Cyber risk insurance is getting fresh attention after data from the Identity Theft Resource Center’s 2025 Business Impact Report found that 81% of small businesses surveyed reported a security breach, a data breach or both in the last year. The number is a blunt reminder that the threat is not theoretical for smaller firms; it is already showing up in their inboxes, payment systems and customer records.
That matters now because a 2026 ERGO NEXT survey of 501 small business owners found that 27% ranked a cyberattack or data breach among their top concerns, while 31% said it was the risk they felt least prepared to handle. Those worries track with a broader reality: when breaches hit, they can be expensive. The Identity Theft Resource Center said 63% of breached small businesses suffered losses of $250,000 or more.
Shawn Silver said cybercriminals are not chasing the biggest company in the room. They are looking for a way in, and a small business can be perfect. He said the most exposed firms tend to be in high-risk industries such as financial services, but the danger reaches much further than that. E-commerce retailers, digital service providers, consultants, accountants, creatives, real estate agents and brokers, and healthcare and telemedicine businesses all face exposure if they process digital payments or handle customer data.
That is where cyber liability insurance can come in. It is meant to help with some of the costs tied to data breaches, ransomware and hacking, which is different from professional liability insurance, also called errors and omissions coverage, that consultants may already carry for mistakes in their work. The cyber policy is aimed at the incident itself — the stolen credentials, the account takeover, the payment fraud, the compromised customer data — while professional liability is aimed at claims over advice or service errors.
Silver said small businesses are already dealing with phishing, stolen credentials, account takeover, ransomware, payment fraud and compromised customer data. The FBI’s Internet Crime Report put business email compromise losses at about $3 billion in 2025, another sign that a single compromised login can turn into a much larger bill. For owners who still think they are too small to matter, the market is sending the opposite message: size can make them easier to hit, not harder.
The immediate question is not whether cyber risk insurance belongs in the conversation, but whether small firms will treat it as a basic operating cost before a breach forces the issue. The damage is already showing up in survey data, and the next bill may arrive long before any owner expects it.
