Cyber Insurance, matched properly
Cyber insurance for small business: what it covers, published costs by industry, the Notifiable Data Breaches scheme, real claims, and one licensed or authorised broker to arrange it.
- No obligation
- Licensed or authorised brokers
Get a quote from a licensed or authorised broker in a few simple steps
Tell us about your business and the cover you’re after.
Step 1 of 3What is Cyber Insurance?
Cyber insurance, also called cyber liability or cyber security insurance, generally covers the costs of a cyber incident, such as a data breach or cyber attack like ransomware: responding to the incident, restoring systems and data, lost income while you’re down, and claims from people whose data was exposed. What’s covered, and how much, depends on the policy wording.
Who commonly considers it.
- E-commerce & Retail Online shops handling sensitive customer payment data
- Professional Services Firms holding confidential client intellectual property
- Healthcare & Medical Practices managing private electronic health records
- Tech & SaaS Companies Digital platforms where uptime is critical to revenue
What cyber insurance covers.
Policies vary. Based on two insurers’ wordings, they generally cover these.
- Incident response and crisis management Experts to investigate and contain an incident, legal advice, public relations and, on some policies, credit monitoring for the people affected1.
- Data recovery The cost of restoring data and programs. Upgrades are usually only covered under an extension1, 2.
- Lost income Lost revenue while your systems are down, after a waiting period set in the schedule. Some policies include outages at your IT provider1.
- Ransomware and cyber extortion Some policies pay an extortion demand, but only with the insurer’s agreement and where it’s lawful, often with its own lower limit1–3.
- Notifying people The cost of notifying affected people and the privacy regulator1.
- Claims against you Claims from people whose data was exposed, and the cost of defending them. Fines and penalties only where they’re insurable by law1, 2.
Payment scams.
Fake invoices and changed bank details are among the most common cybercrimes businesses report, but many cyber insurance policies only cover them under an extension.
- Often an optional extra One insurer excludes social engineering and funds transfer fraud unless you buy its optional criminal financial loss cover1.
- Lower limits Marsh’s small business cover has a $50,000 cybercrime limit on a $100,000 policy, and $250,000 on policies of $500,000 to $3 million3.
- Time limits to report One policy requires the loss to be reported to the ACSC or your bank within 24 hours1.
- How the fraud happened Another insurer’s cover needs a computer system to have been used maliciously, and excludes acts by employees2.
In 2024–25, the most common cybercrimes businesses reported to the Australian Signals Directorate were email compromise (19% of reports) and business email compromise fraud with a financial loss (15%)19.
How much does cyber insurance cost?
No regulator publishes an average premium. These are brokers’ published figures, which use different methods: a guide, not a quote.
A year, and most between $900 and $2,100. upcover, August 2026.4
Plus a $50 fee, for a $100,000 limit. Marsh.3
Plus a $150 fee, for limits of $500,000 to $3 million. Marsh.3
Average, 2023–24. BizCover.5
Premium a year by industry: the median, with the middle half of policies as the bar. From upcover’s 700+ policies, including stamp duty, August 20264.
How insurers assess your cyber risk.
Insurers ask about your security before they offer cover. One insurer’s proposal form asks about these.
Multi-factor authentication
On remote access, email, admin accounts and cloud backups6.
Backups
Offline backups, and whether restores are tested6.
Protection and patching
Endpoint detection, how quickly you patch, and old technology still in use6.
Payment checks
Verifying new payees, and a second sign-off for larger transfers6.
The data you hold
How many personal records you hold, and what kind6.
Common cyber policy exclusions.
Every cyber insurance policy lists its exclusions in its wording. These are from one insurer’s policy, as an example.
- Known incidentsIncidents you knew about before the policy started1.
- Damage and injuryPhysical property damage and bodily injury1.
- Infrastructure outagesOutages at utility, internet or DNS providers1.
- WarWar, and cyber operations by states1.
