Cyber insurance
Cyber Insurance Premium Estimator
Rough annual premium band by revenue, industry, records - and the control gaps that can get you declined.
How this is calculated
- Base annual premium band by revenue: under US$10 million, US$1,000-7,500; US$10-100 million, US$7,500-50,000; above that, US$50,000-250,000.
- Industry multiplier: healthcare and finance 1.5, retail 1.25, SaaS 1.1, manufacturing and other 1.0.
- Records multiplier: 1.25 from 1 million records, 1.1 from 100,000, otherwise 1.0.
- Controls discount: 3% for each control ticked, up to 18% for all six.
- Missing MFA, tested backups or EDR are flagged as insurability blockers; they do not change the band.
- Colour: red if any blocker is flagged, green with four or more controls and no blockers, amber otherwise.
Constants the tool uses
Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.
- Base bands by revenue
- US$1k-7.5k / 7.5k-50k / 50k-250k
- Industry multipliers
- 1.5 / 1.25 / 1.1 / 1.0
- Records multipliers
- 1.0 / 1.1 / 1.25
- Discount per control
- 3%, capped at 18%
- Assumed policy limit
- US$1-5 million
Worked example
The calculator run on its default inputs:
- Annual revenue
- $5 million
- Personal / sensitive records stored
- 50,000 records
- Industry
- SaaS / technology
- Controls in place
- MFA (email, remote access, admin); EDR / endpoint monitoring
Estimated annual premium band
$1K-$7.8K/yr
- Premium band (illustrative)
- $1,034-$7,755 per year
- Adjustments applied
- industry ×1.1 · records ×1 · controls −6%
- Insurability blockers
- 1 gap found (see notes)
US$5 million revenue starts at US$1,000-7,500. SaaS (x1.1), 50,000 records (x1.0) and two controls, MFA and EDR (-6%), give US$1,034-7,755 a year. Tested backups are not ticked, so that is flagged as a blocker.
Sources
- NAIC - Report on the Cybersecurity Insurance Market (2025) - US market-wide figures only (about US$9.14 billion of cyber premium written in 2024); regulators do not publish small-business premium ranges, which is why every band here is our estimate
Sources last checked September 2026.
Limitations
This is not a quote. Underwriters price on your application, limits, retention, claims history and market conditions, and carriers differ on which controls they require. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.