Cyber Insurance for Small Business: Why the Application Matters More Than the Price in 2026

Cyber insurance for small business has quietly become cheaper. Rates have now fallen for four years in a row, down about 5% so far in 2026 after a 13% drop in 2025, according to figures in the Insurance Information Institute's new brief, Commercial Cyber Insurance: State of the Risk, covered by Insurance Journal on 16 October 2026. Yet most small businesses still don't have it. And the ones that do often can't say with confidence whether the policy would actually pay out. That second problem is the one worth your attention, because it usually comes down to a form you filled in from memory one afternoon.

This article covers why so few small businesses buy cyber cover, what insurers actually ask before they'll cover you, how a single wrong answer can cost you the whole policy, and how to get your answers right without hiring a security team.

The gap: cheaper cover, still not bought

The numbers from the past week tell an odd story.

The FBI's latest Internet Crime Report puts US cyber-related losses at nearly $21 billion for 2025, up from about $16 billion the year before, with more than 1 million incidents reported (via Triple-I, Insurance Journal, 16 October 2026). Losses tied to AI-driven incidents alone came to nearly $893 million. Over the same period, cyber insurance got cheaper.

You'd expect small businesses to be buying. They mostly aren't. Swiss Re estimates take-up at 5 to 10% for micro businesses and 10 to 20% for small and midsize businesses across North America and Europe (Insurance Business, 15 October 2026). In that same article, Lindsey Maher, head of global cyber development at specialist insurer CFC, put small business penetration in Australia, the UK, Canada and New Zealand at roughly 10 to 15%. The US sits higher, at 30 to 40%, partly because more than 200 insurers there sell cyber products.

So for a 6-person business on the Gold Coast or in Melbourne, the odds are that you either don't have cyber cover, or you have a bit of it bundled into a business pack and aren't sure what it includes.

Meanwhile, the cost of getting hit is real. The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 put the average self-reported cost of cybercrime at $56,600 per report for small businesses, up 14% on the year before. Business email compromise with a financial loss made up 15% of the cybercrime reported by businesses.

Why small businesses skip it

Triple-I's brief makes a point that rings true for anyone who has sat through a renewal meeting: price may not be the main barrier. Misunderstanding what cover exists and what it does is a bigger one.

CFC's Maher listed three practical blockers in the Insurance Business piece:

• Sequencing. Cyber gets pushed to the end of a renewal conversation, then dropped when time runs out.
• Broker confidence. Many generalist brokers see cyber as complicated and outside their lane.
• The application form. Long, control-heavy questionnaires are built for large companies. A 20-page form isn't realistic for a business with no IT person.

That last point is the one that matters most, and not only because it puts people off buying. It also creates the risk that the policy you do buy won't hold up.

The application is part of the policy

When you apply for cyber insurance, the insurer asks a series of questions about how you run your IT. Your answers are what they use to decide whether to cover you and what to charge. In most policies, those answers are also treated as part of the contract. If they turn out to be wrong, the insurer may have grounds to deny a claim, or to cancel the policy as if it never existed.

This isn't a theoretical risk. In 2022, Travelers sued its own customer, International Control Services, after the company was hit by ransomware in May of that year. Travelers alleged that ICS had overstated its use of multi-factor authentication (MFA) on its application. Its investigation found MFA only protected the firewall. A server and other systems weren't covered. ICS agreed to let the court enter a judgment rescinding the policy in August 2022 (Lockton summary of Travelers v. ICS). The business had paid for cyber insurance and, at the moment it needed it most, had none.

Nobody at ICS necessarily lied. Someone filling in a form ticks "Yes, we use MFA" because they turned it on for email a while back. They don't think about the old server, the shared admin login, or the accounts nobody uses anymore. The form asks a yes or no question about something that is really a list.

For a small business, that's the normal state of things. You don't have a documented security setup. You have a rough memory of what you turned on, when, and for whom.

The cyber insurance requirements you'll be asked about

Every insurer's form is different, but the cyber insurance application questions tend to cluster around the same handful of controls. If you're shopping for cover, expect to be asked about most of these.

Multi-factor authentication

Usually split into several questions: MFA on email, MFA on remote access (VPN, remote desktop, remote support tools), and MFA on admin accounts. The trap is the word "all." If one person, one shared mailbox, or one admin login doesn't have it, "all" is false.

Backups

How often you back up, whether a copy is stored separately from your main systems, and whether you've ever tested a restore. Many small businesses have backups running and have never once tried to get a file back from them. Verizon's 2026 Data Breach Investigations Report found 69% of ransomware victims declined to pay, partly because of better backups (via Triple-I, 16 October 2026). That only works if the backup actually restores.

Endpoint protection and patching

Whether every computer has security software running, and how quickly you install updates. Again, "every" is the hard word. The laptop in the cupboard that someone takes to trade shows counts.

Access and offboarding

Who has admin rights, and how quickly you remove access when someone leaves. Insurers ask because ex-staff accounts and over-powered logins are an easy way in.

