, regulatory fines, or legal defense from a data breach.
Cyber Insurance vs. Business Property Insurance
Business Property Insurance covers physical damage to equipment. It doesn't cover intangible losses like data corruption, lost access to systems, or restoration costs.
Cyber Insurance vs. Crime Insurance
Crime Insurance covers employee theft, forgery, and certain wire fraud. Cyber Insurance covers external threats and breach costs. Some incidents, like social engineering and BEC, are relevant to both.
Cyber Insurance vs. E&O Insurance
Errors & Omissions (E&O) Insurance covers claims related to errors in your software or services. Cyber Insurance covers claims arising from unauthorized access to data or systems. The line between these has blurred as software makes it possible for errors to cascade into data breaches. Vouch advisors recommend purchasing these together so there's no gap when an incident involves elements of both.
Learn more about Tech E&O vs. Cyber Insurance.
Cyber Insurance vs. D&O Insurance
Directors and Officers (D&O) Insurance covers your directors and officers against personal liability for business decisions. It doesn't relate to cyber incidents, unless there’s a claim specifically alleging that a director or officer was negligent in overseeing cybersecurity practices.
Cyber Insurance vs. Media Liability Insurance
Media Liability Insurance covers claims related to published content, like copyright infringement, and defamation. Cyber Insurance addresses data security incidents.
How Vouch Helps You Navigate Cyber Insurance
Cyber Insurance isn't one-size-fits-all. The right policy depends on the data you handle, the industry you’re in, how your product works, your client contracts, and how fast your business is growing.
Vouch advisors help you evaluate those risks before they become expensive mistakes by:
- Benchmarking your coverage against similar companies in your industry and stage
- Evaluating your specific exposure based on your data, technology stack, and contractual requirements
- Reviewing customer insurance requirements and explaining which requirements are worth negotiating
- Explaining coverage options in plain language, including limits, sublimits, and endorsements
- Clarifying how Cyber and Tech E&O interact and where policies typically leave gaps
- Reassessing coverage as you scale so insurance keeps pace with new customers, products, and markets
Cyber threats have become a routine part of business, whether you're building software, processing payments, storing customer data, or deploying AI. The right Cyber policy gives your company access to experts, advice, and protection, helping you recover without disrupting your business.
Frequently Asked Questions
What Is Cyber Insurance?
Cyber Insurance is a policy that covers the financial and operational costs of a cyberattack or data breach: investigation, notification, data recovery, legal defense, regulatory fines where insurable, and business interruption losses that General Liability and Property Insurance don't address.
What Does Cyber Insurance Cover?
Cyber Insurance covers breach response and notification, digital forensics, data restoration, business interruption from system outages, ransomware and extortion response, fraud losses from phishing and business email compromise, and third-party claims including privacy liability, network security liability, regulatory investigations, and media liability.
What's the Difference Between First-Party and Third-Party Cyber Coverage?
First-party coverage pays your direct losses from an incident, such as breach response, forensics, data restoration, and business interruption. Third-party coverage applies when customers, partners, or regulators allege that your business caused or contributed to the incident and seek compensation. Customer contracts that require Cyber coverage usually reference your third-party limit.
What Is Not Covered by Cyber Insurance?
Common exclusions include physical property damage, bodily injury, hardware replacement without a bricking endorsement, technology upgrades, long-term reputational decline, incidents already underway before the policy started, intentional misconduct, certain nation-state or cyber-war events, and contractual penalties not tied to a covered event.
Do Small and Midsize Businesses Really Need Cyber Insurance?
If you hold customer data, depend on uptime, move money digitally, or sign contracts with larger customers, yes. Contract requirements are one of the most common reasons smaller companies buy it, and coverage is affordable relative to the cost of an incident: the median annual premium for a company under $1M in revenue is $2,082 based on Vouch client data.
Does Cyber Insurance Cover Ransomware Payments?
