How Much Does Cyber Insurance Cost in Australia?

Key points

• Turnover is the biggest single input, and four other things below move the price.
• Check the scam-payment limit on its own, not only the headline limit.
• Check every change of bank details before the money goes, and say so when you are quoted.
• Answer the security questions truthfully, even where the answer is no.

What will cyber insurance cost a business like mine?

The $915 for $500,000 of cover was a Queensland consultant with a $2,500 excess (the amount you pay towards each claim). The $1,160 for $1 million was a Queensland psychologist, also with a $2,500 excess. The $1,740 for $2 million was a Queensland training provider turning over $170,000.

So most of the businesses we insure pay more than those figures. In July 2026, for businesses turning over $500,000 to $2 million, premiums on the cyber cover we placed ran from around $1,400 a year for $500,000 of cover to around $4,000 for $2 million.

Is it worth it for a business your size?

Being small does not keep a business safe, because scams are sent at scale. If your business pays suppliers by bank transfer, takes payments online, keeps customer details anywhere or would struggle to trade for a week without its systems, you carry this risk.

Weigh the premium against what a week of your own downtime would cost, and against one redirected payment you cannot get back. What a policy pays for is on our cyber insurance page.

What moves the price?

Two businesses with the same turnover can still pay very different amounts. Five things make the difference.

Turnover. It is the biggest single input for a small business. Insurers read it as shorthand for how much activity and how many transactions your business runs, and how much could go wrong. If your turnover has grown since you last bought cover, the price is set on the figure you give, so give the current one.

The records you hold. Thousands of customer records, health information or client financials mean more people to notify after a breach and more claims from others. A business holding a supplier list and a job calendar carries far less, and the premium follows.

How money moves. Money paid or received by bank transfer can be redirected to a scammer's account, and insurers price that risk.

The limit and the sections you add. A bigger limit costs more, and so does adding scam-payment cover. On some of the policies we place, cover for hardware an attack leaves unusable is an option, and adding it raises the price too.

Your security setup. Your security answers decide which insurers will offer you terms, and at what price.

Will the policy pay if you pay a fake invoice?

Only if it has a scam-payment section. That section has a limit of its own, usually well below the headline figure.

Some of the cyber policies we place build scam-payment cover in. On others it is an optional section, or one that can be left off, and some leave it out altogether.

That limit is commonly between $25,000 and $250,000, depending on the insurer and the exact fraud type, and it is confirmed at quote stage for your situation. A policy with $1 million on the front page can pay as little as $25,000 on a fake invoice, if your limit sits at the bottom of that range.

Buying more cover usually does not lift it. A bigger headline limit on the covers we place steps up the large sections, such as rebuilding your systems or a serious claim from others, while the scam-payment limit usually stays where it was.

Some of those policies do not pay a redirected-payment claim if nobody in your business independently checked a request to change the bank account before the money went out. The same goes if nobody confirmed the payment instructions were genuine. Most that include scam-payment cover do not ask for that.

Make the check a written habit anyway, because writing it down can also cut your premium. On one quote we ran on the covers we place, a written procedure for checking payment details cut the base premium by about 17 per cent. One quote is not a market rate, so ask what it is worth on yours.

What if you cannot answer the security questions?

The insurers we place cyber with mostly ask about the same short list. They want a second step at login, a code from your phone (multi-factor authentication), and backups an attacker cannot reach, tested by restoring them. They also want software kept up to date, and staff who can spot a forged bill or a fake login page.

The trouble comes when you cannot truthfully tick every box. Maybe that code is on email but not the accounting software, or the backups run but nobody has ever tested a restore.

Where your business is eligible and cannot answer the technical questions at all, we go first to the insurers that do not ask them. Where an insurer does ask, we help you answer from what you know, and we check anything you are unsure of with the insurer rather than guess. Where cover is suitable and available, we also place a business that declares its gaps honestly while its controls catch up. Even where an insurer does not ask about your systems, you still have to tell them anything you know that would matter to their decision.

On the covers we place, answering every security question at its most cautious can still bring back a quote with no cover removed and no conditions added, only a different price.

Why isn't cyber cover already in my business pack?

Sometimes it is, but only as a small extension. Some business packs and management liability policies carry a cyber extension, usually capped at about $250,000, far less than a cyber policy of its own.

A business pack is built around physical loss. A ransomware attack that locks every computer damages nothing physical, so the pack's property and business interruption sections, which turn on physical damage, mostly do not pay. Our business insurance page covers how the two fit together.

If we look after your cyber policy, what happens when you claim?

If money ever goes to a scammer, your bank would be the first call, to stop or recover the transfer. Straight after, you would ring the insurer's cyber incident helpline, on the number in your policy documents, because your policy expects prompt notice. After that, you would ring us on 07 3292 1100.

Our specialist claims manager then deals with the insurer for you, and the broker who looks after your policy stays involved. You spend less time chasing the insurer while you get the business running again. You still give the insurer the records it asks for. The insurer decides the claim, and we tell you where it stands.

Frequently asked questions