When ransomware attacks hit government agencies or data breaches cost multinational corporations millions of dollars, people may wrongly conclude only large organizations need Cyber Liability Insurance.

Cyber Insurance for small businesses is critically important, too.

Consider this sampling of statistics from recent years:

• Across four continents, nearly half (46%) of small and medium-sized businesses (SMBs) experienced a cyber attack, according to a Mastercard survey in 2025. Nearly one in five closed or filed for bankruptcy in an attack’s aftermath.
• In the United States, 41% of small businesses suffered a cyber attack in 2023, and SMBs paid more than $16,000 in cyber ransoms, Hiscox research reveals.
• Ransomware disproportionately affects small organizations, Verizon’s 2025 Data Breach Investigations Report finds. Among large organizations, 39% of breaches involve ransomware; however, among SMBs, 88% of breaches do.
• Employees of businesses with fewer than 100 staffers see 350% more social engineering attacks than do employees at larger enterprises, Barracuda reported in 2022.
• On average, small and medium-sized businesses lose $25,000 due to cyber attacks, according to Astra Security.

We at ProWriters understand cyber security isn’t always at the top of SMB owners’ minds. Day-to-day concerns like marketing, fulfillment, and payroll may seem more pressing.

But cyber criminals do target businesses of all sizes—and smaller businesses tend to suffer from the fallout the most.

Why Small Businesses Often Run Big Cyber Risks

A small-business owner might assume their company’s size works to their advantage in avoiding cyber incidents. The truth is, their size makes them all the more tempting to threat actors.

Why?

Small-business cyber security often goes neglected.

As mentioned, the daily grind may lead business owners and employees to pay less attention to cyber security.

In 2022, UpCity found only half of SMBs in the U.S. had a cyber security plan in place. Arguably even more alarming, 20% also said they had no intention of creating one.

Small-business cyber security is generally unsophisticated.

Many readily available cyber security controls go underutilized.

For example, an astonishing 58% of global SMBs don’t know about the security benefits of multifactor authentication (MFA), reports the Cyber Readiness Institute. The “overwhelming majority,” 85%, require neither customers nor suppliers to use it, and 65% don’t plan to implement MFA in the near future.

The Institute says cost is the biggest barrier to MFA adoption among SMBs worldwide. But the costs of a data breach can far outweigh the costs of implementing MFA.

Small-business cyber security can unwittingly help criminals hit bigger targets.

By hacking a small business’s computer system, criminals can gain a foothold into one or more larger businesses. Recall the 2013 Target data breach, in which hackers used credentials stolen from one of Target’s contractors to push malware to point-of-sale devices.

Any small business without adequate cyber security could become the first step in such a supply chain attack.

Potential Costs of Small-Business Cyber Security Incidents

In 2025, small businesses will pay anywhere between $120,000 and $1.24 million to respond to and resolve a cyber incident, according to PurpleSec.

Costs associated with a cyber incident can add up quickly:

• Ransomware payments made to quickly release encrypted data or computer systems

• Financial loss due to social engineering (criminals tricking targets into sharing security credentials or transferring money)

• Forensic IT costs to determine the cause and extent of a data breach

• Lost income due to business interruption

• Cost of notifying third parties and providing credit monitoring or other compensation to affected individuals

• Public relations campaigns and losses due to the business’s damaged reputation

• Legal fees and court judgments

The cost of strong Cyber Insurance for small business pales in comparison to the cost of recovering from a cyber attack, should recovery even prove possible.

What Small Businesses Should Do When Cyber Criminals Strike

If your small-business client already has a cyber incident response plan, they should execute it as soon as they know an attack has occurred.

Here are some actions all businesses should take:

Contain the breach as far as possible.

Small businesses can disconnect from the internet, disable remote settings, change all passwords, and install any pending software patches or updates. Such measures won’t undo the attack but may help mitigate the damage done.

Determine the source and extent of the attack.

Forensic IT specialists can discover how a cyber incident occurred and how much data attackers viewed, accessed, or exfiltrated. This information is necessary for knowing what weaknesses need strengthening, determining the business’s liability, and returning to normal operations rapidly.

Inform staff and clients.

Keeping a data breach secret is unethical and illegal. Anyone with personal or sensitive information in the business’s system—phone numbers and addresses, Social Security numbers, bank account and credit card information, and more—needs to know about the breach so they can take action to protect their identity.

Update existing cyber security defenses and test new ones.

Once updated or new security measures are in place, an IT professional should attempt to replicate the cyber attack’s method to ensure it cannot be used again. Further penetration testing can identify any remaining vulnerabilities needing remediation.

Notify government authorities and consult with legal counsel.

Small businesses should report cyber crimes to local and state law enforcement agencies and to the Internet Crime Complaint Center. Report fraud to the Federal Trade Commission, and computer or network vulnerabilities to the Cybersecurity & Infrastructure Security Agency. In addition, businesses must talk with their own lawyers about the legal response to the incident.

Easily Find the Cyber Liability Insurance Small Businesses Need

Obtaining Cyber Insurance for small business is one of the most powerful, proactive things your clients can do to protect themselves from cyber attacks’ consequences.

ProWriters makes researching and preparing Cyber Insurance quotes for your small-business clients easier than ever.

Registered ProWriters brokers use our proprietary Digital IQ Comparative Rate platform.

It generates multiple quotes from leading insurance companies for side-by-side comparison in a matter of minutes. You’re sure to find the policy your client needs, and at a competitive rate.

Start taking advantage of the way we’ve streamlined finding and selling Cyber Liability Insurance for small businesses. Register as a ProWriters broker today.