How much does cyber insurance cost in Australia?

In our experience, premiums for small businesses start at around $300 a year and go up from there. What you pay depends on your revenue, industry, how much personal data you hold, your security controls, your claims history, and the limit and excess you choose. Strong basics such as multi-factor authentication and tested backups help keep the premium down.

Reviewed 25 September 2026 by Ben Webster

What drives the price

Insurers price each business individually. The main things they look at are:

Revenue. Larger businesses generally have more to lose from an interruption and more exposure to claims.
Industry. Businesses that hold sensitive data or move money, such as healthcare, legal, accounting and finance, are often priced higher.
Records held. The more personal or client records you store, the bigger a breach could be.
Security controls. What you answer on the proposal about multi-factor authentication, backups, patching and similar basics.
Claims history. Past cyber incidents or claims usually increase the premium.
Limit and excess. A higher limit of cover costs more; a higher excess usually costs less.

How your security affects premium and insurability

Security controls affect more than the price. Gaps can lead to a higher excess, lower limits, exclusions, or an insurer declining to quote. The controls most commonly asked about are:

Multi-factor authentication on email, remote access and admin accounts. This is often the first question on a proposal form.
Regular, tested backups, with a copy that ransomware cannot reach.
Prompt patching of software, operating systems and internet-facing devices.
Email authentication (DMARC), which makes it harder for criminals to send email pretending to be you.
No remote desktop exposed to the internet.

Most of these are part of ASD's Essential Eight, which is a good checklist to work from.

How to lower your premium

Fix the basics before you apply. Turn on multi-factor authentication everywhere it is offered, test a backup restore, and set software to update automatically.
Answer the proposal accurately. Overstating your controls can put a claim at risk. Understating them can cost you money.
Choose a sensible limit and excess. Match the limit to what an incident could realistically cost you, and pick an excess you could pay without strain.
Use a broker. A broker can approach several insurers and explain the differences in cover, not only price.
Keep evidence. Screenshots or reports showing your controls help at renewal and when a new insurer asks questions.

Is cheaper cover worth it?

Compare what the policy covers, not only the premium. Two policies with a similar price can differ a lot in sub-limits, business interruption waiting periods, and whether incident response is included. If you are still deciding whether you need it at all, see Do I need cyber insurance?.

Common questions

Why did my cyber insurance quote come back higher than expected?

Usually because of the business itself rather than the market alone: higher revenue, more personal records, an industry insurers see as higher risk, a past claim, or gaps in controls such as multi-factor authentication or backups. A higher limit or lower excess also costs more. Ask your broker which factors moved the price.

Is a higher excess a good way to lower the premium?

It can reduce the premium, but only choose an excess you could pay the day after an incident without it hurting the business. The saving is rarely worth it if the excess would be hard to fund.

Will improving my security lower my premium straight away?

Not always straight away, but it helps at renewal and can open up insurers that would otherwise decline. Controls such as multi-factor authentication, tested backups and prompt patching are commonly asked about on proposal forms, so being able to answer yes to them matters.

How often should I review my cyber cover?

At least at each renewal, and whenever the business changes in a way an insurer would care about: a big jump in revenue, a new system that holds customer data, a move to taking payments online, or an acquisition. Your policy wording may also require you to tell the insurer about changes like these.

Sources

General information only, not financial or insurance advice. Talk to a licensed broker about your situation.

See where your business stands.

Enter your website and CertIQ scores your cyber health out of 100 in under 10 seconds, with a short Essential Eight self-assessment. Free, no account needed.