Cyber insurance for Capital Region small businesses
Small businesses are attacked because they're easier, not because they're valuable. A single ransomware event or a spoofed invoice can cost more than a fire — and New York law requires you to notify affected customers. This is the policy that pays for the response. I place it for offices, shops and practices in Albany, Clifton Park, Saratoga Springs, Schenectady and Troy.
What cyber insurance covers
First party — your own costs
- Incident response — forensic IT, legal counsel, a breach coach, often via the carrier's 24/7 hotline.
- Ransomware and extortion — negotiation, and payment where lawful and necessary.
- Data restoration — rebuilding systems and recovering data.
- Business interruption — lost income while systems are down.
- Notification and credit monitoring — the notices the SHIELD Act requires, and monitoring where it's appropriate or required.
- Funds transfer fraud / social engineering — money sent to a criminal because of a deceptive email.
Third party — claims against you
- Lawsuits from customers or partners whose data you held.
- Regulatory investigations and fines where insurable.
- PCI fines and assessments if card data is compromised.
- Media liability for content on your website or social channels.
The phone number on the policy
When systems are locked at 6 a.m. on a Monday, the value of cyber insurance is having a breach team on call who have done this hundreds of times. For most small businesses, that response service matters more than the limit.
What it costs and what drives it
For a small business with basic controls in place, cyber cover typically runs from a few hundred to a couple of thousand dollars a year for $1 million in limits. Revenue, the volume and type of data you hold, your industry, and — above all — your security controls set the price. MFA, backups and endpoint protection are the three things every carrier asks about.
Who needs it most
- Anyone taking card payments or storing customer records — retail, restaurants, salons.
- Professional and financial services holding client data — often required by clients; pairs with E&O.
- Medical, dental and allied-health practices — HIPAA obligations on top of SHIELD.
- Contractors and trucking firms — invoice fraud and email compromise are rife in industries with large payments and thin admin.
What I need to quote
- Annual revenue and number of employees.
- What data you hold and roughly how many records.
- Whether you have MFA on email and remote access, backups (and where), and endpoint protection.
- Any prior incidents.
Request a quote — cyber can often be added to a BOP or professional liability package, or written standalone with broader cover.
- SHIELD Act (NY Attorney General) — reasonable safeguards, breach notification
- General Business Law §899-aa, breach notification (NY Senate) — 30 days; AG, Department of State, State Police, DFS for Part 500 entities; consumer reporting agencies above 5,000 residents; checked October 15, 2026
- General Business Law §899-bb, data security protections (NY Senate) — reasonable safeguards; small-business definition; compliant regulated entities; checked October 15, 2026
Common questions
Short answers to what people ask before they call.
Still have a question? Call (518) 902-8822 or book a call.
I'm a small shop. Am I really a target?
Yes. Most attacks are automated and indiscriminate — phishing emails, credential stuffing, scanning for unpatched systems. A restaurant's point-of-sale, a contractor's email, a salon's booking system are all targets. Small businesses are hit far more often than large ones, precisely because they have less protection.
What does New York's SHIELD Act require?
Two things. General Business Law §899-aa says that after a breach of computerized private information, you must notify affected New York residents without unreasonable delay and within 30 days of discovering it, plus the Attorney General, the Department of State and the State Police, and the Department of Financial Services if you're a DFS-regulated (Part 500) business; if more than 5,000 New Yorkers are notified at once, the consumer reporting agencies too. A business that holds data it doesn't own, such as an IT provider, must notify the owner. Section 899-bb adds the duty to keep reasonable safeguards in the first place. Notification, any credit monitoring you offer, and legal advice have real costs, which cyber insurance is designed to pay.
What security does the SHIELD Act expect from a small business?
Reasonable administrative, technical and physical safeguards, scaled to you. Under General Business Law §899-bb a small business is one with fewer than 50 employees, or less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets, and its safeguards must be appropriate for its size and complexity, what it does, and how sensitive the data is. A business that complies with the Gramm-Leach-Bliley rules, HIPAA or the DFS cybersecurity regulation (23 NYCRR Part 500) is treated as compliant. The Attorney General enforces it; there's no private right to sue under that section. Cyber insurance doesn't make you compliant, but the controls carriers require, like MFA and backups, overlap with what the law expects.
Does cyber insurance cover funds-transfer fraud?
It can, if the policy includes social engineering or funds transfer fraud cover — a spoofed email convincing your bookkeeper to pay a fake invoice is among the most common and costly cyber losses for small businesses. Check the sub-limit; it's often lower than the main limit.
What do carriers require before they'll write it?
Increasingly: multi-factor authentication on email and remote access, offline or immutable backups, and endpoint protection. Businesses without MFA are hard to insure at all. I'll tell you what a given carrier wants before you apply.
Get a quote for your business
Tell me what you do, where, and roughly what payroll looks like. Quotes come from the private carriers I represent, usually within days.
Where I work
I'm based in Clifton Park and work in person across six counties, the four on the map plus Warren and Washington, or by phone.
Close to the Clifton Park office: Clifton Knolls, Country Knolls, Rexford, Vischer Ferry, Jonesville, Groom's Corners and Halfmoon across Route 9 — I'll come to you at home.
Auto, home and business insurance by town
Medicare has its own county and town pages.