Mid-Sized Business Cyber Insurance

ByGordon Coyle Reading Time: 17 minutes

Quick Answer

Mid-sized business cyber insurance is a standalone policy that protects companies with roughly 50 to 1,000 employees, or $10 million to $1 billion in revenue, against data breaches, ransomware, wire transfer fraud, and the legal and recovery costs that follow. It covers first-party losses and third-party liability at limits a small BOP cyber endorsement cannot reach, which matters because mid-market firms now absorb the majority of ransomware attacks.

If you have been through a renewal lately, you already know the feeling. As one business owner put it plainly, “cyber insurance renewal demands are getting absurd.” Another asked where to find a “5 million dollar cyber policy without getting bent over a barrel.” A third summed up a denied claim in four words: “cyber insurance is a mess.” These are not small operators complaining about a $40 monthly premium. They are growing companies that bought coverage, thought they were protected, and then hit a wall, either at renewal or at the worst possible moment, when a claim got denied.

That gap between “I have cyber insurance” and “my cyber insurance actually paid” is exactly what mid-sized companies keep falling into. The Coyle Group is a commercial insurance agency for business owners who have outgrown one-size-fits-all coverage and need a specialist who understands the nuances. When your business crosses out of the small-business bracket, the cyber endorsement you bolted onto a Business Owners Policy years ago stops keeping up, and most owners have no idea until the policy fails to respond.

You bought cyber coverage, but you are not sure it will actually pay when a breach hits. We structure standalone cyber programs around how your business actually operates, then stress-test the limits and the fine print before you sign, not after a claim. Gordon Coyle has spent 40-plus years auditing business insurance programs, and finds a fatal flaw in roughly 9 out of 10 of them.

Book a no-pressure call, and we will tell you honestly whether your current cyber coverage holds up.

Book a Call
small business cyber insurance

Why Mid-Sized Businesses Are Now the Number One Cyber Target

Mid-sized businesses are the single most attacked segment in cybercrime today, absorbing 73% of all ransomware incidents in North America and Europe, according to Black Kite’s 2026 research covered by Infosecurity Magazine. The surprise is not that attackers moved down-market from the enterprise. It is that they never really left, even as total incident volume climbed 44% between 2023 and 2025.

You might think cybercriminals are only interested in large corporations, but that could not be further from the truth. Mid-market companies, generally those with $10 million to $1 billion in revenue, sit in the worst possible spot. They hold the same valuable data, cash flow, and customer records as a Fortune 500 firm, but rarely have the dedicated security team to defend it. Attackers know this. They have industrialized the math, and the cost of getting caught unprepared is brutal:

Despite the clear risks, many owners do not realize their coverage is thin until after an attack, breach, or fraud has already occurred. By then it is too late, and the financial fallout can be overwhelming. If you want the raw numbers behind the threat, our breakdown of the $11.5 billion problem with ransomware puts the trend in perspective.

small business cyber insurance

What Mid-Sized Business Cyber Insurance Is, in Simple Terms

Mid-sized business cyber insurance is a standalone policy built to absorb the financial hit of a cyber event, from the technical cleanup to the lawsuits, at coverage limits scaled to a larger company. It is the difference between checking a box and actually being protected, which is a distinction most owners never see until a claim tests it.

In plain language, cyber insurance does two jobs. It pays your own recovery costs, and it pays what you owe other people when their data or money is caught in the incident. As I often remind clients, there is a real difference between being covered and being adequately covered. One checks a box. The other protects your business. A mid-sized firm needs the second kind, because the exposures scale with headcount, revenue, and the number of people who can be tricked into a wire transfer.

For a foundational overview, our guide on what cyber insurance actually covers walks through the core components without the jargon.

Understanding Cyber Risks for Growing Companies

Cyber risk for a mid-sized company is far broader than viruses and malware. The core threats are data breaches, ransomware attacks, phishing scams, and, most financially damaging, wire transfer fraud, and each one scales in cost as your business grows. What most owners underestimate is how often the entry point is a single employee, not a firewall failure.

