What does cyber insurance cost a small business, and what do insurers now require?

For a small UK business, standalone cyber insurance typically costs from a few hundred pounds to around £1,000 a year, with broker benchmarks published in May 2026 putting a £1 million policy for a consultancy or contractor turning over £500,000 to £1 million at about £500 to £750 a year ^{1Source 1How much does cyber insurance cost? 2026 UK premium benchmarks — Get Indemnity, updated 1 May 2026 (broker guide).getindemnity.co.uk/cyber-insurance/costAccessed 3 November 2026See in Sources2Source 2How much does cyber insurance cost? — Coversure (broker guide, undated).www.coversure.co.uk/ultimate-guide-cyber-insurance/cyber-insurance-cost/Accessed 3 November 2026See in Sources}. Premiums rise with turnover, the data you hold and the limit you buy: the same benchmarks put a £2 million law firm with a £5 million limit at £7,500 to £10,000 ^{1Source 1How much does cyber insurance cost? 2026 UK premium benchmarks — Get Indemnity, updated 1 May 2026 (broker guide).getindemnity.co.uk/cyber-insurance/costAccessed 3 November 2026See in Sources}. Before they quote, most insurers now expect multi-factor authentication, tested offline backups, protected and patched devices and staff training; without MFA in particular, brokers say many insurers will simply decline ^{3Source 3New ABI publications outline path to stronger cyber resilience — Association of British Insurers, 19 August 2026.www.abi.org.uk/media-hub/news-post/new-abi-publications-outline-path-to-stronger-cyber-resilienceAccessed 3 November 2026See in Sources4Source 4MFA used to be a nice-to-have. Now insurers just say no without it — Insurance Business UK, 12 August 2026 (trade press, quoting UK brokers).www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave--now-insurers-just-say-no-without-it-585827.aspxAccessed 3 November 2026See in Sources}. Business Technologies NI (BTNI) does not sell insurance. This guide explains what the market charges, what underwriters look for and how to get the controls in place.

The short version

• Standalone cyber cover for a small business typically costs a few hundred pounds to about £1,000 a year; a £25,000 add-on to an existing business policy can cost under £200 ^{1Source 1How much does cyber insurance cost? 2026 UK premium benchmarks — Get Indemnity, updated 1 May 2026 (broker guide).getindemnity.co.uk/cyber-insurance/costAccessed 3 November 2026See in Sources2Source 2How much does cyber insurance cost? — Coversure (broker guide, undated).www.coversure.co.uk/ultimate-guide-cyber-insurance/cyber-insurance-cost/Accessed 3 November 2026See in Sources5Source 5Cyber insurance for small businesses — Simply Business, updated 14 July 2026 (broker price, £25,000 limit, including insurance premium tax).www.simplybusiness.co.uk/insurance/cyber-insurance/Accessed 3 November 2026See in Sources}.
• Insurers now assess your controls before quoting. MFA, backups, endpoint protection, patching and training are the ones that decide whether you're insurable and at what price ^{3Source 3New ABI publications outline path to stronger cyber resilience — Association of British Insurers, 19 August 2026.www.abi.org.uk/media-hub/news-post/new-abi-publications-outline-path-to-stronger-cyber-resilienceAccessed 3 November 2026See in Sources4Source 4MFA used to be a nice-to-have. Now insurers just say no without it — Insurance Business UK, 12 August 2026 (trade press, quoting UK brokers).www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave--now-insurers-just-say-no-without-it-585827.aspxAccessed 3 November 2026See in Sources6Source 6Cyber Security Controls for UK Businesses: ABI's 2026 guidance — Beinsure, 10 September 2026 (trade press).beinsure.com/news/cyber-security-controls-for-uk-businesses/Accessed 3 November 2026See in Sources}.
• Cyber Essentials certification includes £25,000 of cyber liability cover for eligible UK organisations, and the NCSC reports certified organisations are 92% less likely to claim ^{7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources8Source 8NCSC Annual Review 2025: empowering organisations with NCSC tools and services — National Cyber Security Centre, 14 October 2025.www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/empowering-organisations-ncsc-tools-servicesAccessed 3 November 2026See in Sources}.
• Policies pay for incident response, data recovery, business interruption and liability claims. They don't pay regulatory fines, and many exclude state-backed attacks and some kinds of fraud ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources10Source 10Market Bulletin Y5381: State backed cyber-attack exclusions — Lloyd's, 17 August 2022.assets.lloyds.com/media/e9a4058c-4c25-48d6-99d3-0c466987e099/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdfAccessed 3 November 2026See in Sources11Source 11UK to lead crackdown on cyber criminals with ransomware measures — Home Office, 22 July 2025.www.gov.uk/government/news/uk-to-lead-crackdown-on-cyber-criminals-with-ransomware-measuresAccessed 3 November 2026See in Sources}.

