How to price cyber insurance for SMEs: rating factors and a worked example
How SME cyber insurance is rated from revenue, industry, data held and security controls, with a worked quote for a professional services firm priced by a real rating model.
SME cyber insurance is usually priced from a base premium by revenue band, adjusted for the limit, the industry and how much personal data the business holds. What sets cyber apart from other lines is how much the security controls matter. Multi-factor authentication (MFA), offline backups and endpoint detection change both the price and whether the risk is written at all.
This article covers the main rating factors, the rules that decline, refer and endorse, and a worked quote priced by a rating model we built in Ptally for this article. The rates are illustrative and are not taken from any insurer.
The main rating factors
Revenue
Revenue is the main exposure measure for SME cyber. More revenue usually means more systems, more staff and more transactions to disrupt. The example model sets a base premium at a £1m limit by revenue band, from £650 up to £500k of revenue to £7,200 for £25m to £50m.
Limit
An increased limit factor scales the base: 0.55 for £250k, 0.75 for £500k, 1.00 for £1m and 1.40 for £2m. The factor rises more slowly than the limit, because most claims are well below the top limits.
Industry
Some industries hold more sensitive data or are targeted more often. The example uses 1.00 for professional services, 1.15 for retail, 1.25 for manufacturing and 1.45 for healthcare.
Records held
The cost of a data breach rises with the number of people affected: notification, credit monitoring, regulatory work and claims. The records factor is 1.00 up to 10,000 records, 1.10 up to 50,000, 1.25 up to 250,000 and 1.50 above that.
Security controls
- MFA on email and remote access is close to essential. Without it the example loads the premium by 30%.
- Offline or immutable backups make a ransomware attack recoverable. Without them the premium is loaded by 20%.
- Endpoint detection and response (EDR) earns a 10% credit.
Retention and claims history
A higher retention (excess) lowers the premium: 1.08 at £1,000, 1.00 at £2,500, 0.94 at £5,000 and 0.88 at £10,000. One cyber incident in three years loads the premium by 25%, and two or more by 60%.
UK Insurance Premium Tax at 12% is added to the risk premium.
Declines, referrals and endorsements
Cyber products lean on rules as much as rates. The example model:
- declines businesses with more than £50m revenue, and businesses with neither MFA nor offline backups;
- refers businesses with two or more incidents in three years, and healthcare businesses holding more than 250,000 records;
- endorses the policy with a ransomware sublimit of 50% of the limit when there is no EDR, and with a condition that MFA stays in place when it is declared.
The endorsements come back in the quote response with their form codes, so the policy schedule can show the right wordings. See building policy documents from the quote response.
A worked example
Take a UK accountancy firm with £3.2m revenue, holding 18,000 client records. It wants a £1m limit with a £2,500 retention. It has MFA and offline backups but no EDR, and no incidents in the last three years.
| Step | Value | Reason |
|---|---|---|
| Base premium | £2,100.00 | Revenue £2.5m to £5m, £1m limit |
| × Limit factor | 1.00 | £1m |
| × Industry factor | 1.00 | Professional services |
| × Records factor | 1.10 | 18,000 records |
| × MFA | 1.00 | In place |
| × Backups | 1.00 | Offline backups |
| × EDR | 1.00 | Not in place |
| × Retention | 1.00 | £2,500 |
| × Incident history | 1.00 | No incidents |
| = Risk premium | £2,310.00 | |
| + IPT at 12% | £277.20 | |
| = Annual premium | £2,587.20 |
The quote is valid. It carries two endorsements: the ransomware sublimit, because there is no EDR, and the MFA condition.
Changing the controls shows how much they matter:
- With EDR: £2,328.48, and the ransomware sublimit drops off.
- Without MFA: £3,363.36.
- Without MFA or offline backups: declined.
A healthcare clinic with the same revenue and controls but 300,000 patient records comes to £5,115.60 and is referred to an underwriter.
Things to watch in a cyber model
Controls change fast. Insurers revise their minimum controls often. Keeping them as rules in the model, with tests, means a new requirement is a tested change rather than a note to underwriters.
Questions must match the rules. Every control in the rating must be a question in the quote form or broker submission. A model that loads for missing EDR is only as good as the answer it receives.
Price and wording together. A sublimit is a pricing decision as well as a wording. Keeping the endorsement rule in the same model as the rates means they are tested and released together.
Getting started
Ptally is free to build on, with no implementation fee. Send us your cyber rating guide or spreadsheet and we will help you turn it into a tested model, with the declines, referrals and endorsements alongside the rates. Price quotes over the API, or see how models are built on the model building page. Talk to our team.