- Contract liabilityLiability you take on in a contract, and punitive damages1.
- Your own servicesFailures of IT services you provide for a fee, and recalls of technology you sell1.
- Deliberate actsYour own intentional acts1.
Some policies also make you share the loss if an attacker used a security flaw you hadn’t fixed. In one wording, your share rises to 50% once a fix had been available for more than a year2.
The law.
Cyber insurance isn’t compulsory, but these rules shape what happens after a cyber attack or data breach.
- Notifiable data breaches Organisations covered by the Privacy Act must tell affected people and the OAIC about a breach of personal information, such as customer data, that’s likely to cause serious harm. They have 30 days to assess a suspected breach, then must notify as soon as practicable8, 9. See notifiable data breaches and small business.
- Who the Privacy Act covers Most businesses with annual turnover of $3 million or less aren’t covered. Some are regardless of size, such as health service providers and businesses that trade in personal information7.
- 2024 privacy reforms Penalties for serious breaches by a company of up to $50 million, three times the benefit gained or 30% of adjusted turnover, whichever is greater, plus infringement notices and, from 10 June 2025, a right to sue for serious invasions of privacy10, 11, 13. The first penalty under the Act, $5.8 million, was ordered in October 202512.
- Reporting ransomware payments Since 30 May 2025, businesses with annual turnover of more than $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours. Not reporting can mean a penalty of 60 penalty units, which is $21,840 at the rate from 1 July 202614–16.
- Paying a ransom Paying isn’t generally illegal, although the government discourages it. Paying a sanctioned person or group can be an offence15.
- Insuring fines Whether penalties can be insured is unsettled in Australia, and courts have ordered that some penalties not be paid by insurance17, 18.
What cyber incidents cost.
Average cost per cybercrime report, as reported by businesses to the Australian Signals Directorate.
$56,600
Up from $49,600 the year before.
$97,200
Up from $62,900 the year before.
$202,700
Up from $63,200 the year before.
From the Annual Cyber Threat Report 2024–25, which covered more than 84,700 cybercrime reports. Ransomware was involved in 11% of the incidents ASD responded to, and phishing in 60%19.
Real claims.
Published examples from insurers and brokers. Every claim depends on the policy wording.
- Engineering firmBackups failed after an attack, and re-creating the lost data cost over $270,00021.
- ManufacturerA ransomware attack cost $202,00020.
- Accounting firmA caller impersonating a contact led to a fraudulent transfer of over $75,000, with total costs of over $100,00020.
- Construction firmInvoice fraud after a missed call-back check cost $93,42521.
- Electrical contractorA ransomware attack cost $81,38721.
- HairdresserA hacked phone system ran up $30,000 in calls, paid under optional social engineering cover5.
- Law firmBusiness email compromise cost $26,50020.
Common questions.
Is cyber insurance compulsory in Australia?
No law requires it, but some contracts and clients ask for it.
Does my general business insurance cover cyber incidents?
Often not. Many general liability policies exclude cyber events, so cyber cover is usually a separate policy.
How much does cyber insurance cost for a small business?
upcover puts the typical premium at about $1,200 a year, with most between $900 and $2,100. Marsh’s starting price is $400 plus a fee, for businesses with revenue up to $2 million and a $100,000 limit.
Is cyber insurance worth it for a small business?
It depends on the business and the risks it faces, and a broker can talk it through. For scale, small businesses reported an average cost of $56,600 per cybercrime report in 2024–25, up from $49,600 the year before, according to the Australian Signals Directorate.
Will a cyber policy pay a ransom?
Some policies can, but only with the insurer’s consent and where it’s lawful. It depends on the wording.
Is it legal to pay a ransom in Australia?
Generally yes, although the government discourages it. Paying a sanctioned person or group can be an offence.
Do I have to report a ransomware payment?
Businesses with annual turnover of more than $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Are fake invoice and payment scams covered?
Often only under an optional extension with its own, lower limit. Some policies require the loss to be reported within a set time.