These threats can compromise sensitive customer information, disrupt your operations, fraudulently transfer hundreds of thousands of dollars out of your bank accounts, and even trigger legal liability.

Here is how the primary risks break down:

  • Data breaches. Unauthorized access to customer, employee, or partner records, followed by notification costs, credit monitoring, and regulatory exposure. Our data breach insurance guide covers what every company should know.
  • Ransomware. Attackers encrypt your systems and demand payment to release them, often stealing data first as extra leverage. See how cyber insurance responds to ransomware.
  • Phishing. Deceptive emails that harvest credentials or plant malware, and the most common first step in a larger attack. Our phishing attacks security guide breaks down the tactics.
  • Wire transfer fraud. An employee is duped into wiring funds to a fraudulent account, and the money is often unrecoverable. This overlaps with crime coverage, which is why our explainer on cyber insurance versus crime insurance matters for larger firms.

There is a reason human error sits at the center of so many claims. Roughly 95% of data breaches are caused by human error, which is why employee training belongs in every mid-market risk plan alongside the policy itself.

See how cyber insurance responds when ransomware hits a growing company.

Not sure where your exposure is worst? Contact us and we will map your real risk before talking about coverage.

Book a Call

Why Your Current Insurance May Not Be Enough

If your current broker has never walked you through standalone cyber coverage, that is a red flag worth acting on. A cyber endorsement bolted onto a Business Owners Policy rarely stacks up to real protection for a mid-sized company, and the reason is buried in the limits and the exclusions most owners never read.

Traditional policies like a BOP were never designed for digital risk, which leaves your business badly exposed. Cyber insurance is specialized coverage built for the unique threats of the digital age, and it can pay for data breaches, cyber extortion, business interruption, and even regulatory fines. The trouble is that many endorsements cap out at $50,000 or $100,000 in coverage, carry crippling sublimits on the exact things that hurt most, like social engineering and ransomware, and respond narrowly when they respond at all.

Picture a ransomware attack with no real cyber policy behind you. How do you cover the ransom? Restore your data? Manage the fallout and the notifications? Now picture an employee wiring hundreds of thousands of dollars to a fraudulent account, money that is now gone. With the right coverage, you would have the financial resources and the expert response team to navigate both. Without it, you are writing checks personally.

This is the pattern Gordon describes as outgrowing your coverage. You outgrew your first accountant. You outgrew your first attorney. Your cyber policy follows the same pattern, and staying with an endorsement that fit you at 15 employees is a quiet liability at 150. If you are weighing whether to upgrade, our take on why you should not skip cyber insurance makes the case directly.

Book a Call

When a Cyber Endorsement Is Enough, and When You Have Outgrown It

A small cyber endorsement can be perfectly reasonable for a very small, low-data business, but most companies outgrow it the moment they start moving money by wire, holding regulated data, or signing contracts that demand cyber coverage. Knowing which side of that line you sit on is the difference between a sensible spend and a dangerous gap.

An endorsement on your Business Owners Policy may still be adequate if all of the following are true:

  • You hold minimal customer data and no regulated records.
  • You do not move money by wire or ACH in any real volume.
  • Your revenue sits well below the mid-market range, and no client, lender, or vendor requires proof of cyber coverage.

You have outgrown the endorsement and need a standalone policy once any of these apply:

  • You process wire or ACH transfers, which is exactly what invites business email compromise.
  • You hold personal, health, or payment-card data that triggers breach-notification laws.
  • A customer, lender, or vendor contract requires a stated cyber limit.
  • You have crossed roughly 50 employees or $10 million in revenue.

If you recognize your business in that second list, you are squarely in standalone territory, and the next question is how the policy is actually built.

What a Real Standalone Cyber Policy Covers: Key Aspects

A standalone mid-sized business cyber insurance policy splits into two halves: first-party coverage that pays your own losses, and third-party coverage that pays what you owe others. The half most owners forget is third-party liability, and it is often the one that turns a bad week into a lawsuit.

Here is how the core components compare:

Coverage type

What it pays for

Why mid-market needs it

First-party: Incident response

Forensics, legal counsel, breach coaches

Speed limits the damage and the cost.

