Do small businesses really get targeted by cyber attacks?

Yes — small businesses are attacked more often than large ones, precisely because their defences are weaker. Automated phishing and ransomware tools don't check company size, and the majority of UK businesses reporting a breach in recent government surveys were small or micro businesses.

What does cyber insurance cover for a small business?

Typically: forensic investigation of the breach, customer notification and credit monitoring, legal and regulatory costs including GDPR exposure, ransomware and extortion response, business interruption while systems are down, data restoration, and liability if client data is lost. Most policies also include a 24/7 incident response team — often the most valuable part at 2am.

Doesn't my business insurance already cover cyber?

Almost never. Standard commercial combined and office policies exclude cyber events or offer only token extensions. Similarly, cyber policies don't replace your other covers — the two are designed to sit side by side with no gap between them.

How much does cyber insurance cost for a small business?

For most small UK businesses with straightforward IT, premiums start in the low hundreds of pounds per year — frequently less than a single hour of the incident response you'd otherwise pay for yourself. Price depends on turnover, the data you hold, and your security basics (MFA, backups, patching).

Guides · 5 min read

Do I need cyber insurance for a small business?

If you take card payments, hold customer data, run on email or rely on cloud software, you have a cyber exposure — and attackers specifically target small businesses because their defences are thinner. Here's how to decide whether the cover is worth it for you.

Why small businesses are the main target now

Cyber crime at small-business scale is automated. Phishing kits, credential stuffing and ransomware-as-a-service sweep the internet looking for weak passwords, unpatched software and suppliers to larger companies — they don't check your turnover first. Attackers know a ten-person firm is less likely to have MFA everywhere, tested backups, or anyone whose job is security.

The costs land differently too. A large company absorbs a £30,000 incident; for a small business that's a catastrophic week of downtime, emergency IT help and lost customers, before any legal or regulatory costs.

What the policy actually buys you

Beyond the financial cover — forensics, customer notification, GDPR-related legal and regulatory costs, ransomware response, business interruption and data restoration — the most undervalued part of a cyber policy is the incident response team. When your email is compromised on a Friday night, you get a 24/7 hotline to specialists who contain breaches for a living, instead of Googling for help while the clock runs.

If you hold client data — health, financial, personal records — the liability side matters too: claims from clients whose data you lost, and the costs of dealing with the ICO.

Who can probably skip it (and who can't)

A sole trader with no customer database, no online payments and no reliance on email for income might reasonably decide the risk is low. But if you invoice by email (payment diversion fraud), store customer details (breach notification costs), run a website that takes bookings or payments, or would lose a week's income if your systems went down, the arithmetic usually favours a policy that costs a few hundred pounds a year.

Why use a specialist cyber insurance broker

Cyber wordings vary enormously: what triggers business interruption cover, whether social engineering and payment diversion are included, what security controls you must warrant, and how "failure to maintain security" exclusions are drafted. A specialist cyber insurance broker knows which insurers pay claims cleanly, helps you tick the security boxes that keep premiums down (MFA, backups, patching), and makes sure the policy you buy actually responds to the attacks small businesses really face.

Common questions

Do small businesses really get targeted by cyber attacks?: Yes — small businesses are attacked more often than large ones, precisely because their defences are weaker. Automated phishing and ransomware tools don't check company size, and the majority of UK businesses reporting a breach in recent government surveys were small or micro businesses.
What does cyber insurance cover for a small business?: Typically: forensic investigation of the breach, customer notification and credit monitoring, legal and regulatory costs including GDPR exposure, ransomware and extortion response, business interruption while systems are down, data restoration, and liability if client data is lost. Most policies also include a 24/7 incident response team — often the most valuable part at 2am.
Doesn't my business insurance already cover cyber?: Almost never. Standard commercial combined and office policies exclude cyber events or offer only token extensions. Similarly, cyber policies don't replace your other covers — the two are designed to sit side by side with no gap between them.
How much does cyber insurance cost for a small business?: For most small UK businesses with straightforward IT, premiums start in the low hundreds of pounds per year — frequently less than a single hour of the incident response you'd otherwise pay for yourself. Price depends on turnover, the data you hold, and your security basics (MFA, backups, patching).

How CoverBroker fits in

CoverBroker is not an insurance broker and doesn't arrange cover. Upload your current policy documents and we'll introduce you to a specialist cyber insurance broker matched to your business — with an optional free AI review of your existing cover first. Free, no obligation.

Get matched with a cyber insurance specialist

Upload your policy documents — free, no obligation.

Upload my documents