Skip to content
VITI Security
Contact

Cyber insurance

Cyber Insurance Premium Estimator

Rough annual premium band by revenue, industry, records - and the control gaps that can get you declined.

What drives the cost of cyber insurance

Underwriters price each policy from your application, so two companies of the same size can get very different quotes. The main factors:

  • Revenue and size: a proxy for how much a breach or outage would cost.
  • Industry: healthcare and finance hold the most sensitive data and usually pay more.
  • Records held: more personal or payment records mean larger potential notification and liability costs.
  • Security controls: the answers on the application, and increasingly the evidence behind them.
  • Limit and retention: a higher limit or a lower retention (deductible) raises the premium.
  • Claims history and the state of the insurance market at renewal.

The estimator above turns the first four into a rough annual premium band. No regulator publishes small-business premium ranges, so the bands are our estimates, not quotes. For scale, US insurers wrote about $9.14 billion of cyber premium in 2024, according to the NAIC.

Controls insurers ask about

Applications differ by carrier, but these come up again and again, and missing the first three can stop a quote altogether:

  1. Multi-factor authentication on email, remote access and privileged accounts
  2. Endpoint detection and response (EDR) on servers and laptops
  3. Backups kept offline or immutable, and restore-tested
  4. Timely patching, especially of internet-facing systems
  5. Email security and phishing training for staff
  6. An incident response plan, and someone to call when it is needed

Answer the application accurately

Overstating your controls is risky. If the application says MFA or tested backups are in place and they are not, a carrier may have grounds to deny a claim or rescind the policy. It is cheaper to close the gap before renewal than to discover it during a claim.

FAQ

Is cyber insurance worth it for a small business?

That depends on what a ransomware attack, a breach notification or a week of downtime would cost you, and whether you could absorb it. Insurance transfers part of that risk; it does not replace the controls insurers expect you to have.

Will better security lower my premium?

Often it affects whether you can get cover at all, and on what terms. The estimator applies a small discount for each control you have; real pricing depends on the carrier.

We close the control gaps insurers flag (MFA, EDR, backups, patching) and test them. See cybersecurity services and the ransomware cost calculator.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Base annual premium band by revenue: under US$10 million, US$1,000-7,500; US$10-100 million, US$7,500-50,000; above that, US$50,000-250,000.
  2. Industry multiplier: healthcare and finance 1.5, retail 1.25, SaaS 1.1, manufacturing and other 1.0.
  3. Records multiplier: 1.25 from 1 million records, 1.1 from 100,000, otherwise 1.0.
  4. Controls discount: 3% for each control ticked, up to 18% for all six.
  5. Missing MFA, tested backups or EDR are flagged as insurability blockers; they do not change the band.
  6. Colour: red if any blocker is flagged, green with four or more controls and no blockers, amber otherwise.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Base bands by revenue
US$1k-7.5k / 7.5k-50k / 50k-250k
Industry multipliers
1.5 / 1.25 / 1.1 / 1.0
Records multipliers
1.0 / 1.1 / 1.25
Discount per control
3%, capped at 18%
Assumed policy limit
US$1-5 million

Worked example

The calculator run on its default inputs:

Annual revenue
$5 million
Personal / sensitive records stored
50,000 records
Industry
SaaS / technology
Controls in place
MFA (email, remote access, admin); EDR / endpoint monitoring

Estimated annual premium band

$1K-$7.8K/yr

Premium band (illustrative)
$1,034-$7,755 per year
Adjustments applied
industry ×1.1 · records ×1 · controls −6%
Insurability blockers
1 gap found (see notes)

US$5 million revenue starts at US$1,000-7,500. SaaS (x1.1), 50,000 records (x1.0) and two controls, MFA and EDR (-6%), give US$1,034-7,755 a year. Tested backups are not ticked, so that is flagged as a blocker.

Sources

Sources last checked September 2026.

Limitations

This is not a quote. Underwriters price on your application, limits, retention, claims history and market conditions, and carriers differ on which controls they require. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.