| John Bosman | 1,199 words
Small-business cyber losses rarely start with sophisticated hacking. They start with ordinary activity—email, invoices, passwords, and vendor access. The FBI’s 2025 IC3 Internet Crime Report recorded $20.877 billion in reported losses, up 26% from 2024; for the full picture of what cyber insurance covers, start by separating the loss event from the policy that may respond.
Short answer
The threats costing small businesses the most are phishing and stolen credentials, business email compromise and funds-transfer fraud, ransomware, and AI-enabled impersonation. Each one hits differently, may involve a different coverage path, and can require a specific endorsement rather than a broad assumption that a cyber policy covers everything.
Reader checkpoint
- If an employee clicked a phishing link today, what would the attacker be able to reach?
- Does anyone verify payment or bank-change requests by calling a known number before money moves?
- Does our cyber or crime policy include social engineering / funds transfer fraud coverage, or only system breaches?
Quick answer
The practical defense is mostly procedural: require multi-factor authentication, use a password manager, call a known number before moving money, and test backups before an incident. Coverage also depends on the loss type and policy form—cyber first-party coverage, a social engineering or funds-transfer fraud endorsement, and crime coverage can answer different questions and may carry sublimits.
At a glance
What to identify before the next decision
| Main issue | Cyber losses start with routine activity: email, payments, passwords, vendors |
|---|---|
| Common blind spot | Assuming a cyber policy automatically covers a tricked employee sending money; that is often a separate social engineering endorsement |
| Useful document | Cyber and crime policy declarations and endorsements; payment-approval process; MFA and backup status |
| Best next step | Use the Commercial Renewal Readiness Score |
1. Phishing and Stolen Credentials
Phishing is a deceptive email, text, or login page designed to make someone disclose a password, approve access, or open a malicious file. The 2025 IC3 report lists phishing/spoofing among the most frequently reported crime types. For a small business, the realistic scenario is an employee entering Microsoft 365 credentials into a look-alike sign-in page; the attacker then reads invoices, resets passwords, and uses the mailbox to request payments from coworkers or vendors.
Multi-factor authentication, a password manager, and a simple habit of reporting suspicious messages quickly are the controls that matter most. If credentials are used to access systems or data, cyber first-party coverage may typically help with breach response, forensics, notification, and recovery costs, subject to the policy’s terms and conditions. The policy does not replace the need to contain the access quickly.
2. Business Email Compromise and Funds-Transfer Fraud
Business email compromise (BEC) uses a trusted-looking email—often a vendor, executive, bookkeeper, or escrow contact—to redirect a payment or change bank instructions. IC3 reported $3,046,598,558 in BEC losses in 2025, making it its second-highest reported-loss category. A common scenario is a vendor’s real mailbox being compromised just before an invoice is due; the attacker sends new wiring instructions that look routine, and the payment is gone before the error is noticed.
The most useful controls are a callback to a known, independently verified number and two-person approval for wires and bank-detail changes. Cyber coverage does not automatically mean the transfer is covered. The response may depend on a social engineering or funds-transfer fraud endorsement or a crime policy, and those coverages are often sublimited. Read the endorsement, not only the policy declarations page.
3. Ransomware
Ransomware locks or steals data and then demands payment or threatens to expose it. A small business can be hit when one compromised login reaches shared files, an unpatched remote-access tool, or a vendor connection. The immediate business problem is often operational: employees cannot access scheduling, accounting, customer records, or equipment controls while the company is trying to determine what was affected.
Offline, tested backups; patching; endpoint detection and response (EDR); and an incident-response plan are the key controls. Cyber policies may typically address cyber extortion, business interruption, data restoration, and response vendors, depending on the form. The IC3 report cautions that reported ransomware losses reflect only reported complaints and normally exclude lost productivity or downtime, so a ransomware dollar figure does not show the full business impact. Review the ransomware walkthrough before an incident forces a rushed decision.
4. AI-Enabled Impersonation and Deepfakes
AI-enabled impersonation uses convincing text, cloned voices, altered images, or video to make a request appear to come from a real executive, vendor, customer, or IT contact. In its first dedicated AI-related category, IC3 recorded 22,364 complaints and $893,346,472 in reported losses for 2025. A finance employee may hear what sounds like the owner’s voice asking for an urgent confidential wire, while a familiar-looking email supplies the details.
The controls are procedural: require verification through a known channel, train people to treat urgency and secrecy as red flags, and make it safe to pause a request. The coverage question is usually the same one raised by BEC: whether the relevant social engineering or funds-transfer fraud endorsement applies. Learn how deepfakes can affect businesses before trusting a familiar voice or video by itself.
5. Vendor and Supply-Chain Compromise
A vendor compromise happens when a third party’s systems, credentials, software, or services affect your business. A payroll provider outage, compromised managed-service provider, or exposed shared customer file can interrupt operations even if your own network was not the first point of entry. The business may still face missed revenue, customer questions, contractual obligations, and a decision about who is responsible for the response.
Limit vendor access to what is necessary, review vendor security before connecting systems, and keep a current vendor list with key contacts and data access noted. Depending on the policy, dependent business interruption and third-party liability coverage may be relevant. These provisions can be narrow, so the useful renewal question is whether the vendors your business depends on fit the policy’s definitions.
Defined Q&A
Common questions about business insurance
What is the most common cyber threat to small businesses?
Phishing and credential theft are common entry points because they exploit ordinary inbox, login, and password habits. A convincing message can lead to mailbox access, a fraudulent payment request, data exposure, or a larger ransomware event, which is why MFA and a reporting habit matter early.
Does cyber insurance cover money sent to a scammer?
Sometimes, but often only if the policy includes social engineering or funds-transfer fraud coverage, or if a crime policy responds. These coverages may have separate conditions and sublimits, so a business should check the endorsement before assuming a tricked employee’s wire is covered.
Are small businesses really targets?
Yes. Smaller businesses may have fewer approval layers, less dedicated IT staff, and more reliance on email, vendors, and a small number of people who can move money. That can make a believable request efficient for an attacker without making the business careless.
Pick the threat that feels most plausible for your business, check whether your policy actually responds to it, and fix the procedural gap first. A better approval step, backup test, or callback process is often easier to put in place before a claim tests the coverage.
What to do next
Commercial Renewal Readiness Score | Start a Coverage Review | Cyber Liability Insurance