This research proposes a novel firm-based model for pricing cyber insurance. Our model considers two types of cyber risk: virus attacks and data breaches. Virus attacks deliver adverse shocks to the firm’s productivity, while data breaches cause premium customer departures that worsen the prospect of the firm’s product demand. We derive the endogenous structural form of cyber losses in firms and utilize it to solve the formula for cyber insurance premiums. Our quantitative results show that the consensus prediction about a strictly positive premium-risk nexus is no longer valid. Asymmetries in the sub-premium’s sensitivity to cyber risks from different sources and the premium customer loss rates jointly shape the complexity of the relation between cyber insurance premiums and cyber risks. Improvements in the product demand conditions enhance firms’ incentives to hedge cyber losses and push premiums higher. Lastly, we discuss the influence of product price competition on premiums.