Short answer
Small firm cyber insurance can still make sense when you are careful, because some losses don’t depend on your own clicking. A fake invoice sent in your name, a breach at a vendor you rely on or a stolen laptop with client data can all reach a two-person firm. Good habits lower your odds. This post also covers when skipping coverage is a reasonable call.
What do small firms say about cyber insurance?
Two objections came up this year from firms that declined our cyber quotes. One said, “It’s just two of us and we’re good at spotting phishing; we call the client on any unknown payment link.” Another said, “My company wouldn’t lose much from an attack.”
Both are fair points. Another firm put it this way: “Not excited, but I’d need it if something happened.” That is a common feeling, and the decision deserves a real look instead of a sales pitch.
Which habits already protect a two-person firm?
Calling a client to confirm a payment change is exactly the right habit. It stops many of the fraud attempts that rely on a spoofed email. A small team also has a small attack surface, with fewer people, fewer accounts and fewer systems to compromise.
These habits lower the chance of a loss. They don’t cover every way a loss can reach you, which is where the next section picks up.
Which losses can small firm cyber insurance address even when you are careful?
Some losses start outside your own inbox:
- Your client gets a fake invoice in your name. A small civil engineering firm told us a spoofed email “from” the firm redirected a client’s ACH payment. The client lost about $7K, and the firm had no say in it.
- A vendor you rely on gets breached. Verizon’s 2026 report points to third parties being involved in a large share of breaches, so your own security is only part of the picture.
- Your email gets used to attack your clients. A compromised account can send convincing messages to people who trust you.
- A laptop with client data is stolen. Notification and response costs can follow even if no one ever misuses the data.
Attackers don’t always pick targets by size either. One October 2026 report described a hacker using AI agents to break into over 100 company websites. Our post on why AI hackers target every firm covers this in more depth.
Whether a policy responds to any of these depends on its terms, conditions and verification requirements. Our post on cyber policy wire fraud explains how limits for social engineering and similar losses often work.
Could a client claim against you after a cyber incident?
A client who loses money or data through your systems may look to your firm for answers. Many owners assume their professional policy handles this, but that depends on the wording. Our post on whether professional liability covers a hack walks through the question.
What does small firm cyber insurance cost?
In quotes we ran in 2026, the cheapest $1M option for firms under $250K in revenue ranged from $522 to $975. These figures describe our quotes and not the whole market. Your price depends on your state, security controls and claims history.
Compare that range with one incident. The $7K example above is a small loss, yet it still came from a single spoofed email. Response and notification costs after a breach vary widely, so we don’t put a number on them here. For a fuller price breakdown, see what small A&E firms pay for cyber insurance.
When might you skip small firm cyber insurance?
Skipping it can be reasonable in some situations:
- You hold very little client data and keep it off laptops and phones.
- You never handle client funds or move large payments.
- No client contract asks you to carry cyber coverage.
- Your firm could absorb a loss at the scale you expect without strain.
If most of these describe you, the case for coverage is weaker. Check your contracts first, because requirements sometimes appear after you have won the work. Our guide to phishing and IT security covers habits that help either way.
Related questions
Does a two-person firm need cyber insurance?
It depends on the data you hold, how you handle payments and what your contracts require. Some losses reach small firms regardless of how careful they are.
Is a small firm really a target for hackers?
Attacks can reach firms of any size, and some are automated. A two-person firm’s odds are generally lower than a large firm’s, though a spoofed email can still reach its clients.
Does calling clients to confirm payments make cyber insurance unnecessary?
Callbacks are a strong habit. They don’t prevent a client from receiving a fake invoice in your name, or a vendor breach from exposing your information.
How much does cyber insurance cost for a small firm?
In quotes we ran in 2026, the cheapest $1M option for firms under $250K in revenue ranged from $522 to $975. Pricing varies by firm.