Does the Privacy Act apply to small businesses?
Most businesses with annual turnover of $3 million or less aren’t covered, but some are regardless of size, such as health service providers and businesses that trade in personal information.
What makes a data breach notifiable?
When personal information is accessed, disclosed or lost without authorisation, serious harm to someone is likely, and action taken hasn’t removed that risk.
Can a cyber policy pay privacy fines?
Only where the fine is insurable by law, which is unsettled in Australia, and courts can order that a penalty isn’t paid by insurance.
What do insurers ask about before offering cover?
Commonly multi-factor authentication, backups, endpoint protection, patching, and how you check payment details before paying.
What does a cyber incident cost a small business?
Small businesses reported an average cost of $56,600 per cybercrime report in 2024–25, according to the Australian Signals Directorate.
Still have a question? A broker can talk it through with you.
Get a quote from a brokerWhy businesses use Covra.
One enquiry, one broker.
Not sure what cover you need
Talk it through with a licensed or authorised insurance broker, who can look at your business and your options.
Don’t want lots of calls
COVRA sends your contact details to one broker, not several.
No obligation
You don’t have to take out a policy.
Need it sorted properly
Cyber Insurance can be complex; discuss your insurance needs with a licensed or authorised broker.
Approved brokers on COVRA.
Licence and covers checked
Before a brokerage can receive enquiries, we check on ASIC’s professional register that it holds, or acts under, an Australian Financial Services Licence that covers general insurance, and check its website for the covers it offers.
One broker only
Your name and contact details go to the one broker who receives your enquiry.
Advice comes from the broker
COVRA doesn’t give advice. The broker can advise you within the scope of their licence or authorisation.
Brokers pay, you don’t
COVRA is free for businesses. Brokers pay COVRA to receive enquiries. There’s no obligation to take out a policy.
COVRA is a referral service only. It doesn’t recommend or compare brokers, and approving a broker isn’t a recommendation.
How it works.
Tell us about your business
Answer a few questions about your business and the cover you’re asking about.
We pass it to one broker
We check your enquiry, then pass it to one approved, licensed or authorised broker who offers a cover you’re asking about.
The broker gets in touch
The broker who receives your enquiry contacts you to talk through your needs and options.
Related cover.
Other cover often considered alongside Cyber Insurance.
Sources.
- Cyber Event Protection policy wording (CEP-005.1), Emergence, February 2026
- Cyber ERM version 2.2 policy, Chubb, July 2022
- Cyber security insurance for SMEs, Marsh
- How much does cyber insurance cost?, upcover, 26 August 2026
- Cyber Liability Insurance, BizCover
- Cyber Event Protection long proposal form, Emergence, February 2024
- Small business, OAIC
- When to report a data breach, OAIC
- Part 4: Notifiable Data Breach (NDB) scheme, OAIC, February 2025
- Passing of bill a significant step for Australia’s privacy law, OAIC, 29 November 2024
- Statutory tort for serious invasions of privacy, OAIC, 19 June 2025
- Australian Clinical Labs ordered to pay penalties, OAIC, 9 October 2025
- Bills Digest: Privacy and Other Legislation Amendment Bill 2024, Parliamentary Library, 18 November 2024
- Fines and penalties, ASIC, 2026
- Factsheet: ransomware payment reporting, Department of Home Affairs, 29 September 2025
- Ransomware payment and cyber extortion payment reporting, Australian Signals Directorate
- A ‘sting’ in the tail: courts close in on insurance cover for civil penalties, Mondaq, 2026
- Indemnity for civil penalties, MinterEllison, 25 July 2025
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- Cyber insurance in action: claims examples, DUAL, 11 May 2026
- Cyber claims examples for small businesses, Marsh, 17 August 2026
- Cyber insurance requirements in Australia, upcover, 28 June 2026
- Cyber Insurance Australia, Finder, 22 September 2026
