What Cyber Insurance Costs an Australian SME, and What Moves the Number

There is no honest ballpark for what cyber insurance costs an Australian SME. The reason is published rather than coy. The Insurance Council of Australia calls cyber a relatively novel product with comparatively limited publicly available actuarial data, and says incomplete data sets make premiums difficult to price. What can be described is the machinery behind a quote: the market cycle, the cover being bought, the taxes added to the premium, and the controls an insurer examines.

Somebody has asked you what the renewal will cost, and nothing online answered it. Published cyber insurance cost ranges are hard to find, and a range drawn up without seeing your environment wouldn't be a rate anyway. So you're being asked to budget for a product the industry itself says is hard to price.

The useful version of the question is narrower. What moves the number, and which of those things sit inside your own business? A few you can change before a renewal, and the largest ones you can't touch at all. Knowing which is which stops you reading a renewal notice as a report card on your security.

That leaves two jobs that are genuinely yours before a renewal. One is knowing what cover you're comparing, because first-party and third-party cover are different products sold under one name. The other is being able to show what's running in your environment, with records, on the day somebody asks.

TL;DR: What moves the number

• ✅ A cyber premium is set per risk, against your sector, the data you hold, your claims history and your controls, so a figure from an article can't stand in for a quote.
• ✅ Australia's cyber market has been softening through 2025 and into 2026: lower premiums, broader coverage, new entrants. Part of your renewal movement is the market.
• ✅ State-based taxes and levies add nine to 40 per cent on top of small business insurance premiums, and no control in your environment reaches that part.
• ✅ First-party and third-party cover are different products under one name, so two quotes can match on price and not on cover.
• ✅ Controls are the lever you own before a renewal, and the evidence behind them is half of it. ASIC's 2023 cyber pulse survey found 33 per cent of participants had no incident response plan.

Contents

• Why No One Can Quote You a Price
• The Market Cycle and the Taxes Inside Your Premium
• The Levers That Sit Inside Your Own Environment
• Questions finance leaders ask about cyber insurance pricing

Why No One Can Quote You a Price

Start with what the industry says about itself. The Insurance Council of Australia represents members writing roughly 85 per cent of the premium income of Australia's private sector general insurers. In its February 2026 submission to a parliamentary committee it calls cyber a relatively novel product, and records comparatively limited publicly available actuarial data on the market. Its own expectation is that pricing volatility will fall as that data builds up over the coming decades. Read that in the present tense. Today's premiums are being set in a market that says its own data is still arriving.

The second reason is simpler: cyber insurance covers two different jobs under one name. First-party cover deals with the immediate expenses of surviving an incident: incident response, business interruption, recovery of data, crisis management, public relations and in some cases cyber extortion. Third-party cover deals with liabilities to others. That means privacy liability, the cost of navigating regulatory investigations and, in some instances, the associated fines and penalties. Two quotes carrying the same headline premium can be buying materially different things.

There's a third shape worth knowing about. The same submission notes that products with cyber insurance embedded in a managed service provider's offering are coming to market, which is a different route to cover again. So the first question to put to any two quotes is which of these shapes each one is.

The Market Cycle and the Taxes Inside Your Premium

Insurance prices move for reasons that have nothing to do with any individual buyer. Australia's cyber insurance market has been softening through 2025 and into 2026, according to the Insurance Council of Australia's February 2026 submission on small business cyber insurance: premiums down, coverage up, and new entrants heightening competition. The submission attributes that reading to broker and actuarial market analysis. It follows years of hard market conditions influenced by major data breaches such as the 2022 attacks on Optus and Medibank.

Then there's tax, which rarely makes the conversation. State-based taxes and levies add nine to 40 per cent on top of premiums, and state governments collected $8.9 billion in insurance taxes in 2024-25. Both figures come from the Insurance Council's release on small business insurance, so they describe small business insurance broadly rather than cyber on its own. It's still money inside a premium that no control in your environment can reach.

Scale is the last outside factor. Globally, SMEs and micro businesses account for 30 per cent of cyber market premium, on the Insurance Council's figures, and its submission describes Australia's own cyber pool as "relatively small and novel". Put the cycle, the taxes and a young market together, and a renewal that jumped, or one that fell, is weak evidence about how secure you are. Judge the controls on evidence. Read the premium as a price set in a market.

The Levers That Sit Inside Your Own Environment

The controls you run, and the records behind them, are the part you can move before a renewal. What an underwriter weighs beyond that is set out in what underwriters check before they cover you. The distinction that matters here is the difference between a control and the record of a control.

ASIC's inaugural cyber pulse survey, published in 2023, found 33 per cent of participants had no cyber incident response plan, and 44 per cent were not managing third-party or supply chain risks. Those are gaps in practice. They are also gaps in the paperwork that would demonstrate practice. A control you can prove is a different input from a control you assert.

