Average Cyber Insurance Cost (2026 Report)

Small businesses pay $83 per month ($999 annually) on average for cyber insurance with a $1 million aggregate annual limit. This national benchmark comes from analysis of business insurance costs for over 400 industries across all 50 states and Washington, D.C.

Keep in mind that this is only an estimate, and you quote is based on your industry, the type and amount of information you store, where you operate, and how many employees have access to your systems.

Most business insurance prices physical danger, but cyber insurance prices data value. The more sensitive information you store, the more you pay. Three factors mainly drive your premium: industry (what data you hold), employee count (how many access points you create), and location (how much breaches cost to resolve in your state).

Below, we'll break down how each of these items affect your pricing and what sub-factors they're the source of.

Use this table to find your size band and see how much you're paying above or below baseline. If you're between bands, budget for the higher one before you grow into it.

Unlike other coverage types, cyber insurance costs by general industry area are more normally distributed:

• Low-risk (20%+ below average): Cleaning services, transportation and logistics, recreation and sports, nonprofits and associations, agriculture and natural resources
• Mid-risk (within 20% of average): Wholesale and distribution, arts/media/entertainment, manufacturing, childcare services, education, construction and contracting, fitness services, pet care services, real estate and property services, repair and maintenance, beauty/body/wellness services, food and beverage, retail and product rental, marketing and communications, other professional services (event planners, lawyers, security guards)
• High-risk (20%+ above average): Consulting services, hospitality/travel/tourism, financial services, health care and medical, tech/IT

Tech companies, health care providers, and financial services firms pay 37% or more above average because their industries often involve high-value transactions and highly sensitive information. Even though these industries are especially expensive, most are not above average, and 68% are below national benchmarks.

Find your industry below to see where you fall, then review the risk tier to decide whether to prioritize security investments or shop harder for competitive rates.

If you want to explore cyber insurance costs in more detail for your area of work, we've provided resources focused on industry level costs below.

Location matters less in cyber than in other business insurance, but it's still worth checking. The gap between the cheapest state Wyoming ($71) and most expensive area of Washington D.C. ($103) is only $32 a month because cyber-attack risk is not directly tied to your location.

Similar to industry, state risk is more normally distributed and cyber insurance pricing follows with an even more clear bell curve:

• Lower-cost (10%+ below average): Idaho, Montana, North Dakota, Alaska, Wyoming.
• Mid-cost (Within 10% of average): Colorado, Texas, Florida, Georgia, North Carolina, Oregon, Pennsylvania, Michigan, Ohio, Minnesota, Arizona, Tennessee, Missouri, Wisconsin, Indiana, Alabama, South Carolina, Kentucky, Louisiana, Utah, Kansas, Oklahoma, New Mexico, Mississippi, New Mexico, Mississippi, Arkansas, Hawaii, Rhode Island, Maine, New Hampshire, Iowa, Vermont, Nebraska, West Virginia, South Dakota,
• Higher-cost (10%+ above average): Washington D.C (District of Columbia), New York, California, New Jersey, Connecticut, Illinois, Maryland, Massachusetts, Delaware, Nevada, Virginia, Washington.

California and New York are the only states/territories that sit 20% above the national average for cyber insurance costs due to stricter notification timelines, more aggressive attorneys and juries that award larger settlements. That vast majority of states are close to the average with 65% falling within 10% of national benchmarks.

California and New York cost more because breach response there is more expensive: stricter notification timelines, more aggressive attorneys general, and juries that award larger settlements.

Unlike other business insurance, you can directly reduce your cyber premium by improving your security. Missing basic controls like MFA or EDR can add 25% to 50% to your quote or disqualify you entirely. Strong security signals lower risk and earns better rates. Prioritize the required controls first to qualify for coverage, then add discount-earning controls if the math makes sense for your risk level.

Cyber insurance costs vary based on how insurers estimate your breach likelihood and potential claim size. Your premium is most influenced by industry, employee count and state. Use the $83 monthly national average as a reference point, not a prediction.

To get the most out of this data, think through three questions: Where do you fall compared to the average, given your industry, state and employee count? What's driving your cost, whether that's data sensitivity or your security posture? And what would actually change your price, like adding MFA, EDR or backup procedures, or shopping multiple insurers?

Unlike other business insurance, you have direct control over cyber premiums through security investments. Strong controls can cut your quote by 20% to 30% or make the difference between approval and denial.

Where you go next depends on where you are in your buying process.

Ready to compare providers?

• Best Cyber Insurance Providers