Business insurance
Cyber liability insurance
New York's breach notification law applies to a two-person shop exactly as it applies to a bank. Telling people is most of the cost, and the claim that actually happens to small businesses is not the one anybody worries about.
If you hold private information about New York residents — customers, patients, employees — you have obligations under the state's SHIELD Act to safeguard it and to notify people if it is exposed. There is no small business exemption from the notification duty, and no threshold below which it does not apply.
Cyber insurance is really two policies. First party covers your own costs: forensic investigation, notification, credit monitoring, legal advice, restoring data, and business interruption while your systems are down. Third party covers claims against you by the people whose data was exposed. For a small business the first party side is where almost all the money is.
Notification is the expense, not the hacking
The dramatic part of a breach is the intrusion. The expensive part is what follows: engaging a forensic firm to establish what was taken, engaging a lawyer to determine what your obligations are in each affected jurisdiction, and then contacting every affected individual and providing monitoring.
For a business holding a few thousand customer records, that process runs into tens of thousands of dollars before anybody has sued you. It is also not optional. This is why cyber cover is worth having at a scale where the business feels too small to be a target: the cost is driven by the number of records you hold, not by how interesting you are to an attacker.
The claim that actually happens: social engineering
Small businesses rarely suffer a sophisticated intrusion. What they suffer is somebody emailing the bookkeeper, convincingly, as the owner or as a supplier, asking for a payment or for changed bank details — and getting it. That is social engineering fraud, and it is by a wide margin the most common cyber loss at this scale.
It is frequently NOT covered as standard, because it involves a voluntary transfer by your own employee rather than a system intrusion. It needs a specific social engineering or funds transfer fraud endorsement, usually with a sub-limit. Ask for it by name; a cyber policy without it is missing the exposure most likely to be used against you.
Ransomware is the other one, and it brings a decision you should not be making for the first time under pressure. Good policies provide access to a response panel who have handled it before. That access is worth as much as the limit.
What the carrier expects of you
Applications increasingly ask about specific controls, and answering them inaccurately is a coverage problem rather than a formality. Multi-factor authentication on email and remote access, offline or immutable backups that have actually been tested, and a patching routine are the three that come up most.
Some carriers now decline businesses without multi-factor authentication outright, and some apply coinsurance to ransomware claims where it was absent. If you are answering yes to a control you do not have, you are buying a policy that will not respond. Tell us the truth about what you run and we will find the carrier that will write it.
The regulated cases
If you are in healthcare, HIPAA sits on top of the state duties. If you are a financial services firm licensed by the New York Department of Financial Services, the cybersecurity regulation at 23 NYCRR 500 imposes a detailed programme with annual certification — considerably more than the SHIELD Act asks of an ordinary business.
We are not your compliance advisers and we will not pretend to be. What we will do is make sure the insurance matches the obligations you actually have, and tell you plainly when the question you are asking belongs to a lawyer or a security firm instead of to us.
Nothing is insured until it is bound, in writing. A quote is an estimate of a premium, not a promise of one and not cover. The number can move when the carrier pulls your motor vehicle record, your loss history or your insurance score, and it can move again at underwriting. Nothing is insured until a policy is bound and you have the effective date and time in writing. We do not backdate, and no cover on this site starts because you filled a form in.
Included as standard
How we handle this line
Social engineering asked for by name
The loss small businesses actually suffer, frequently excluded as standard, and available by endorsement with a sub-limit.
Notification costs sized to your records
Because the cost is driven by how many people you have to contact, not by how interesting you are to an attacker.
Controls answered honestly
Multi-factor authentication and tested backups. A yes you cannot support is a policy that will not respond.
Incident response panel checked
Access to people who have handled ransomware before is worth as much as the limit, and not every policy provides it.
Business interruption included
Your own downtime, which for a business that trades online is frequently the largest first-party loss.
Honest about our own limits
We place insurance. We are not your security consultants or your compliance counsel, and we will say when you need those.
When to ring us
Signs this is worth a conversation
- You hold customer, patient or employee records of any kind.
- You take payments or store card details.
- Your bookkeeper can change supplier bank details from an email.
- You have no multi-factor authentication on email.
- Your backups have never actually been tested by restoring from them.
- You are regulated by DFS or handle health information.
Cyber liability — what it typically costs
- Typical annual premium for $1M of cyber cover for a small business holding customer data.$700 – $2,600
This is a typical premium range for this area. It is not a quote, and it is not our price. We do not set premiums: a carrier files its rates with the Department of Financial Services and our commission is already inside the filed rate, so the same policy from the same carrier costs the same through any producer in New York. What genuinely moves your own number is which carrier writes it, the limits and deductibles you choose, and the facts on your record — which is what we would go through with you before anything is quoted.
Questions we are actually asked
Cyber liability — frequently asked
Is my small business really at risk?
The risk that matters at your scale is not a targeted intrusion — it is a convincing email persuading somebody to make a payment, and an obligation to notify everybody whose data was exposed. Both scale with how many records you hold rather than with how interesting you are, and New York's notification duty has no small business exemption.
Does cyber insurance cover a fraudulent payment?
Only with a social engineering or funds transfer fraud endorsement. It is commonly excluded as standard because the transfer was made voluntarily by your own employee rather than through a system intrusion — which is precisely why it is the exposure to ask for by name.
What does the carrier require of me?
Increasingly, multi-factor authentication on email and remote access, backups that have been tested by actually restoring from them, and current patching. Some carriers decline without MFA and some apply coinsurance to ransomware claims where it was absent. Answering the application inaccurately buys a policy that will not respond.
How much is cyber insurance for a small business?
Typically $700 to $2,600 a year for $1,000,000 of cover, driven by revenue, the volume and type of records you hold, and the controls you have in place. Businesses with strong controls are now meaningfully cheaper to insure than those without.
Related cover
Usually considered alongside this
Professional liability
For the businesses whose product is advice — where the loss is somebody else's money and no general liability policy touches it.
$900 – $4,200
Business insurance
The businessowners policy that covers most small Queens businesses properly, and the four risks it is famous for leaving out.
$800 – $2,800
Commercial property
Building, stock, tenant improvements and the income you lose while the place is shut — which is the part most policies are short on.
$1,200 – $5,400
Commercial umbrella
The extra layer that contracts increasingly demand, sitting above your liability, your auto and usually your employers liability.
$900 – $4,500Bring the declarations page and we will read it with you
Ask us what it would cost
Send or bring the summary pages of what you already have — those two sheets are where most of the useful conversation is. We will tell you what we would place it with and what that would cost, what we are paid for doing it, and whether you should move at all. Quite often the answer is that your current policy is priced fairly and you should keep it, and that is an answer we give in writing like any other.