Cyber insurance pays for the costs of a data breach or attack: forensic investigation, breach notification and credit monitoring, data and system restoration, business interruption, ransomware extortion, and liability and regulatory defense when customers or regulators bring claims. Coverage for social engineering and funds transfer fraud varies; the NAIC notes it may be excluded, sublimited or left to a separate crime policy. Cyber can be bought as a stand-alone policy or as an endorsement on a BOP or package policy, and the NAIC says endorsements often carry narrower terms and lower limits. The market is large and still growing. The NAIC's 2026 report puts 2025 US cyber direct written premium at about $9.46 billion, with 5.84 million domestic policies in force, while noting that many small and mid-size businesses still have no coverage. Appetite depends on industry, revenue, the amount and type of sensitive data held (health, payment card, personal information) and, most of all, security controls. Applications commonly ask about multi-factor authentication for email and remote access, offline or segregated backups, endpoint detection, patching and employee phishing training. The NAIC advises buyers to ask which security practices a policy requires. Hard-to-place risks include healthcare, education, municipalities, managed service providers and businesses with prior incidents. Small accounts are quoted on carrier and MGA portals and through small-commercial quoting platforms. Larger accounts need a full application and sometimes a call with the underwriter.
Carriers with published appetite
From each carrier's own public appetite guide or product pages. Appetite changes: confirm with the carrier before you submit.
Offices — Acuity Cyber Suite covers cyber liability defense, data breach response, identity theft, data restoration, business income and PR services; the page names contractors, trucking, offices and restaurants as buyers. No limits or eligibility rules published, and availability varies by state (Acuity cyber suite page, viewed Oct 2026).
Quote it through: Bold Penguin, Semsee, PL Rating, or the carrier portal
Professional services — Cyber is preferred for office and professional service classes. AmTrustCyber is quoted automatically alongside WC and BOP, and agents can bind up to a $1M limit online. Cover includes ransom payments, business interruption, privacy and network liability, regulatory fines and PCI penalties (AmTrust Small Business Appetite Guide, BOP, MKT6424, May 2025).
Quote it through: Tarmika Bridge, or the carrier portal
Offices — First- and third-party cyber is an optional coverage on the BOP for office, mercantile, processing and service risks (Berkley Small Business BOP page, 2026).
Healthcare — Medical and dental offices and life sciences R&D are strong for cyber, BOP and GL, WC, umbrella and auto. Life sciences manufacturing is qualified (each risk on its merits) for BOP but strong for cyber. Cyber and umbrella are one-click cross-sells on Marketplace (2024 Chubb Small Business Appetite Guide).
Quote it through: Bold Penguin, Semsee, Tarmika Bridge, or the carrier portal
Offices — Cyber and Information Protection Plus covers data breach notification and credit monitoring, lost revenue from damaged data, cyber extortion, network security and multimedia liability. It is listed as an add-on for offices, contractors and manufacturers (Frankenmuth cyber and offices pages, Oct 2026).
Real estate — Real estate is a strong-appetite class for Hiscox cyber. Real estate developers and mortgage and loan brokers are out of appetite (Hiscox USA appetite guides, June 2026).
Retail — Retail trade and pharmacies are conservative-appetite classes for cyber. Personal and household goods repair is strong. Wholesale trade and manufacturing are out of appetite (Hiscox USA appetite guides, June 2026).
Hospitality — Hotels, hospitality, restaurants and food services are conservative-appetite classes for cyber. Arts, entertainment and recreation are strong. Gambling is out (Hiscox USA appetite guides, June 2026).
Quote it through: Bold Penguin, or the carrier portal
Manufacturing — Markel Cyber 360's strongest appetite is manufacturing, retail and technology; technology E&O targets software and SaaS, consultants and hardware. Markel uses BlackKite scanning to cut underwriting questions and offers wrongful collection cover. Recent stand-alone cyber limits run $1M to $5M (Markel preferred US and Bermuda retail appetite guide, June 2026).
Retail — Retail is one of three strongest classes for Markel Cyber 360, alongside manufacturing and technology. Policyholders get the Upfort Shield security tool (Markel preferred US and Bermuda retail appetite guide, June 2026).
Quote it through: Tarmika Bridge, or the carrier portal
Healthcare — PHLY Cyber Security Liability is written nationwide on admitted or non-admitted paper, with eight insuring agreements including business interruption, cyber extortion and privacy liability. Published class profiles include health and fitness organizations and veterinarian practices, alongside human services, schools and religious organizations (PHLY Cyber Security Liability product page, Oct 2026).
Professional services — Hanover cyber targets small and mid-sized construction, manufacturing, non-profit, professional services, retail, technology and wholesale businesses. Data breach and cyber liability is an add-on to the BOP or package policy; Cyber Advantage Pro is a standalone policy with a dedicated limit (Hanover cyber product page, viewed Oct 2026).
Quote it through: Semsee, Tarmika Bridge, or the carrier portal
Before you submit
- Annual revenue and number of employees
- Number and type of records held: personal, health and payment card data
- Multi-factor authentication status for email, remote access and admin accounts
- Backup practices: frequency, offline or immutable copies, and last restore test
- Endpoint protection, patching cadence and phishing training details
- Prior cyber incidents or claims, and any current coverage or endorsement limits
Sources
- NAIC: 2026 Report on the Cybersecurity Insurance Market
- NAIC: Ransomware (insurance topic)
- Triple-I: Cyber market growth challenged as cybercrime becomes more frequent, complex
Updated Oct 30, 2026