"How much will it cost?" is the first question every business owner asks me about cyber cover. The honest answer is that it depends on you, and that is good news, because much of what drives cyber insurance cost sits within your control.
Insurers price each business on its own risk. Two firms of the same size can receive very different quotes. In this guide I explain the factors that move the premium, with examples, so you can see where your business stands and what to improve before you apply.
Why there is no standard cyber insurance cost
Cyber insurance for business has no price list. Each insurer has its own appetite, its own rating model and its own view of risk. Prices also shift from year to year as the market changes.
In outline, every insurer asks the same three things. How big a target are you? How much damage could an attack cause? How well can you resist and recover? Then it sets a premium for the limit and deductible you choose.
For example, two accountancy firms in the same city ask for quotes on the same day. One has MFA on every account and tested backups. The other has neither. The first firm may receive several quotes to choose from. The second may receive fewer quotes, higher prices or a request to fix its controls before an insurer will offer terms.
Revenue and sector: how big a target you are
Revenue is usually the starting point. A larger business tends to have more systems, more staff and more income to lose during an outage. So the potential claim grows with turnover.
Sector matters just as much. Insurers group industries by how often attackers target them and how badly an outage hurts.
- A manufacturer may face a large business interruption loss if ransomware stops its production line.
- A law firm holds sensitive client files and moves client money, which attracts fraudsters.
- A design studio with similar revenue may hold little sensitive data and recover quickly from an outage.
For example, a 40-person engineering consultancy and a 40-person online pharmacy may report similar revenue. The pharmacy handles health data and card payments around the clock, so an insurer will usually treat it as the higher risk.
The data you hold: records and sensitivity
Insurers ask how many personal records you hold and what type they are. A breach of many records means more notification letters, more customer claims and more regulatory work.
The type of data matters too. Health records, payment card data and identity documents cost more to handle after a breach than a simple mailing list.
For example, a private clinic with years of patient files carries more breach exposure than a marketing agency holding only client contact names. You can reduce this factor yourself:
- Delete records you no longer need, in line with your retention rules.
- Move card payments to a payment provider so card numbers never touch your systems.
- Encrypt laptops and databases that hold personal data.
Controls: MFA, backups and EDR
This is the factor you can move fastest, and in cyber insurance underwriting it carries real weight. Many insurers treat a few controls as essential before they will offer cover at all:
- Multi-factor authentication (MFA) on email, remote access and admin accounts. Our MFA checklist lists what underwriters usually accept.
- Backups kept separate from your main network, with a recent restore test. See the backup and restore checklist.
- Endpoint detection and response (EDR) on laptops and servers, so your team or provider spots and stops an attack early.
- Patching of critical systems within a set time.
- Staff training on phishing and payment fraud.
For example, a logistics firm with 90 staff applies for cover. It has MFA on email but leaves its remote access portal without it. An insurer may decline or add an exclusion until the firm closes that gap. Once MFA covers remote access too, the same firm can go back to market with a much stronger story.
Evidence matters as much as the control itself. A dated restore test report carries more weight than a line saying "we test backups". PrismX helps businesses collect that evidence, track when it expires, and present it in a signed submission an insurer can review.
Claims history, limits and deductible
Three more factors shape your final cyber insurance cost.
Claims history. A business with past cyber claims or incidents will usually pay more. Insurers want to see what you changed afterwards. For example, a recruitment agency that suffered a fake invoice fraud and then added payment call-back checks has a far better story to tell than one that changed nothing.
Limit. The limit is the most the policy pays. A higher limit means more protection and a higher premium. When you choose it, think about your worst realistic day, such as two weeks offline plus letters to every customer.
Deductible. This is the amount you pay before the insurer pays. A higher deductible usually lowers the premium, because you carry more of the small losses yourself. Pick a level your cash flow can really absorb.
For example, a retailer with steady cash reserves might choose a higher deductible to save on premium. A start-up with thin cash might prefer a lower deductible and accept a higher premium each year.
How to lower your cyber insurance cost before you apply
You can start bringing your cyber insurance cost down months before renewal. Here is the order I suggest:
- Fix the essentials first. Put MFA everywhere it counts, keep separate backups with a restore test, and run EDR on every device.
- Gather proof. Screenshots, reports and dated test results carry more weight than ticked boxes.
- Reduce your data. Delete what you do not need and move card payments out of your systems.
- Answer the proposal form accurately. A wrong answer can cause trouble at claim time, even if it lowers the price today.
- Give your broker time. Starting early lets them approach more insurers and compare terms.
Our application readiness checklist walks through each step. When you are ready, read how to get a cyber insurance quote faster.
Your cyber insurance cost reflects the risk an insurer sees, and you control much of what it sees. Start with your controls and your evidence this month. To see how PrismX can prepare your business for its next application, book a pilot conversation.