Cyber insurance for small business: what it covers and what to check
Cyber insurance, often sold as cyber liability insurance, pays for the costs of a cyber incident, such as ransomware, a hacked email account or a data breach: getting expert help to contain it, restoring systems and data, notifying affected customers, the income you lose while you can't trade, and claims or regulatory action from people whose information was exposed. Most small business policies combine that first-party cover with third-party liability cover.
It is not compulsory, and it's usually not included in a standard business package, so a business that takes payments, holds customer records or can't trade without its systems should look at it on its own merits. The value is in the detail: what the policy calls an incident, the sub-limits on payment fraud, the waiting period before income cover starts, and the security steps you promise on the proposal form.
By Better Rate Mate Editorial Team ยท Last reviewed
General advice only. It doesn't consider your circumstances. Read the PDS and TMD before you decide.
What cyber liability insurance covers
Cyber liability insurance policies split into two halves. First-party cover pays your own costs after an incident; third-party cover pays claims made against you by others. The table sets out what each part usually responds to. Names and limits differ between insurers, so the policy wording decides.
| Part | What it usually pays for | What to check |
|---|---|---|
| Incident response | IT forensic specialists, lawyers and crisis support to contain the incident and work out what happened | Whether there is a 24/7 hotline and whether you must use the insurer's panel of providers |
| Data and system restoration | Recovering or rebuilding data, software and systems damaged by the incident | Whether hardware replacement is included or excluded |
| Business interruption | Lost profit while your systems are down because of a covered incident | The waiting period in hours before cover starts, and the indemnity period |
| Notification and monitoring | Telling affected individuals and regulators, and credit or identity monitoring for customers | Whether regulator-required notifications are covered in full |
| Cyber extortion | Specialist negotiation and, where lawful and agreed by the insurer, an extortion payment | The insurer's consent conditions and the ransom payment reporting rule (below) |
| Privacy and network liability | Claims by customers or others whose information was exposed, and the legal cost of defending them | The limit, and whether it is shared with your first-party costs |
| Regulatory defence | Legal costs of responding to a regulator's investigation after a breach | Whether fines and penalties are covered at all, and only where insurable by law |
| Payment diversion (social engineering) | Money sent to a criminal after a fake invoice or a hacked supplier email | Often a small sub-limit or an optional extension, sometimes only under crime cover |
How often small businesses are hit, and what it costs
Often, and the cost is real money. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 says its Australian Cyber Security Centre received over 84,700 cybercrime reports in the year, about one every 6 minutes, and it assesses that the vast majority of cybercrime still goes unreported. The average self-reported cost of cybercrime per report was $56,600 for a small business, up 14% on the year before, $97,200 for a medium business and $202,700 for a large one.
Email is the main way in. The top self-reported cybercrime threats for businesses were email compromise without financial loss (19% of reports), business email compromise fraud that did cause a loss (15%) and identity fraud (11%). That's why the payment diversion section of a policy, and its sub-limit, matters so much to a small business.
| Business size | 2022-23 | 2023-24 | 2024-25 |
|---|---|---|---|
| Small | $45,965 | $49,615 | $56,571 |
| Medium | $97,203 | $62,870 | $97,166 |
| Large | $71,598 | $63,202 | $202,691 |
Common cyber risks for small business
These are the cyber risks and cyber attacks that most often reach small businesses, and the part of a cyber policy that responds to each. The first three are the top business threats in the Australian Signals Directorate's Annual Cyber Threat Report 2024-25.
| Cyber risk | What happens | Cover that usually responds |
|---|---|---|
| Email compromise | A criminal gets into a business email account and uses it to read, send or redirect mail. Email compromise without a financial loss was ASD's top self-reported business threat in 2024-25 (19% of reports) | Incident response and data and system restoration |
| Business email compromise fraud and invoice scams | A fake or altered invoice, or a hacked supplier's email, gets you to pay a criminal's account. 15% of business reports in 2024-25 | Payment diversion (social engineering) cover, often a small sub-limit or optional extension |
| Identity fraud | Your business or staff details are used to open accounts or impersonate you. 11% of business reports in 2024-25 | Incident response and identity monitoring for affected people |
| Ransomware and other malware | Malicious software encrypts or locks your files and systems, often with a demand to pay | Cyber extortion, data recovery and business interruption. A business with turnover of $3 million or more must report a ransom payment to ASD within 72 hours |
| Data breach | Customer or staff information is stolen or exposed | Notification and monitoring, privacy liability and regulatory defence; the Notifiable Data Breaches scheme may apply |
| Website or system outage after an attack | You can't take bookings, payments or orders while systems are down | Business interruption, after the policy's waiting period |
Reputational damage
A breach can cost customers' trust as well as money. Some policies include crisis communications or public relations costs after a covered incident; check whether yours does and what the limit is, because reputational damage itself (lost future business) is usually not something a policy pays for directly.
The reporting rules a cyber incident can trigger
Two sets of legal obligations can land on a business in the days after an incident, and a good policy funds the help you need to meet them.
The first is the Notifiable Data Breaches scheme, run by the Office of the Australian Information Commissioner (OAIC) under the Privacy Act. Organisations covered by it must notify the OAIC and the people affected when a data breach is likely to result in serious harm, and must take all reasonable steps to assess a suspected breach within 30 calendar days. The scheme covers businesses and not-for-profits with an annual turnover of more than $3 million, and some smaller businesses regardless of turnover, including private health service providers, businesses that trade in personal information and Commonwealth contractors. The small business exemption was still in place at the time of writing, although the government released an exposure draft privacy bill for consultation in 2026, so check the OAIC for changes.
