Cyber Insurance for Michigan Businesses

It’s Monday morning at a small manufacturer in Sterling Heights. The bookkeeper gets an email from a longtime supplier: “We changed banks. Please send this week’s payment to our new account.” It looks real. It isn’t. The money is gone before lunch.

Stories like this happen in Michigan every day. In 2025, Michiganders filed more than 22,000 internet crime complaints with the FBI, reporting about $381 million in losses.^[1] Small businesses get hit the most. In one major 2026 study, about 96% of ransomware victims were small and mid-sized businesses.^[2]

Cyber insurance can help you recover from a day like that. But getting a policy isn’t as simple as it used to be. This guide explains it in plain English: what it covers, what insurers will ask you, and how to get ready.

What is cyber insurance?

Think of it like insurance for a break-in, except the burglar comes in through your computers. Coverage usually falls into two groups:^[3]

Every policy is different. Some cover a lot, some cover very little. That’s why reading the details matters (more on that below).

What insurers will ask you

A few years ago, the application was a page or two. Currently, it reads more like a security checkup. Insurers want proof that you’ve done the basics, and generally ask about the same things.^[4] Here they are in plain English:

• A second login step (MFA). Similar to when your bank texts you a code. Insurers want this on email, remote logins, and admin accounts. It’s usually the first thing they ask about.^[5]
• Modern security software. Basic antivirus isn’t enough anymore. Insurers look for tools (called EDR) that spot unusual behavior and alert someone right away.
• Backups hackers can’t reach. If your only backup is plugged into the same network, ransomware can lock it too. One copy of the backup should be kept offline or locked so it can’t be changed.
• Regular updates. Install security updates on a schedule, and replace computers and software the manufacturer no longer supports.
• Staff training. Most attacks start with a fake email. Short yearly training and practice “phishing” emails help people spot them.
• A call-back rule for payments. Before changing anyone’s bank details or sending a wire, call them at a phone number you already have on file. Insurers ask about this directly.^[6]
• A written plan. A simple page that says who to call and what to do if you get hacked.

A Michigan example

Let’s go back to that Sterling Heights company. They are a 25-person shop and use Microsoft 365 for email, have a server sitting in the back room, and rely on a software vendor that remotely accesses the system when support is needed.

When the owner asks their insurance agent for a cyber insurance quote, the agent sends over an application. The owner works through it with their IT provider, and discovers several gaps they hadn’t realized were there.

• Most employees are required to use a second login step on email, but the shared “accounting” mailbox does not.
• The vendor’s remote login only requires a password.
• The computers have basic antivirus only but no endpoint security.
• Backups are stored in a box in the same room, on the same network. Nobody has tested them in a year.

There is another weakness that has nothing to do with technology. Changes to bank or payment information are approved through email. There is no requirement to verify the request by phone.

The owner could simply check “yes” on the insurance application and move on. After all, nobody wants to admit their business has security gaps. But that creates a much bigger problem. If a claim occurs later, inaccurate answers on the application can become an issue when the insurance company investigates what actually happened.

Instead, the owner decides to fix the problems.

Over the next three months, the IT provider strengthens Microsoft 365 security, secures the vendor’s remote access, upgrades endpoint protection, moves backups away from the production network, establishes a regular backup testing process, and implements a simple but important rule: any request to change banking or payment information must be verified by phone using a trusted number already on file.

Once the changes are in place, the owner completes the insurance application based on the environment that actually exists.

A few weeks later, an email arrives that appears to be from a supplier. Their banking information has supposedly changed, and the bookkeeper is asked to send the next payment to a new account.

Under the old process, the request might have been approved with nothing more than an email reply.

Under the new process, the bookkeeper calls the supplier using the number already on file.

The supplier didn’t send the email.

The attempted fraud ends with a phone call instead of a wire transfer.

That is the point of a good cyber insurance process. The goal isn’t to find the right boxes to check on an application. It’s to uncover the weaknesses that could cost the business money, disrupt operations, or create a much larger problem after an incident occurs.

Getting ready for insurance made the business safer before the policy ever had to pay.

How to get cyber insurance in 6 steps

1. 01

   Know what you have

   Make a simple list: your computers, the software and cloud services you use, and where you keep sensitive information like customer records, employee files, or card numbers.

2. 02

   Check your current policies

   Ask your agent if any policy you already have includes cyber coverage, and how much. It’s often small.

3. 03

   Fix the basics first

   Work through the list above. Fixing gaps before you apply usually gets you better options than explaining them after.

4. 04

   Find a licensed agent

   Look for an agent or broker who knows cyber policies. In Michigan, you can check their license for free with the state’s Department of Insurance and Financial Services (DIFS).^[7]

5. 05

   Answer honestly, with your IT person

   Fill out the application together with whoever runs your IT, and save proof like screenshots and backup reports. A wrong answer can cost you the whole policy.^[8]

6. 06

   Read the fine print, then keep it up

   Compare what each policy covers, not just the price. After you buy, put the insurer’s hotline in your emergency plan and keep your security basics in place until renewal.

Fine print to watch for

Ask your agent about these before you sign:

• Smaller limits inside the policy. A $1 million policy might pay much less for certain things, like wire fraud.
• Waiting periods. Lost-income coverage often doesn’t start until you’ve been down for a set number of hours.
• Call first. Most policies require you to call the insurer before hiring help or paying anything, including a ransom.^[9]
• Things that aren’t covered. Problems you already knew about, some attacks linked to wars or foreign governments, and upgrades you make after an attack are common exclusions.

Michigan rules to know

• Telling customers about a breach. Michigan law generally requires businesses to notify affected Michigan residents, without unreasonable delay, when certain personal information (like Social Security or bank account numbers) is exposed. Knowingly skipping a required notice can lead to fines.^[10] A lawyer can tell you what applies to you.
• Checking your agent. Use the free DIFS license lookup before you share details about your business.^[7]
• Reporting a cyber crime. Contact the Michigan State Police Cyber Command Center at 877-MI-CYBER or mc3@michigan.gov. They also recommend reporting to the FBI at ic3.gov.^[11]

Your cyber insurance checklist

Print this out and check off what you already have. Anything unchecked is a good place to start.

If you get hacked

1. Call your insurer’s hotline and your agent first, before paying anyone.
2. Unplug affected computers from the network, but don’t wipe them.
3. Call your bank right away if money was sent.
4. Report it to the Michigan Cyber Command Center (877-MI-CYBER) and the FBI at ic3.gov.
5. Talk to a lawyer about whether you need to notify customers.

Frequently asked questions