First-party: Business interruption

Lost income during downtime

Larger revenue means larger daily losses.

First-party: Cyber extortion

Ransom negotiation and payment

Mid-market absorbs most ransomware attacks.

First-party: Data restoration

Rebuilding systems and data

Recovery, not ransom, drives most of the bill.

Third-party: Privacy liability

Claims from customers and partners

More records means more people to notify and defend.

Third-party: Regulatory defense

Fines and investigation costs

Larger firms draw more regulatory attention.

Notably, IBM found that roughly 63% of the average breach cost comes from detection, escalation, and lost business, not the ransom itself. That is why a policy built only around extortion payments leaves the biggest expenses uncovered. For help sizing the pieces, our guide on how much cyber insurance you should buy is a useful next read, and the 9 tips for buying cyber insurance covers the buying process end to end.

First-party vs third-party cyber coverage, explained for business owners.

Which Mid-Sized Businesses Need It Most

Every mid-sized business that stores data, moves money electronically, or relies on connected systems needs cyber insurance, but a handful of industries face outsized risk. Manufacturing tops the list, and the reason has less to do with technology than with how much a day of downtime actually costs.

Attackers follow data, cash flow, and pressure to pay. That points squarely at these sectors:

  • Manufacturing and distribution. The most-hit mid-market segment, where production downtime and supply-chain leverage make ransom demands effective.
  • Professional and technical services. Law, accounting, engineering, and consulting firms holding sensitive client data. See our insurance for technology companies overview for tech-adjacent firms.
  • Construction and real estate. High-value wire transfers make these firms prime targets for business email compromise.
  • Healthcare and financial services. Regulated data and strict notification rules raise both breach frequency and cost. Financial firms can start with our cyber insurance for hedge funds resource.

If your business sits in any of these, or simply runs on email and bank transfers, the question is not whether you are a target but whether your limits match your exposure. Book a call, and we will benchmark your industry against real claims data.

Contact Us

Key Benefits of Mid-Sized Business Cyber Insurance

The core benefit of mid-sized business cyber insurance is financial survival: it turns a potentially company-ending event into a covered, managed recovery. The benefit owners overlook, though, is the expert response team that comes attached to a good policy, often worth more than the payout itself.

What a properly structured policy delivers:

  • Breach response on day one. Access to forensics, legal, and PR specialists the moment an incident hits, not weeks later.
  • Balance-sheet protection. Coverage for recovery costs that would otherwise come straight out of profit or personal funds.
  • Ransom and extortion support. Professional negotiators and the financial backing to resolve an attack without improvising.
  • Regulatory and legal defense. Help meeting notification laws and defending the claims that follow a breach.
  • Business continuity. Lost-income coverage that keeps payroll and operations funded through downtime.
  • Peace of mind. Confidence that a single incident will not undo years of work.

How Much Does Mid-Sized Business Cyber Insurance Cost?

Mid-sized business cyber insurance typically runs from a few thousand dollars to tens of thousands per year, driven mostly by your revenue, industry, coverage limits, and the security controls you have in place. The figure owners fixate on, the premium, is rarely the number that should worry them. The limit is.

Premiums scale with exposure, and the biggest cost levers are within your control:

  • Revenue and records. More revenue and more sensitive data mean higher premiums and higher recommended limits.
  • Industry. Manufacturing, healthcare, and financial services price higher than lower-risk sectors.
  • Coverage limits. Where a small firm might carry $250,000, a mid-market company often needs $1 million to $10 million or more. As Gordon puts it, one million is a floor, not a ceiling.
  • Security controls. Multi-factor authentication, endpoint detection, tested backups, and employee training can meaningfully lower your rate, and are increasingly required to get coverage at all.

A cheap policy with a useless sublimit is not a deal, it is a false economy. The real cost to weigh is not this year’s premium but the seven-figure bill you pay if an underpowered policy fails you. For a deeper look at pricing mechanics, our anatomy of a cyber breach and its cost breaks down where the money actually goes.

Want an accurate number for your business? Contact us for a real quote instead of a calculator guess.