The second is ransomware payment reporting under the Cyber Security Act 2024. Since 30 May 2025, a business with an annual turnover of $3 million or more in the previous financial year must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making it, or of becoming aware that someone paid on its behalf. The obligation applies to the payment, not to the demand: an incident where nothing was paid does not have to be reported under this rule, although the government encourages voluntary reports through cyber.gov.au.
What cyber insurance usually does not cover
Every policy has exclusions, and a few catch small businesses more often than others:
- Incidents that began before the policy started, or that you knew about when you applied.
- Losses from failing to keep the security measures you described on the proposal form, such as multi-factor authentication or offline backups. Answer those questions accurately and keep them true.
- Outages of infrastructure you don't control, such as a power grid, internet provider or telecommunications network, unless the policy specifically extends to them.
- Upgrading systems beyond what you had before (betterment), and the cost of fixing the underlying security weakness.
- Payment diversion fraud beyond any sub-limit, which is where many small business losses actually sit.
- Fines and penalties that the law does not allow to be insured.
Does my business need cyber insurance?
Ask what a week without your systems, or a leaked customer list, would actually cost. A business that takes bookings or payments online, keeps health, financial or identity records, or can't invoice or trade when its email and accounts are locked is exposed, whatever its size. A tradie who keeps job details in a notebook and takes bank transfers is exposed too, but mostly to payment diversion, which is often only lightly covered.
Cyber cover sits alongside good security rather than replacing it. The Australian Cyber Security Centre's small business guide recommends three measures as a starting point: turn on multi-factor authentication, keep software updated, and back up your information. Insurers ask about the same basics on their proposal forms, so getting them in place helps both your security and your cover.
Is cyber cover part of my business package?
Usually not in full. Some business packages and management liability policies include a small cyber or crime section, and some professional indemnity policies respond to a claim that your error caused a client's data loss. None of those normally pays for your own incident response, restoration or lost income. If you are relying on one, check its limit and what it actually lists as covered before you decide you don't need a standalone policy.
How much does cyber insurance cost?
There's no standard price, because insurers rate each business on how likely an incident is and how much it could cost. These are the things they ask about and price on:
- Your industry and annual turnover.
- How much personal, health or payment information you hold, and how much of your trade depends on your systems.
- Your security controls: multi-factor authentication, backups kept offline, software updates and staff training. The proposal form asks, and your answers form part of the policy.
- The limit you choose, the sub-limits for payment diversion and extortion, and the excess and waiting period.
- Any previous incidents or claims.
How to compare cyber insurance quotes
Cyber policies are harder to compare on price than most business cover, because the structure varies so much. Put the quotes side by side on these points:
| Detail | Why it matters |
|---|---|
| Overall limit, and whether first- and third-party cover share it | A shared limit can be used up by your own costs before a customer claim arrives |
| Sub-limits for payment diversion, extortion and regulatory matters | These are where small-business losses concentrate |
| Business interruption waiting period | A long waiting period can mean a short outage is never covered |
| Excess (sometimes called a retention) | Check whether it applies per claim and whether a separate time excess applies to interruption |
| Claims-made basis and retroactive date | Cyber is usually written on a claims-made basis; an unknown intrusion that began before the retroactive date may not be covered |
| Incident response service | Access to specialists in the first hours is often the most valuable part of the policy |
| Security conditions | The warranties you give on MFA and backups; a false answer can defeat a claim |
General advice only. This information doesn't take into account your objectives, financial situation or needs. Consider whether the product is right for you and read the Product Disclosure Statement (PDS) and Target Market Determination (TMD) before you decide. We don't compare every product in the market, and we may earn a commission if you take up a product through our links.
What to watch for
- The proposal form is part of the contract. If you say you use multi-factor authentication or offline backups, make sure that is true on the day you claim, not just the day you apply.
- Call the insurer's incident line before you pay anyone or engage your own IT contractor. Many policies only pay for providers the insurer approves.
- Don't pay a ransom without advice. The insurer's consent may be a condition of cover, and a business with a turnover of $3 million or more must report the payment within 72 hours.
- If fake invoices and hacked supplier emails are your biggest worry, check the payment diversion sub-limit specifically. It is often a fraction of the headline limit.
Common questions
What does cyber insurance cover?
Your own costs after a cyber incident (incident response, data and system restoration, lost profit while systems are down, notifying affected customers) and claims or regulatory investigations brought against you because of it. Payment diversion fraud is usually sub-limited or needs an extension.
How much does a cyber attack cost a small business?
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 puts the average self-reported cost of cybercrime per report at $56,600 for a small business, up 14% on the previous year. Many incidents are never reported, so treat it as a guide to what a reported incident costs.
Is cyber insurance compulsory in Australia?
No. No law requires a business to hold cyber insurance. Some clients, particularly government and larger businesses, ask their suppliers to hold it as a contract condition.
Does cyber insurance pay ransoms?
Some policies can cover an extortion payment where it is lawful and the insurer consents in advance; others exclude it. Separately, a business with an annual turnover of $3 million or more must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours.
Does cyber insurance cover scam invoices and fake bank details?
Sometimes, under a social engineering or payment diversion section, but it is often a small sub-limit or an optional extra, and some insurers place it under crime cover instead. Check the wording rather than assuming the headline limit applies.
Do small businesses have to report data breaches?
If your business is covered by the Notifiable Data Breaches scheme, yes: breaches likely to result in serious harm must be notified to the OAIC and the people affected. The scheme covers businesses with an annual turnover of more than $3 million, and some smaller ones regardless of turnover, such as private health service providers.
Is cyber insurance tax deductible?
The ATO lists insurance premiums among the operating expenses a business can generally deduct. Check your own situation with your accountant or the ATO.
General information only
This page explains how cyber insurance generally works in Australia. It is not advice about your business or any particular policy. Read the Product Disclosure Statement and Target Market Determination before you buy, and speak to a licensed adviser or broker if you are unsure what you need.