There's a persistent myth that hackers only go after big companies. The opposite is true: small businesses are targeted *because* they're less defended, and the tools attackers use are automated — they don't care how big you are, only whether they can get in.
What cyber insurance covers
Cyber insurance generally splits into two halves:
- First-party — your own costs after an incident: breach investigation and notification, data restoration, ransomware payments and negotiation, and lost income while systems are down.
- Third-party — liability when others are harmed: claims from customers, patients, or partners whose data was exposed, plus regulatory defense.
Just as valuable as the money is the response team most policies include — the forensics, legal, and PR experts you'll want on speed-dial at 2am, which most small businesses can't assemble on their own.
Why your other policies usually won't cover it
This is the trap. Standard general liability typically excludes most data and cyber events, as does a typical property policy. Business owners often assume they're covered until a claim is denied — cyber is a distinct exposure that usually needs its own coverage.
The exposures that catch small firms
- Ransomware — files encrypted, operations frozen, a payment demand.
- Funds-transfer / wire fraud — a spoofed email tricks staff into sending money.
- Business email compromise — an attacker inside your inbox redirects invoices.
- Data breach — customer or employee information exposed, triggering notification laws.
Any business that takes payments, stores customer data, or runs on email — which is essentially all of them — has real exposure.
How to approach it
You don't need enterprise-grade coverage; you need coverage sized to your data and revenue, paired with basic controls (multi-factor authentication, backups, staff awareness) that also lower your premium. Many businesses add cyber to a Business Owners Policy or carry it standalone.
If you'd rather move fast, you can complete our Cyber & Technology E&O application online and we'll take it from there — or request a quote and we'll right-size cyber coverage to your actual risk.
Frequently Asked
Do small businesses actually get hacked?
Yes — disproportionately. Attackers automate and target smaller firms because defenses are usually weaker. A single ransomware event or wire-fraud scam can be existential for a small business.
What does cyber insurance cover?
Typically first-party costs (breach response, data restoration, ransom, lost income) and third-party liability (claims from customers or partners whose data was exposed), plus access to breach experts.
Isn't this covered by my general liability policy?
Almost never. Standard general liability excludes most cyber and data events, which is exactly why standalone cyber coverage exists.
This article is general information for business owners, not insurance or legal advice, and does not bind or alter coverage. Policy terms, eligibility, and pricing vary by carrier and state — confirm specifics with our licensed team before making decisions.