What does cyber insurance cost a small business in the UK?

There is no published UK-wide average: the Government's Cyber Security Breaches Survey measures who has insurance, not what they pay ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}. The figures below come from UK brokers' published guides, so treat them as indicative. Every policy is priced on turnover, sector, the data you hold, your security controls, your claims history and the limit you buy ^{2Source 2How much does cyber insurance cost? — Coversure (broker guide, undated).www.coversure.co.uk/ultimate-guide-cyber-insurance/cyber-insurance-cost/Accessed 3 November 2026See in Sources}.

Two things stand out. First, the limit matters as much as the turnover: a £25,000 limit is cheap but, as the Cyber Essentials scheme itself notes of its included cover, it "might be sufficient for a small breach or incident but will be inadequate if you suffer a serious problem or more than one incident" ^{7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources}. Second, your controls move the price. Brokers say premiums for lower-risk small businesses start from a few hundred pounds a year, where the business has strong email security, MFA, backups and limited sensitive data ^{1Source 1How much does cyber insurance cost? 2026 UK premium benchmarks — Get Indemnity, updated 1 May 2026 (broker guide).getindemnity.co.uk/cyber-insurance/costAccessed 3 November 2026See in Sources}.

What do insurers now require before they will quote?

In August 2026 the Association of British Insurers (ABI) published good-practice guidance on cyber resilience. It is not a mandatory minimum, but it describes what the industry regards as the basics: regular staff training, reliable offline backups, clear incident response plans, multi-factor authentication, good logging and monitoring, strong encryption, and supplier and third-party checks ^{3Source 3New ABI publications outline path to stronger cyber resilience — Association of British Insurers, 19 August 2026.www.abi.org.uk/media-hub/news-post/new-abi-publications-outline-path-to-stronger-cyber-resilienceAccessed 3 November 2026See in Sources}. Underwriters apply the same list in their proposal forms.

Answer the proposal form honestly. The NCSC's guidance is blunt: "If you're claiming that security measures are in place when they're not, the insurer may not be obliged to pay any claims" ^{13Source 13Cyber insurance guidance — National Cyber Security Centre (NCSC), 2020.www.ncsc.gov.uk/guidance/cyber-insurance-guidanceAccessed 3 November 2026See in Sources}.

Does Cyber Essentials reduce cyber insurance costs?

It can, in three ways. First, a UK-domiciled organisation with turnover under £20 million that certifies its whole organisation to Cyber Essentials is entitled to cyber liability insurance with a £25,000 limit of indemnity and a 24-hour incident helpline, at no extra cost beyond the certification fee ^{7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources}. The same scheme offers upgrades: for an organisation turning over up to £10 million, a £100,000 limit costs £305.76 a year and a £250,000 limit £546.56, including tax ^{7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources}.

Second, the NCSC reports data from the scheme's insurer showing that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance ^{8Source 8NCSC Annual Review 2025: empowering organisations with NCSC tools and services — National Cyber Security Centre, 14 October 2025.www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/empowering-organisations-ncsc-tools-servicesAccessed 3 November 2026See in Sources}. Third, the NCSC notes that some insurers offer discounts where recognised defences, such as those certified by Cyber Essentials or Cyber Essentials Plus, are already in place ^{13Source 13Cyber insurance guidance — National Cyber Security Centre (NCSC), 2020.www.ncsc.gov.uk/guidance/cyber-insurance-guidanceAccessed 3 November 2026See in Sources}. One charity told the Government's breaches survey: "If you don't have at least Cyber Essentials, then insurance will be prohibitively expensive" ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}.

Our guides to what Cyber Essentials costs and to Cyber Essentials for professional firms cover the fees and the five controls.

What does a cyber insurance policy cover?

The ABI describes two kinds of cover. First-party cover pays for your own direct financial loss from a cyber event, typically theft of funds, theft of data or damage to digital assets, together with the incident response, forensic investigation, data restoration and business interruption costs that follow ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources}. Third-party cover pays for liability actions brought against you, including investigation and defence costs, civil damages and compensation to affected parties ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources}.

What does cyber insurance not cover?

