Is State Farm Cyber Suite Worth It for Small Businesses? An MSP's Honest Review
As a Managed Service Provider (MSP), we're often asked whether cyber insurance products are worth the investment.
Recently, we reviewed State Farm's Cyber Suite offering, including the cybersecurity services provided through Zeguro.
Our honest assessment is simple:
Cyber Suite appears to be a reasonably solid cyber insurance product, but it is not an IT service and it is not a replacement for an MSP.
The real question is not whether the product is good. The real question is:
Is it worth the premium?
What Are You Actually Buying?
Based on the materials provided, Cyber Suite primarily provides:
- Financial protection after a cyber incident
- Access to breach attorneys
- Access to forensic investigators
- Access to ransomware negotiators
- Coverage for business interruption and recovery costs
- Assistance with breach notification and legal compliance
In simple terms:
Cyber Suite is designed to help your business recover after a cyber incident.
It is not designed to prevent cyber incidents from occurring in the first place.
What is Zeguro?
Zeguro is a U.S.-based cybersecurity company that was acquired by HSB (Hartford Steam Boiler), the company providing the cyber coverage behind Cyber Suite.
Their platform focuses on:
- Cybersecurity awareness training
- Vulnerability monitoring
- Security policy templates
- Compliance assistance
- Cyber risk assessments
- Security recommendations and guidance
Think of Zeguro as:
Cybersecurity coaching, training, assessments, and compliance guidance.
Not:
"We'll manage your computers and secure your business every day."
What's Probably Included?
While the brochure does not clearly define every included feature, we would expect policyholders to receive access to:
- Security awareness training
- Basic vulnerability assessments
- Website monitoring
- Security policy templates
- Compliance checklists
- Educational content
- Self-service risk assessments
These are useful resources and can help business owners better understand their cybersecurity posture.
However, they are also generally the lowest-cost cybersecurity services to provide at scale.
What Will Probably Happen After Enrollment?
If you've participated in cybersecurity assessments before, the process will likely look something like this:
- Zeguro identifies risks.
- Zeguro recommends improvements.
- Zeguro highlights security gaps.
- Zeguro presents additional security recommendations, services, or partner solutions.
That's not necessarily a criticism. It's simply how many cybersecurity Software-as-a-Service (SaaS) platforms operate.
Our expectation is that the included tools represent the "low-hanging fruit," while more advanced remediation, consulting, compliance assistance, monitoring, and professional services may involve additional costs.
Like many cybersecurity platforms, the assessment process is likely to identify opportunities for additional remediation work, consulting engagements, security products, or managed services.
What Will They Likely Recommend?
For most small businesses, we would expect recommendations such as:
- Multi-factor authentication (MFA)
- Improved password practices
- Security awareness training
- Endpoint protection
- Vulnerability remediation
- Secure backup solutions
- Written security policies
- Compliance controls
- Ongoing monitoring
The important thing to understand is:
Recommendations are not implementation.
A report recommending MFA does not deploy MFA.
A recommendation to patch systems does not patch systems.
A security policy template does not configure security controls.
Eventually, someone still needs to perform the work.
How This Works Alongside an MSP
We do not see Zeguro as a competitor to a quality MSP.
Instead, the two services are complementary.
Zeguro
- Finds issues
- Scores risk
- Provides guidance
- Provides training
- Helps satisfy insurance requirements
Managed Service Provider (MSP)
- Implements MFA
- Deploys endpoint security
- Manages backups
- Handles patching
- Secures Microsoft 365
- Responds to threats and alerts
- Supports end users
- Maintains the environment
A good MSP becomes the implementation team for many of the recommendations generated by a platform like Zeguro.
Who Should Seriously Consider Cyber Suite?
Cyber Suite becomes increasingly valuable if the business handles:
- Credit card data (PCI)
- Personally Identifiable Information (PII)
- Customer financial information
- Healthcare-related information
- Employee records
- Student records
- Information concerning minors
- Sensitive customer information
For these businesses, the cost of a breach often extends far beyond technical recovery and includes legal, regulatory, notification, and reputational expenses.
The Biggest Caveat: Premium Cost
Before purchasing any cyber insurance product, we recommend understanding:
- Is Cyber Suite included or offered as a separate rider?
- What are the coverage limits?
- What are the deductibles?
- Are ransomware payments covered?
- Are business interruption losses covered?
- Are legal and notification expenses covered separately or included within the overall limit?
- Will completing Zeguro recommendations affect premiums, policy eligibility, or renewals?
Once those questions are answered, the premium becomes much easier to evaluate.
If the Premium is Relatively Low
Cyber Suite could be an excellent value.
A single ransomware event, forensic investigation, legal review, breach notification campaign, or recovery effort can easily exceed many years of premiums.
If the Premium is Relatively High
The value proposition becomes less clear.
At some point, businesses may receive greater benefit from investing those dollars into:
- Security improvements
- Better backup systems
- MFA deployment
- Email security
- Endpoint Detection and Response (EDR)
- Managed security services
Reducing risk can sometimes provide more value than simply insuring against it.
Will Zeguro Information Be Shared With Underwriting?
One question we would ask State Farm directly is:
Are any Zeguro assessment results, vulnerability findings, questionnaire responses, training metrics, or cybersecurity scores shared with underwriting teams, and can that information impact premiums, renewals, coverage eligibility, or policy terms?
We have not found direct evidence that Zeguro assessment results automatically impact premiums.
However, we have also not found documentation specifically stating they do not.
For that reason, we would want clarification directly from the insurer.
Best-Case Scenario
- Helps identify weaknesses
- Provides useful recommendations
- Reduces claim frequency
- Potentially supports favorable underwriting outcomes
Middle-Ground Scenario
- Supports risk assessment
- Improves claims readiness
- Provides product insight
- Contributes to general underwriting intelligence
Worst-Case Scenario
Suppose a business:
- Completes assessments
- Documents serious security deficiencies
- Declines to address those deficiencies
- Experiences a preventable cyber incident
Could that information become relevant during future underwriting reviews?
We think that's a reasonable question to ask.
On the other hand, businesses might also reasonably ask whether improving their cybersecurity score could help qualify for better premiums in the future.
Either way, it is worth obtaining clarification from the insurer before participating in any detailed assessment program.
Final Thoughts
Think of Cyber Suite as your seatbelt and airbag.
Think of your MSP as the brakes, steering, headlights, maintenance, and driver training.
One helps reduce the damage when an accident happens.
The other helps reduce the chances of the accident occurring in the first place.
Our overall conclusion is that Cyber Suite appears to be a worthwhile cyber insurance option for many small businesses, particularly those handling sensitive information.
The included Zeguro tools may help identify security gaps and improve cyber awareness, but they do not replace the operational, technical, and security functions provided by a quality MSP.
Ultimately, the decision should come down to a combination of:
- Premium cost
- Coverage limits
- Deductibles
- Business risk exposure
- Existing cybersecurity maturity
The question isn't whether Cyber Suite is good.
The question is whether it makes financial and operational sense for your business.