Multi-factor authentication is one of the eight ASD mitigation strategies. ASD consulted on evolving the Essential Eight from 15 June to 12 July 2026 and published the result as the ASD Essentials on 15 October 2026, so check current guidance against this article's October 2026 date.

inSUPPORT has run more than 1,500 cyber audits, and a Cyber Strength Audit is built to produce that record: where the environment actually stands against the frameworks and the controls insurers expect, what closing each gap takes, and, where a policy is already held, whether the environment still matches what the insurer was told. From there, The 6 Step Cyber Strength System keeps the agreed controls in place and the evidence current, and the pricing effect remains the insurer's call. In practice the record comes down to three things:

• What is actually deployed, with the scope stated.
• When each control went in, when it was last tested, and who owns it.
• The last restore test, and what came back.

Questions finance leaders ask about cyber insurance pricing

Can you give me a ballpark for a 60-person business?

No, and treat a figure offered sight unseen with care. What cyber insurance costs in Australia is set per risk, so a number quoted without seeing your sector, the data you hold, your claims history and your controls is a sales anchor. What you can establish before a renewal is what you'd actually be buying, and what you can evidence. That's what makes the quotes you do receive comparable. It's a smaller promise than a price. It's also the part that survives a board meeting. If anybody does hand you a range, ask what it assumes about your sector and your controls. The assumptions are the whole number.

Who should we actually ask about the price?

The licensed party who arranged the policy, or who would arrange it. If you already hold cover, that's whoever arranged it, and questions about premium, levels of cover, exclusions and claims belong with them and with the insurer. Where cyber insurance forms part of an inSUPPORT plan, that conversation runs through inSUPPORT, which is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence, to the licensed insurance partners the cover is arranged through. It's underwritten by the insurer, and cover is subject to the insurer's assessment. What an IT provider can tell you is what's running in the environment, and what the records would show if somebody looked. Split the conversation that way and each half goes to someone qualified to answer it: an insurance adviser can't audit your identity configuration, and an IT provider can't price a risk.

How far before a renewal should we start?

Before the questionnaire lands. In practice that means reading your contract for the notice and renewal dates first. Assembling the evidence can take longer than switching a control on. An incident response plan has to be written and then tested, a restore has to be run and recorded, and scope has to be documented control by control. Allow weeks rather than days. Expect the documentation to be the slow part. Treat better controls as reducing the risk itself, because that benefit is yours regardless. Whether it shows up in a price is the insurer's assessment, and nobody on the technical side can commit to it. Start by finding out what you can evidence today, because that sets how much of the window you need.

What is the first step if we do not know what our environment can evidence?

Get the current position written down by somebody looking at the systems themselves. A Cyber Strength Audit assesses the environment against the compliance frameworks that apply to the industry and the technical controls insurers expect to see. It then sets out where the gaps are and what closing them takes. The output is a plain-English risk picture ranked by business impact, plus a documented audit trail you can hand to a board, an insurer or a client who asks for it. From there a proposal form gets answered from records instead of recollection. The budget conversation starts from something checkable. If you already hold a policy, the same audit reads it against what is technically in place.

Sources

• "Submission: Small business insurance, cyber insurance", Insurance Council of Australia's submission of 24 February 2026 to the Parliamentary Joint Committee on Corporations and Financial Services. The source for the softening Australian cyber market through 2025 and into 2026 (lower premiums, increased coverage, new entrants heightening competition), the hard market conditions that preceded it, influenced by major data breaches such as the 2022 Optus and Medibank attacks, the Australian pool being relatively small and novel, the comparatively limited publicly available actuarial data and the expectation of less pricing volatility, the first-party and third-party cover split, embedded cyber insurance in managed service provider offerings, and the 85 per cent membership share. The submission attributes its market reading to broker and actuarial analysis. insurancecouncil.com.au
• "Cyber risk", Insurance Council of Australia. The source for incomplete data sets making premiums difficult to price, and for SMEs and micro businesses accounting, globally, for 30 per cent of cyber market premium. insurancecouncil.com.au
• "Insurance Council calls for reforms to support small business resilience", Insurance Council of Australia media release, 26 February 2026. The source for state-based taxes and levies adding nine to 40 per cent to premiums, and for the $8.9 billion collected in insurance taxes by state governments in 2024-25. Both figures describe small business insurance broadly rather than cyber alone. insurancecouncil.com.au
• "23-300MR ASIC calls for greater organisational vigilance to combat cyber threats", Australian Securities and Investments Commission. The source for the inaugural cyber pulse survey (2023) findings that 33 per cent of participants had no cyber incident response plan and 44 per cent were not managing third-party or supply chain risks. asic.gov.au
• "Frequently asked questions", Australian Signals Directorate, ASD Essentials overview, published and last reviewed 15 October 2026. The source for the consultation on evolving the Essential Eight running from 15 June to 12 July 2026 and for its result being published as the ASD Essentials on 15 October 2026. Read 20 October 2026. cyber.gov.au

Related Reading

• What Underwriters Check Before They Cover an Australian Business
• The 6 Step Cyber Strength System
• MFA Is Not a Checkbox: The Gap Australian SMEs Still Have
• How Do You Know Your Backups Would Actually Restore?

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.