Yes, subject to policy terms. Cyber Insurance typically covers ransom negotiation support, the ransom payment itself where legally permitted, and system recovery costs. Policies include access to ransomware response specialists who evaluate whether payment is advisable before any funds are transferred.
Does Cyber Insurance Cover Phishing and Social Engineering?
Yes, subject to sublimits. Social engineering coverage applies to funds transfer fraud, business email compromise, invoice manipulation, and impersonation attacks. Review your policy's social engineering sublimit, which is often lower than the main policy limit, and coordinate it with any Crime policy you carry.
Does Cyber Insurance Cover Cloud or Vendor Breaches?
Often, but check the wording. Third-party claims and your response obligations are generally covered even when an incident starts at a vendor, because customers can still hold your company responsible. Lost income from a vendor's outage falls under contingent business interruption, which some policies include, some offer as an extension, and many limit with a sublimit.
Does Cyber Insurance Pay for Hardware Replacement?
Not by default. Cyber Insurance focuses on data and system restoration. Hardware replacement usually falls under Business Property Insurance, unless your Cyber policy includes a bricking endorsement that pays to replace devices an attack has made unusable.
Does General Liability or Property Insurance Cover Cyberattacks?
No. General Liability covers physical injuries and property damage. Property Insurance covers physical assets. Neither covers data breaches, ransomware, forensic costs, customer notifications, or regulatory investigations.
Does Tech E&O Replace Cyber Insurance?
No. Tech E&O covers errors in your software or services. Cyber Insurance covers unauthorized access to data or systems. These are different triggers, and both are typically needed for technology companies. Buying them on the same form closes the coverage gap when an incident involves elements of both.
Is Cyber Insurance Required by Law?
No federal law requires it for most industries. Some regulated sectors, like healthcare and financial services, have cybersecurity standards that effectively require it. Many enterprise clients contractually require it as a condition of doing business.
How Much Cyber Insurance Do I Need?
Start with your revenue, PII volume, and industry. Companies under $1M in revenue with limited data exposure typically start at $1M in limits. Most companies move to $2M once revenue passes $2M, and software companies holding more than 1 million personal records typically need $3M to $5M. If a contract specifies a limit, read the clause first: it usually references your third-party limit.
Does Cyber Insurance Cover AI-Related Incidents?
Standard Cyber Insurance covers the financial consequences of AI-enabled attacks against your business, including deepfake fraud and AI-powered phishing, subject to sublimits. Liability from errors or hallucinations in your own AI products requires Tech E&O with an AI endorsement. Without the endorsement, AI-generated errors from your own product may be excluded from standard E&O coverage.
What Do Insurers Look for When Underwriting Cyber Insurance?
The primary controls are multi-factor authentication (MFA), endpoint detection and response (EDR), encrypted offline backups, and a documented incident response plan. Patch cadence and vendor risk management also come up. Answer accurately, because some policies exclude claims if you fail to maintain the controls you described on your application.
Does Cyber Insurance Cover Regulatory Fines?
It covers the cost of regulatory investigations, mandatory notifications, and fines or penalties where they're legally insurable under privacy laws like HIPAA, CCPA, and GDPR. Many policies also cover PCI fines and assessments. It doesn't make you compliant, but it covers the financial consequences when a compliance gap leads to an incident or regulatory action.
Do All Cyber Policies Offer the Same Protections?
No. Coverage terms, sublimits, and endorsements vary widely between insurers. Contingent business interruption, bricking, war exclusion wording, and whether breach response costs erode your main limit are all common differences. Reviewing policy language closely is essential.
Vouch Specialty Insurance Services, LLC (CA License #6004944) is a licensed insurance producer in states where it conducts business. A complete list of state licenses is available at vouch.us/legal/licenses. Insurance products are underwritten by various insurance carriers, not by Vouch. This material is for informational purposes only and does not create a binding contract or alter policy terms. Coverage availability, terms, and conditions vary by state and are subject to underwriting review and approval.
.avif)
