The Myth
"We're too small for hackers to target."
The Reality
Small businesses are targeted because they're easier. Most ransomware attacks are not targeted - they're opportunistic.
What a Real Cyber Policy Includes
- Ransomware payments (some policies pay; others don't - read closely)
- Business interruption while systems are down
- Incident-response retainer (forensics, legal, PR)
- Data breach notification costs
- Regulatory fines (CCPA, HIPAA where applicable)
- Cyber-extortion expenses
Common Gaps
- Social engineering (someone tricks an employee into wiring money) is often excluded by default. Buy the endorsement.
- Crypto-jacking is often excluded.
- Pre-existing vulnerabilities can void coverage. Maintain a documented patch policy.
What's Reasonable
For a 12-person business: $1M/$1M cyber, $500K social-engineering endorsement, ~$2,500-$4,000/yr.