Book a Call

Policy Details Mid-Market Buyers Get Wrong

The costliest cyber mistakes at the mid-market level are not skipping the policy, they are getting its structure wrong: the limit, the named insured, and the dates. These are the levers a specialist adjusts, and the ones a generalist most often leaves on the default setting.

Before you bind, confirm each of these policy-level details:

  • Contract-required limits. Client and vendor agreements increasingly mandate a specific cyber limit, and carrying less can put you in breach of contract, not just under-insured.
  • Named insured and subsidiaries. The policy must name every operating entity, including newly acquired or newly formed subsidiaries, or their claims can fall outside coverage.
  • Retroactive and prior-acts dates. Cyber is written on a claims-made basis, so a missing or recent retroactive date can leave a breach that quietly began earlier with no coverage at all.
  • Business interruption waiting period. Many policies apply an 8 to 12 hour waiting period before lost income is covered, which matters when a day of downtime is expensive.
  • Defense inside the limit. If defense costs erode your limit rather than sitting outside it, a single lawsuit can consume the coverage you were counting on to recover.

How to secure high cyber limits and meet contract-required coverage.

Getting these right is where structure beats price, and it is where most standalone policies quietly succeed or fail.

Downsides and Coverage Traps to Watch For

The biggest danger with cyber insurance is not going without it, it is believing you are covered when a hidden clause says otherwise. Claim denials are common, and most trace back to two culprits: sublimits and security-control misrepresentations on the application.

Watch for these traps before you sign:

  • Application misrepresentation. If you attest to controls you do not actually have, the carrier can rescind the policy after a claim.
  • Social engineering sublimits. Wire-fraud losses are often capped far below your main limit, sometimes at $25,000 on a seven-figure policy.
  • Ransomware sublimits and coinsurance. Some policies pay only a fraction of an extortion event.
  • Dependent business interruption gaps. Outages at your vendors or cloud providers may not be covered.
  • Slow or narrow incident response. Weak panels and low response limits leave you exposed when speed matters most.

Real-world example

In Travelers v. International Control Services, the carrier moved to rescind a cyber policy after a ransomware claim, alleging the insured had misrepresented that it used multi-factor authentication when it did not. The lesson for mid-sized firms is direct: the security controls you claim on the application are the controls the carrier expects to find after a breach. Get them wrong, and a paid claim can turn into a denied one.

This is why the fine print, not the price, decides whether a policy protects you. Our roundup of common cyber insurance myths clears up the assumptions that get owners into trouble.

Contact Us

How to Know If Your Cyber Coverage Actually Protects You

You can pressure-test your own cyber coverage in about ten minutes by checking your limit, your sublimits, and your control requirements against how your business actually runs. If any one of them is out of step, you have a gap, and gaps are where claims die.

Ask yourself, or your broker, these questions:

  • Is my limit sized to a real breach? If your limit is below $1 million, compare it to the $11.5 million average US breach and decide if that math works.
  • What are my sublimits? Find the social engineering and ransomware sublimits specifically, and confirm they are not a small fraction of the total.
  • Can I prove my controls? Confirm you actually run every control you attested to, especially MFA and backups.
  • Is it standalone or an endorsement? An endorsement on a BOP is a warning sign for a mid-market firm.

If you cannot answer these confidently, you are sitting in what Gordon calls the confidence gap, the space between knowing and not knowing your coverage is adequate. It is a dangerous place to land. Our cyber risk scorecard gives you a structured way to assess it.

Three cyber security tips you can put to work today.

Why The Coyle Group Is the Cyber Insurance Expert for Mid-Sized Businesses

The Coyle Group specializes in cyber programs for companies with 25 to 1,000 employees, the exact mid-market range where off-the-shelf coverage stops fitting. We do not replicate a deficient policy at a lower price and call it a win. We build coverage that actually responds.

Cyber insurance can feel confusing and overwhelming, especially if you are not steeped in the risks. That is where we come in. Led by CEO Gordon B. Coyle, CPCU, ARM, AMIM, PWCA, with more than 40 years of experience, our team runs a straightforward process: we discover how your business really operates, review your current program for gaps, and right-size your coverage to your actual exposure. Almost every program we review contains at least one fatal mistake, and most owners have no idea it is there until we point it out.

