Cyber Insurance for Small Business in 2026: Ransomware and the Security Questions Insurers Ask

Ransomware is malicious software that blocks access to your systems until a payment is made. The FBI's Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025, with reported losses of over $32 million (IC3 2025 Internet Crime Report).

That loss figure understates the cost. IC3 says it "does not normally include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services," and that some victims report no loss at all.

The same IC3 report shows who outside critical infrastructure reports ransomware. Of more than 1,400 such complaints, the most reported industries were:

The FTC lists the first-party costs a cyber policy typically includes. Several apply directly to a ransomware attack:

• Forensic services to investigate the breach.
• Recovery and replacement of lost or stolen data.
• Lost income due to business interruption.
• Cyber extortion and fraud.
• Legal counsel to determine your notification and regulatory obligations.

Extortion coverage can carry its own lower limit, called a sublimit. The Hartford, for example, lists an "Extortion Sub-Limit" among its own core cyber coverages (The Hartford, cyber insurance cost). That is one insurer's product; ask every insurer for the extortion limit in writing.

Paying a ransom has legal risks

In a September 21, 2021 advisory from the US Treasury's Office of Foreign Assets Control (OFAC), the US government states that it "strongly discourages all private companies and citizens from paying ransom or extortion demands." The advisory warns that companies facilitating payments for victims, "including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response," may risk violating sanctions rules (OFAC advisory).

OFAC treats a prompt, complete report to law enforcement or CISA as "a significant mitigating factor." It asks victims to report to CISA, their local FBI field office, IC3 or the Secret Service as soon as possible. New York's Department of Financial Services also advises against ransom payments (NYDFS Circular Letter No. 2 (2021)).

Ransomware questions for every proposal

Insurers use what you tell them about your security to set terms. New York's insurance regulator describes insurers gathering information "through surveys and interviews on topics including corporate governance and controls, vulnerability management, access controls, encryption, endpoint monitoring, boundary defenses, incident response planning and third-party security policies." It tells insurers to price policies "based on the effectiveness of each insured's cybersecurity program" (NYDFS Circular Letter No. 2). That letter is addressed to New York insurers, but it shows the kind of questions to expect.

One insurer's description is more specific. The Hartford says insurers "often look for" multifactor authentication, regular backups, endpoint detection and response (EDR), consistent patching and employee training. It adds that insurers "often require" MFA, backups and regular system updates "before approving coverage or offering better terms" (The Hartford).

The table pairs each control with what CISA, the federal cybersecurity agency, tells small businesses to do, and the record to keep for your application.

Source for the CISA column: CISA cyber guidance for small businesses. For ransomware specifically, the FBI's 2025 report also advises offline or off-site backups that are encrypted and immutable (cannot be altered or deleted), and EDR tools to detect attackers moving across a network.

Answer the questionnaire with what is true today. If a control is planned, say so and give the date. The cyber renewal checklist helps you track changes from one year's application to the next.

The Hartford publishes figures for its own customers: on average, its small business customers pay "about $320 per year, or about $27 per month, for data breach coverage" (The Hartford). The page was updated February 25, 2026 and does not state the period the average covers. Those are one insurer's figures, not a market rate.

The same page lists industry, company size, limits, coverage selections, the type and amount of data, security controls and past incidents as factors, and says past incidents can lead to "higher pricing and stricter exclusions or may require higher retentions."

To compare actual offers on the same basis, use the quote comparison worksheet.

If you provide professional services, ask how a cyber policy and your professional liability coverage divide claims involving data or technology. Ask each insurer to show the wording rather than assume one policy covers what another excludes.

If you want PolicyBenchmark to follow up about cyber coverage, request coverage help. Keep passwords, client records and details of an active incident out of any request form.

Sources checked October 3, 2026. The New York circular letter is guidance to New York insurers; elsewhere, ask your state insurance department.