Staff training and payment checks

Whether your team gets any phishing awareness training, and whether you have a process to verify changes to bank details before paying an invoice. Given that business email compromise is one of the most common costly crimes for Australian businesses, expect this to be asked in detail.

Your inventory

Some forms ask how many devices, users and systems you have, or whether you keep a list. This one sounds like admin, but every other answer depends on it. You can't say MFA is on for all users if you don't know who all your users are.

How to answer honestly without a security team

The goal isn't to look perfect on paper. It's to give answers that match reality, so that if you ever claim, there's nothing for an assessor to find that contradicts the form. Here's a practical way to get there in an afternoon or two.

1. Write the list before you answer anything

Before you open the form, write down:

• Every person with a login to your email or main business systems, including contractors and ex-staff who might still have one.
• Every computer, laptop and phone used for work, and who uses it.
• Every business app or service that holds customer or financial data.
• Every way someone can get into your systems from outside: remote desktop, remote support tools, a VPN, an installer's login on a device.

2. Check each control against the list, not your memory

Go through each item and check, don't recall. Open the admin settings for your email platform and look at MFA status person by person. Look at each computer and confirm the security software is actually running. Find the last date updates were installed.

3. Fix what's quick, disclose what isn't

You'll find gaps. Some take minutes: turning MFA on for the last two accounts, removing a former employee's login, deleting a shared admin password. Do those before you submit.

Some take longer, like replacing an old server or setting up a proper backup. Don't tick "Yes" and plan to fix it later. Answer honestly, and tell your broker what you're doing and by when. Insurers deal with partial answers all the time. A known gap with a plan is a pricing question. A hidden gap discovered after a claim is a coverage question.

4. Read the definitions

"Remote access," "privileged account" and "backup" mean specific things in a policy. If the form defines a term, use that definition, not your own. If it doesn't and you're unsure, ask your broker in writing and keep their reply.

5. Keep evidence, with dates

Take screenshots of MFA status, backup reports, and device lists on the day you submit. Save them somewhere you can find them in a year. If you ever need to claim, being able to show that your answers were true at the time is worth far more than the hour it takes.

6. Treat it as a yearly check, not a one-off

Your setup changes. People join and leave. Laptops get replaced. A new tool gets added. A policy renewal is a natural point to re-check the list and update your answers.

What cyber insurance won't do

It's worth being clear about the limits.

Cyber insurance is a financial backstop. It can cover things like incident response costs, getting systems back up, legal and notification costs, and some business interruption. Depending on the policy, it may or may not cover funds lost to a fake invoice. Read that section carefully, because social engineering fraud is often covered separately, with its own limit, or not at all.

It won't stop an attack. It won't restore a backup you never tested. And as Triple-I CEO Sean Kevelighan put it in the brief, insurance works best alongside prevention and preparedness, not instead of them.

For most small businesses, the better order of operations looks like this:

1. Know what you have (people, devices, apps, access).
2. Put the basic controls in place and check they're actually working.
3. Buy cover that matches the business you actually run, with answers you can stand behind.

Small business cyber insurance in Australia: a few local notes

If you're shopping for small business cyber insurance in Australia, a few things are worth knowing:

• Bundled versus standalone. Some business insurance packs include a small cyber extension. Check the limit and what's excluded before assuming you're covered. A standalone policy is usually broader.
• Ask about the form up front. Some insurers now offer shorter applications for very small businesses. Ask your broker which insurers have a short-form option for your size.
• Use the free government guidance. The Australian Cyber Security Centre's small business guides and the Essential Eight give you a plain-language starting point for the controls most insurers ask about. Working through them also makes the application easier.
• Ask about incident response. Many policies include access to a response team or hotline. Find out the number before you need it and write it down somewhere that isn't on the computer that might get locked.

Where Vera fits

The hardest part of a cyber insurance application isn't any single question. It's that every answer depends on knowing exactly who and what you have, and most small businesses keep that in a spreadsheet that's out of date, or in someone's head.

That's the gap Vera was built for. It keeps your hardware, software licences and team directory in one place, so the list in step one already exists. Breach monitoring shows you if a team member's work email has turned up in a known data breach, which is useful context when you're answering questions about credential risk. And the task board gives you somewhere to track the gaps you found, like "turn on MFA for the shared accounts mailbox" or "test a backup restore," with a due date, instead of a mental note that gets lost.

None of that replaces a broker or a policy. It just means that when the form asks "Do all users have MFA?" you can check, rather than guess.

The takeaway

Cyber insurance for small business is getting more affordable, and the case for having some is stronger than it was a few years ago. But the price isn't the risk. The risk is buying a policy based on answers you didn't check, then finding out at the worst possible moment that the insurer reads "all" more literally than you did.

Before your next renewal, spend an afternoon writing the list and checking it against reality. Fix the quick gaps, disclose the rest, and keep the evidence. If you'd like a simpler way to keep that list current all year, Vera is built for exactly that.