How Much Does Cyber Liability Insurance Cost for a Small Business in Australia?

Cyber liability insurance for a small Australian business with strong security controls can start from around $600 a year. Revenue plays a part, but the number that moves your premium the most is how many personal information records you hold, the industry you operate in and how well you’re protected against an attack in the first place. These are general market figures, not a quote. Actual pricing depends on your specific business and circumstances.

What determines the cost of cyber liability insurance?

Insurers price cyber liability cover primarily on the volume and sensitivity of the data you hold and the industry you operate in, alongside your annual revenue and the security controls you have in place. Claims history moves the number further, and the limit of cover you choose sets the ceiling. Revenue is a real factor here. Insurers use it as a genuine signal of scale and exposure. It just isn’t the starting point the way sum insured is for a property policy.

Why does the number of records matter more than revenue?

Because data volume and industry tell an insurer something revenue alone can’t. A high-revenue business that holds almost no personal data carries a smaller cyber exposure than a lower-revenue business sitting on thousands of customer records, so insurers weigh data and industry first. Revenue still matters and is priced in alongside them: a larger business generally has more systems, more staff and more potential entry points, and insurers factor that scale into the premium too. It’s genuinely part of the calculation, just not the starting point the way sum insured or turnover is for a property or liability policy.

This shows up clearest in businesses holding large volumes of client data on someone else’s behalf, such as IT and technology consultants, recruitment and HR firms or financial services businesses. A small team can carry a large data footprint, and the premium reflects that footprint more than the team’s size.

What cyber security controls actually lower your premium?

Multi-factor authentication on email and remote access is close to a baseline requirement with most cyber insurers now. Beyond that, endpoint protection, regular backups stored separately from the main network and documented staff training are the controls insurers most commonly ask about, and the same ones government guidance points small businesses to.¹ A business that can show these controls are actually in place, not just written down, is generally offered better terms than one that can’t.

Is cyber liability insurance required by law in Australia?

Cyber liability insurance is not a general legal requirement for Australian businesses. Separately, if your business is covered by the Privacy Act 1988, you have obligations under the Notifiable Data Breaches scheme regardless of whether you hold insurance, including notifying affected individuals and the Office of the Australian Information Commissioner if a breach is likely to cause serious harm.² This information is general in nature and does not constitute legal advice. If you are unsure about your specific obligations under the Privacy Act, speak with a qualified legal professional.

What does an uninsured cyber incident actually cost?

The average reported cost of a cyber incident for an Australian small business was $56,600 in the 2024 to 2025 year, and that figure has been rising.³ That’s the direct cost of a single incident. It doesn’t count the trading days lost while systems are down or the cost of rebuilding customer trust afterward, both of which can outlast the incident itself by months.

A ransomware event is the clearest example. A business locked out of its own systems can’t invoice, can’t take bookings and can’t access client records until it’s resolved, on top of whatever the ransom negotiation, data restoration and notification costs come to. Without a policy, all of that falls on the business directly. With one, the insurer’s incident response panel is generally the first call, not the business owner working it out alone.

The figures above are general market indicators, not a quote. Cyber liability pricing depends on your specific business, data and circumstances more than most other covers, so the only way to get an accurate number is a proper assessment. Cipher can review your data, industry and existing controls and go to our specialist panel on your behalf. Get in touch.

The information in this article is general in nature and does not constitute legal, financial or insurance advice. Please speak with a qualified adviser about your specific circumstances.

Footnotes

1. Cyber security checklist, business.gov.au ↩

2. Protect your customers’ information, business.gov.au ↩

3. Cyber risk, Insurance Council of Australia ↩