Cyber incidents are no longer a problem reserved for banks and large technology companies. In the Allianz Risk Barometer 2026, cyber incidents ranked as the UK’s number-one business risk, cited by 62% of respondents. The government’s Cyber Security Breaches Survey 2025/2026 adds a practical warning: 46% of small businesses identified a cyber breach or attack in the previous 12 months.
That does not mean every small company needs a large cyber liability policy. It does mean owners should decide deliberately rather than assume general business insurance will pick up the bill. Cyber insurance works best alongside good security, not as a replacement for it.
What cyber insurance for small businesses actually covers
A standalone policy is designed to help with costs arising after a cyber event. Exact wording varies, but cover may include forensic investigation, restoration of systems and data, legal advice, customer notification, crisis communications and loss of income while systems are unavailable.
Some policies also provide third-party liability protection if clients claim your business failed to safeguard their information, where data breach insurance and a broader cyber liability policy can overlap. For a small firm, one of the most valuable benefits may be immediate access to specialist incident-response teams during a crisis.
Ransomware insurance cover needs careful reading. A policy may pay for investigation, data restoration and business interruption, while ransom payments can be restricted, excluded or subject to legal, sanctions and insurer-approval requirements. “Ransomware covered” does not mean every loss will be reimbursed.
Why small businesses have a real exposure
Smaller firms may have fewer servers and employees, but they often have fewer layers of defence. One compromised Microsoft 365 account, stolen laptop or fraudulent supplier email can interrupt a company that depends on a handful of people and cloud systems.
The 2025/2026 government survey found phishing remained by far the most common type of attack. Only 47% of businesses overall used two-factor authentication and just 25% had a formal incident-response plan. Those gaps matter because a cyber incident can quickly become a cash-flow, customer-service and legal problem.
Imagine a ten-person accountancy firm. An employee enters credentials into a convincing fake login page. The attacker accesses the mailbox, downloads client information and changes bank details on an invoice. The firm may need to investigate, restore accounts, contact clients and obtain legal advice. Where a personal data breach meets the reporting threshold, UK GDPR generally requires notification to the Information Commissioner’s Office within 72 hours of becoming aware of it. A suitable policy can provide expertise and cover some response costs.
Do you really need SME cyber insurance in the UK?
Cyber insurance is not a universal legal requirement for ordinary UK small businesses. The better question is whether your company could comfortably absorb the financial and practical consequences of a serious incident without specialist support.
Cover becomes more compelling if you hold customer or employee personal data, take payments online, rely heavily on cloud software, provide professional services, store commercially sensitive information, or would lose meaningful revenue if email, ecommerce or booking systems went offline. Client contracts may also require cyber cover.
A micro business with minimal data, reliable backups and limited dependence on connected systems may decide to retain more of the risk itself. Even then, the decision should follow a basic risk assessment rather than the assumption that a small company is too insignificant to attack.
What does cyber insurance cost for a UK small business?
There is no authoritative single UK average premium because insurers price individual risk. Published 2026 broker estimates vary widely, but straightforward micro and small firms may see quotes from a few hundred pounds a year, while data-heavy, higher-turnover or higher-risk SMEs can pay into the low thousands or more.
Insurers commonly consider turnover, sector, sensitive data, claims history, remote access, payment activity, business interruption exposure and existing security controls. Comparing policies only by premium can be misleading. A cheaper policy with a low interruption limit, narrow fraud cover or large excess may provide worse value after a real incident.
How to reduce your premium and strengthen your application
Improve security before asking insurers to price the risk. Multi-factor authentication for email, administrator and remote-access accounts is a common underwriting expectation. Keep software patched, restrict administrator privileges and maintain backups that an attacker cannot easily alter.
Cyber Essentials can provide a useful framework. The National Cyber Security Centre recommends fundamental safeguards and points organisations considering insurance towards Cyber Essentials or Cyber Essentials Plus. The latest government survey found Cyber Essentials certification among small businesses had increased from 5% to 12%.
Be precise on the proposal form. If you state that MFA protects all remote access while a critical system is exempt, that mismatch can cause problems later. Document backup testing, staff responsibilities and incident-response procedures so you can demonstrate how the risk is managed.
Natural internal reading paths include business insurance for small businesses, a cyber security checklist for SMEs and business interruption insurance.
What to check before buying a cyber liability policy
Start with existing insurance. The NCSC advises organisations to check whether business interruption, property or other policies already provide cyber-related protection or specifically exclude it. Then compare standalone cover against the losses your business would actually face.
Check the business interruption waiting period, whether outages at cloud providers are covered, limits for data restoration and incident response, exclusions for social engineering or funds transfer, and the insurer’s notification requirements. Also distinguish between regulatory support and regulatory penalties; legal and investigation costs may be covered, but you should not assume every regulatory fine is insurable.
FAQ
Is cyber insurance mandatory for small businesses in the UK?
Generally, no. Most UK small businesses are not legally required to buy cyber insurance, although a client, lender, supplier agreement or industry contract may require it.
Does cyber insurance cover ransomware?
Many policies cover parts of a ransomware incident, including forensic response, data recovery and business interruption. Ransom payments may face exclusions, sanctions restrictions and prior insurer approval.
Does general business insurance include cyber cover?
Sometimes limited protection is included, but many traditional policies restrict or exclude cyber losses. Review the wording and ask the insurer or broker exactly what is covered.
Can better cyber security reduce the cost of cover?
It can improve eligibility and may lead to better terms. Insurers commonly assess controls such as MFA, patching, backups, access management and staff training, although pricing varies by insurer and risk profile.
Is cyber insurance worth it?
For many small UK businesses, cyber insurance is increasingly sensible because the exposure is not just the likelihood of an attack; it is the cost and complexity of responding when one succeeds. Government figures show cyber incidents are common among small firms, while 2026 market data places cyber at the top of UK business concerns.
The strongest approach combines prevention with risk transfer. Improve security first, calculate how much downtime, lost data and professional response you could fund yourself, then compare policies against that gap. If a serious breach would strain cash flow or leave you scrambling for technical and legal support, cyber insurance can be a practical part of business resilience.
