Cyber insurance cost for Singapore SMEs: what drives the premium
What drives cyber insurance cost for a Singapore SME?
Cyber underwriters price the probability of an incident and the cost of responding to it. Five inputs do most of the work.
| Input | Why it moves the premium |
|---|---|
| Annual revenue | Proxy for the size of a business interruption loss and the attacker's ransom demand |
| Personal data records | Drives notification, credit monitoring and PDPC exposure after a breach |
| Sector | Manufacturing, professional services and ICT were the 3 most-hit sectors in 2024 |
| Security controls | MFA, backups, patching and endpoint detection cut both frequency and severity |
| Limit and deductible | A S$1 million limit costs more than S$250,000; a higher deductible lowers the rate |
Two further factors adjust the rate. Claims history over 3 to 5 years, including incidents that were not claimed. And dependence on a single IT provider or cloud platform, which concentrates the risk.
Premium ranges published on advisory websites are not insurer rates and change with the market. The reliable number is the quote a broker obtains against a completed proposal form. What a company can control is the inputs above, and the controls input is the one that moves fastest.
Which limit does an SME need?
Cyber limits for Singapore SMEs are commonly bought at S$250,000, S$500,000 or S$1 million. The right limit is set from the cost of the worst plausible incident, not from the premium budget.
The components of a cyber loss are:
- Incident response: forensic investigators, legal counsel and a public relations adviser, usually engaged within 24 hours.
- Business interruption: lost revenue and extra costs while systems are down, often 5 to 15 working days for a ransomware event.
- Data restoration: rebuilding systems and recovering data from backups.
- Notification: informing affected individuals and the PDPC where the breach is notifiable.
- Third-party liability: claims from customers or partners whose data or operations were affected.
- Regulatory: defence costs, and fines where insurable.
A 20-person professional services firm with S$4 million revenue and 3,000 client records might model a 10-day outage. Lost billings S$150,000, forensic and legal fees S$60,000, notification S$20,000. That points to a S$500,000 limit with headroom for liability. A 200-person logistics company with S$60 million revenue models a larger interruption and buys S$1 million or more.
What underwriters ask before quoting
The proposal form has moved from a page of tick boxes to a controls questionnaire. Insurers now decline to quote where the baseline controls are absent, and price sharply where they are present.
| Control | What the insurer expects |
|---|---|
| Multi-factor authentication | On all email, remote access and administrator accounts |
| Backups | Offline or immutable copies, tested restores, at least weekly |
| Patching | Critical patches applied within 30 days |
| Endpoint detection and response | On all servers and laptops |
| Email filtering | Phishing and malware filtering on inbound mail |
| Privileged access | Separate admin accounts, no shared passwords |
| Incident response plan | Written, with named roles and a tested restore |
| Staff training | Phishing awareness at least annually |
A company that answers "no" to multi-factor authentication will usually receive no quote, or a quote with ransomware excluded. A company that evidences all 8 controls receives the insurer's best rate and the full ransomware section.
CSA's Cyber Essentials mark certifies that an organisation has the fundamental measures in place. It is designed for SMEs and covers cloud, operational technology and AI security in its current form. Insurers do not require the mark, but the controls it certifies are the same ones on the proposal form, so a certified company completes the form from its audit evidence.
What a claim costs
Singapore's reported incident figures show where losses come from. Ransomware cases reported to CSA rose from 132 in 2023 to 159 in 2024 and 165 in 2025. In 2025 SMEs were the most affected group, which CSA attributes to lower security maturity and more limited resources. In 2024 the 3 most-hit sectors were manufacturing, professional services and ICT, with professional services in the top 3 for the first time.
Phishing reports fell 21% to around 4,800 in 2025, from 6,100 in 2024, but CSA notes that most phishing goes unreported. Phishing remains the usual entry point for ransomware and for payment-diversion fraud.
The regulatory exposure sits under the Personal Data Protection Act. The PDPC can impose a financial penalty of up to S$1 million or, for an organisation with annual Singapore turnover above S$10 million, up to 10% of that turnover. Whether a PDPC penalty is insurable depends on the policy wording and on whether the law permits it. Most Singapore cyber wordings cover fines "where insurable by law" and defence costs in every case. The breach notification duty itself is covered in the existing article on cyber insurance and PDPA breaches.
How to lower the premium
The inputs that move the premium are the same ones that cut the chance of a claim. In order of effect:
- Turn on multi-factor authentication everywhere. This single control moves a company from declined to quoted.
- Hold an offline or immutable backup and test a restore each quarter. Insurers price ransomware severity on recovery time.
- Deploy endpoint detection and response on every device. Insurers ask for the product name.
- Reduce the personal data held. Delete records past their retention period; fewer records, lower notification cost.
- Accept a higher deductible. Moving from S$5,000 to S$25,000 lowers the rate and removes small claims the company would absorb anyway.
- Document the incident response plan and the last test date.
- Obtain Cyber Essentials certification and attach it to the proposal.
Example only. A 40-person distributor with S$12 million revenue completes the controls table and buys a S$500,000 limit with a S$10,000 deductible. The same company without MFA and with online-only backups would be declined by most markets or offered a limit with ransomware excluded. The gap between the 2 positions is not a discount; it is the difference between insurable and uninsurable.
Frequently asked questions
What limit should a 20-person company buy?
Model the worst plausible incident: forensic and legal costs, the revenue lost over 5 to 15 days of outage, data restoration, notification of every record held and third-party claims. For most 20-person Singapore firms that sum lands between S$250,000 and S$1 million. Buy the limit the model supports, then adjust the deductible to fit the budget.
Do insurers require MFA before quoting?
In practice, yes. Multi-factor authentication on email, remote access and administrator accounts is the first question on every current proposal form. Without it, most insurers decline or exclude ransomware. With it, the company qualifies for the full wording.
Does cyber insurance pay a ransom?
Many Singapore cyber wordings include cyber extortion cover, which reimburses a ransom payment made with the insurer's consent and the negotiator's costs. Payment is never automatic: the insurer's response team assesses the attacker, sanctions exposure and whether backups allow recovery instead. Some insurers sub-limit or exclude extortion for companies without offline backups.
Is a PDPC fine insurable?
Cyber policies typically cover regulatory fines "where insurable by law" and always cover the defence costs of a PDPC investigation. Singapore has not stated that PDPC financial penalties are uninsurable, but no court has ruled on it. Treat fine cover as uncertain and the defence cost cover as the reliable part.
Sources
General information only, not advice on any particular policy. Cover depends on the policy wording and the insurer's terms.