• Fines. "Cyber insurance will not cover criminal, civil or regulatory fines, penalties or sanctions" ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources}. The ICO's higher maximum fine is £17.5 million or 4% of global annual turnover, whichever is higher ^{14Source 14The maximum amount of a fine under UK GDPR and DPA 2018 — Information Commissioner's Office.ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/Accessed 3 November 2026See in Sources}.
• State-backed attacks. Since 31 March 2023, standalone cyber policies written at Lloyd's must exclude losses from state-backed cyber attacks, and the ABI lists attacks linked to a country or government as a common exclusion across the market ^{10Source 10Market Bulletin Y5381: State backed cyber-attack exclusions — Lloyd's, 17 August 2022.assets.lloyds.com/media/e9a4058c-4c25-48d6-99d3-0c466987e099/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdfAccessed 3 November 2026See in Sources9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources}.
• Some fraud. The NCSC warns that "some insurance policies will not cover monies lost through business email compromise fraud", and the Cyber Essentials-included cover excludes money stolen by electronic means ^{13Source 13Cyber insurance guidance — National Cyber Security Centre (NCSC), 2020.www.ncsc.gov.uk/guidance/cyber-insurance-guidanceAccessed 3 November 2026See in Sources7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources}.
• Physical damage and bodily injury, outages of national infrastructure such as power or telecoms, and claims brought in North America unless the policy says otherwise ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources}.
• Conditions you didn't keep. Policies commonly require you to maintain the controls you declared. The Cyber Essentials-included cover, for example, requires you to install and maintain automatic updates for critical business software ^{7Source 7Cyber Liability Insurance — IASME Consortium, updated 17 October 2026.iasme.co.uk/cyber-essentials/cyber-liability-insurance/Accessed 3 November 2026See in Sources}.

Ransom payments are a moving target. In July 2025 the UK Government confirmed plans to ban public sector bodies and critical national infrastructure operators from paying ransoms, and to require other businesses to notify the Government of any intent to pay ^{11Source 11UK to lead crackdown on cyber criminals with ransomware measures — Home Office, 22 July 2025.www.gov.uk/government/news/uk-to-lead-crackdown-on-cyber-criminals-with-ransomware-measuresAccessed 3 November 2026See in Sources}. Check how your policy treats extortion before you need it.

How many UK businesses have cyber insurance?

In the 2025/2026 Cyber Security Breaches Survey, 47% of businesses had some form of cyber insurance, but most of that was cover within a wider policy: only 10% had a specific, standalone cyber policy ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}. Meanwhile 43% of businesses reported a breach or attack in the previous 12 months, including 46% of small businesses ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}. The median cost of the most disruptive breach was nil, but the costliest 5% of incidents reached £4,000 for businesses overall and £10,000 for medium and large ones, before any longer-term loss of customers or reputation ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}.

How do you buy cyber insurance sensibly?

1. 1.Put the controls in first. MFA everywhere, tested backups, endpoint protection and patching lower the price and may be the difference between a quote and a refusal ^{1Source 1How much does cyber insurance cost? 2026 UK premium benchmarks — Get Indemnity, updated 1 May 2026 (broker guide).getindemnity.co.uk/cyber-insurance/costAccessed 3 November 2026See in Sources4Source 4MFA used to be a nice-to-have. Now insurers just say no without it — Insurance Business UK, 12 August 2026 (trade press, quoting UK brokers).www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave--now-insurers-just-say-no-without-it-585827.aspxAccessed 3 November 2026See in Sources}.
2. 2.Decide the limit from your exposure: how much a week without systems would cost, how many customer records you hold, and whether clients or contracts set a minimum.
3. 3.Use a broker who places cyber cover regularly, and answer the proposal form from evidence rather than memory ^{13Source 13Cyber insurance guidance — National Cyber Security Centre (NCSC), 2020.www.ncsc.gov.uk/guidance/cyber-insurance-guidanceAccessed 3 November 2026See in Sources}.
4. 4.Read the exclusions, especially fraud, war and state-backed attacks, territorial limits and the conditions you must keep ^{9Source 9Cyber insurance — Association of British Insurers, web page.www.abi.org.uk/policy-and-guidance/insurance/business-insurance/cyber-insuranceAccessed 3 November 2026See in Sources10Source 10Market Bulletin Y5381: State backed cyber-attack exclusions — Lloyd's, 17 August 2022.assets.lloyds.com/media/e9a4058c-4c25-48d6-99d3-0c466987e099/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdfAccessed 3 November 2026See in Sources}.
5. 5.Note the claims process now: the policy's helpline is usually the first call on the day, yet only about half of insured businesses say they would tell their insurer after a breach ^{12Source 12Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}.

Where does BTNI fit in?

BTNI does not sell or advise on insurance; a regulated broker does that. What we do is put the controls insurers ask about in place and keep them there, through our Cybersecurity and Backup & Disaster Recovery services, including Cyber Essentials readiness, so the answers on your proposal form are true and you can show the evidence. A free Business Technology Review tells you where you stand against the list above.