The $5,000 Question: What Cyber Insurance Actually Costs in 2026

The quotes arrived on the same Tuesday morning. A regional dental-supply distributor in Ohio — $8 million in revenue, 42 employees — got a cyber quote of $1,900 for $1 million in coverage. A food-packaging company across town, nearly identical size, got quoted $6,200 for the same limit from a different carrier. Same zip code, same coverage, a 3.2x spread. The CFO called his broker and asked the obvious question: why?

The answer he got was a shrug wrapped in jargon. That shrug is the state of cyber insurance pricing in 2026 — the fastest-growing commercial P&C line in America, and arguably the least legible one.

Start with the bands that actually exist, because nobody publishes them and carriers prefer it that way. For small businesses under $10 million in revenue, a $1 million cyber policy typically lands between $1,200 and $4,800 a year, according to aggregated broker data from firms including Newfront and Embroker. The median hovers near $2,400. These are the pizza chains, dental practices, and small manufacturers that make up the volume of the market.

Step into the mid-market — $25 million to $250 million in revenue — and the numbers jump an order of magnitude. Premiums for $5 million to $10 million in limits commonly run $18,000 to $75,000 annually. Gallagher's mid-market surveys have consistently placed the median around $32,000 for companies in this band with clean loss histories. Enterprise buyers — Fortune 1000 territory — routinely pay $250,000 to $2 million per year for tower coverage of $50 million to $200 million, with Chubb and AIG anchoring much of that upper market.

Industry is the hidden multiplier

The single biggest driver of where you land inside those bands is industry. Healthcare organizations pay roughly 2.5x the SMB median because protected health information sells for up to $250 per record on dark-web markets, per HHS breach-cost analyses. Financial services firms pay a premium because they are both high-value targets and high-regulatory-cost claims — a breached bank doesn't just notify customers; it answers to regulators in four states. Manufacturing sits in the middle but with a trapdoor: any company with operational technology (OT) on its network — factory-floor systems — gets flagged by underwriters since the 2021 Colonial Pipeline attack rewrote how carriers think about industrial risk.

A 2025 analysis from Coalition — the cyber MGA that now writes coverage for over 90,000 policyholders — found that manufacturing and healthcare companies together accounted for a disproportionate share of the highest-severity claims, which is why underwriters surcharge both even when an individual company's hygiene looks fine. You are not being priced on your company alone. You are being priced on your company's company.

The controls that move the needle

Carriers will not explain this clearly, but the rating factors that matter most are no longer revenue and headcount. They are controls. Multifactor authentication across all remote access is now effectively mandatory — Coalition's 2025 claims data showed that businesses without MFA faced claims roughly 3x more often than those with it deployed. Endpoint detection and response (EDR) on all workstations is close behind. Immutable, tested backups are the factor that separates a $180,000 ransomware negotiation from a $1.4 million one, Coalition's average claim size for mid-market ransomware incidents in its most recent report.

This is why the two Ohio companies got quotes 3.2x apart. The distributor had rolled out MFA and an EDR product the prior year; the food packager was running remote desktop protocol (RDP) open to the internet — the single most exploited attack vector in ransomware claims. The broker never said so in those terms, but the underwriters priced it: one company looked like a managed risk, the other like a claim waiting for a policy period.

What the price doesn't tell you

Here is the nuance nobody volunteers: a cheaper premium can be the more expensive policy. Cyber policies are riddled with sublimits — the ransomware sublimit, the social-engineering sublimit, the business-interruption waiting period. A $1,900 policy with a $250,000 ransomware sublimit and a 12-hour waiting period is a meaningfully worse contract than a $3,400 policy with full-limit ransomware coverage and a 4-hour waiting period. At-Bay's underwriting team has argued publicly that sublimit structure predicts claim outcomes more than headline premium does, and they're right: the claim that breaks a company is almost never the one that fits neatly inside the headline limit.

The counterargument to all this transparency talk is worth taking seriously. Carriers argue that full disclosure of rating factors would let brokers game the inputs — check the MFA box, hide the legacy server in the back office. Opacity, in this view, is a feature: it keeps applicants honest. There's some truth there. But the current equilibrium has tilted too far. When two similar companies get quotes 3x apart and neither the broker nor the buyer can reconstruct why, the market isn't fighting fraud. It's failing at price discovery.

That failure is exactly why the domain sitting behind this article matters. Cyber insurance is a $20-billion-plus global market projected to double by 2030, per Munich Re estimates — and it still has no credible public benchmark for what coverage costs. The first publisher that builds the definitive rate index for cyber will own the data layer every broker, CFO, and carrier currently guesses at. The $5,000 question has an answer. It just doesn't have a home yet.