Here is what a cyber specialist does that a generalist broker usually cannot:

  • Access the right carriers. We place coverage with markets that write higher limits and harder classes like manufacturing and healthcare, instead of whatever one carrier will approve.
  • Negotiate the sublimits up. We push social engineering and ransomware sublimits toward your full limit rather than accepting the default caps that cause denied claims.
  • Pre-underwrite your controls. We make sure the MFA, backups, and training you attest to on the application will actually hold up if a carrier investigates after a breach.
  • Structure for change. We build in the named-insured, prior-acts, and tail provisions that protect you through growth, subsidiaries, and any future sale.

Let us have a no-pressure conversation about your business and how cyber insurance can give you the protection you need. We will walk you through the basics, answer your questions, and help you determine the right coverage for your situation. We will also share a free guide on how to buy cyber insurance, so you have everything you need at your fingertips.

What to Know Before You Buy: Quick Answers and Buying Considerations

Before you buy mid-sized business cyber insurance, make sure you can answer five things clearly: what it covers, who needs it, what it excludes, what drives the price, and how to buy it without creating a gap. This section consolidates the essentials so you can act with confidence.

The essentials at a glance:

  • What it is. A standalone policy covering first-party recovery and third-party liability for cyber events, at limits scaled to a mid-market company.
  • Who needs it. Businesses that move money by wire, hold regulated data, or face cyber requirements in contracts, typically 50 to 1,000 employees.
  • Key coverages. Incident response, business interruption, cyber extortion, data restoration, privacy liability, and regulatory defense.
  • Top exclusions to check. Social engineering sublimits, ransomware coinsurance, dependent business interruption gaps, and application-condition exclusions.
  • What drives cost. Revenue, industry, coverage limits, and security controls such as MFA, endpoint detection, and tested backups.
  • Why standard policies fail. BOP endorsements cap low and sublimit the exact losses that hurt a mid-market firm most.

How to buy it the right way:

  • Map your data, money movement, and contract requirements before you shop.
  • Confirm and document your security controls, so your application survives a claim.
  • Size your limit to a real breach, not to the cheapest quote.
  • Read the sublimits and the named-insured schedule line by line.
  • Work with a specialist who can negotiate terms and access the right carriers, not just quote a price.
Book a Call

Frequently Asked Questions

Usually no. Endorsements on a Business Owners Policy often cap at $50,000 to $100,000 and carry steep sublimits on ransomware and social engineering. For a company with $10 million or more in revenue, that is rarely sufficient. A standalone mid-sized business cyber insurance policy provides higher limits and a broader response.

It depends on your revenue, data volume, and industry, but mid-market firms commonly carry $1 million to $10 million in limits, versus the $250,000 a small business might buy. Given the $11.5 million average US breach cost, a limit under $1 million deserves a hard second look. We size limits to your specific exposure.

The two most common reasons are application misrepresentation, such as claiming to use multi-factor authentication when you do not, and sublimits that cap a specific loss far below the policy total. Both are avoidable by reading the fine print and confirming your controls before you sign.

Most carriers now require multi-factor authentication, endpoint detection and response, tested and segmented backups, and documented employee security training. Missing controls can raise your premium, limit your coverage, or void a claim entirely. Strong controls also lower your rate.

It can, but often under a social engineering sublimit that is much smaller than your main limit. Because business email compromise caused over $3 billion in reported losses in 2025, this is a coverage line worth confirming carefully, and sometimes pairing with crime insurance.

Premiums generally range from a few thousand to tens of thousands of dollars per year, based on revenue, industry, limits, and security posture. Strong controls like MFA and tested backups can reduce the cost meaningfully. The right way to get an accurate number is a real underwriting review, not an online calculator.

About the Author

This article was written by the CEO of The Coyle Group, Gordon B. Coyle, CPCU, ARM, AMIM, PWCA, who has over 40 years of experience working with business owners of all sizes and industries across the US, solving their insurance challenges.

Check Out Our Blogs