Cyber Liability.
Your other policies were written for fire and injury. Neither of them responds when the data goes.
General liability covers bodily injury and physical damage, and now carries an explicit cyber exclusion. Property
policies do not treat data as property. Between those two contracts sits a gap that most owners assume is covered
and is not.
What matters more than the limit is the response. A good
cyber policy brings forensics, legal counsel and negotiators within hours, and that speed decides how expensive
the incident becomes. Send us your policy and we will check the sublimits before the price.
Your costs, and what you owe others
Cyber policies have two halves, and businesses tend to buy thinking about the second while the first is what actually arrives.
First party: what it costs you
The bills that land on your desk in the first week. Forensic investigators to establish what happened, breach counsel to determine your legal obligations, and notification to everyone affected, which is required by law in every state and is rarely cheap at scale.
Then credit monitoring for affected individuals, public relations, extortion negotiation and payment where applicable, and data restoration.
And business interruption, which is the part most underestimated. Revenue lost while systems are down frequently exceeds every other line combined, and recovery takes longer than owners expect.
Third party: what you owe others
Defence and settlement when customers, employees or business partners bring claims over exposed data. These arrive months after the incident, long after the operational crisis has passed.
Regulatory defence sits here too. State attorneys general and federal regulators investigate breaches, and the cost of responding to an investigation is real even where no penalty follows.
Contractual liability matters as well. If you hold client data under an agreement that imposes security obligations, a breach can trigger indemnity claims from the client independent of any regulator.
The incidents we see, in order of frequency
Not the dramatic ones. These are the losses that arrive at ordinary businesses, and each is handled differently by the policy.
Funds transfer fraud
An employee is convinced by a convincing email to wire money to a fraudulent account, often impersonating an executive or a known supplier. Extremely common, and frequently sublimited far below the policy limit or excluded outright.
Ransomware
Systems encrypted and operations halted. The payment is negotiable and often the smaller figure; the downtime, restoration and forensic work are what make it expensive.
Business email compromise
An email account is taken over quietly and used to redirect invoices or harvest data. Often discovered weeks later, which widens both the loss and the notification obligation.
Lost or stolen devices
A laptop or phone with client data. Unglamorous, and still triggers the full notification obligation in most states.
Insider error
An email sent to the wrong list, a misconfigured cloud folder, a document left public. No attacker involved, and the legal consequences are identical.
Vendor and cloud outage
Your systems are fine and your provider is not. Dependent business interruption covers this and is not always included, which matters more every year.
The controls that decide whether you can buy it at all
Cyber underwriting tightened considerably after several years of heavy losses. These are no longer recommendations; without them applications are declined or come back with terms that are not worth having.
Multi-factor authentication
On email and remote access, close to universally required. Applying without it is the single most common reason a submission is declined.
Tested offline backups
Backups that are separated from the network and actually restored in a test. Carriers ask when you last tested, and ransomware negotiating position depends entirely on the answer.
Endpoint detection
Modern detection on workstations and servers rather than legacy antivirus. Increasingly a condition rather than a discount.
Email filtering and training
Most incidents begin with an email. Filtering and periodic staff training reduce both frequency and premium, and they are inexpensive.
Payment verification procedure
A written rule that any change of bank details is verified by phone to a known number. This one procedure prevents the majority of funds transfer losses.
Patching and access control
Timely updates and removing access when people leave. Basic, routinely neglected, and specifically asked about on every application.
Where a control is missing we will tell you before we submit, because it is nearly always cheaper to fix it than to accept the terms that follow from not having it.
The sublimits matter more than the limit
Two policies with the same headline limit can behave completely differently. What separates them is the sublimits, the waiting period on business interruption, and the quality of the response team behind the policy.
Check the sublimits
Funds transfer fraud, extortion and dependent interruption are frequently capped well below the main limit. That cap is the number that will apply to you, not the one on the front page.
Check the waiting period
Business interruption usually starts after a waiting period measured in hours. A twelve-hour wait and a twenty-four-hour wait produce very different claims on the same event.
Check who answers
The response panel is the product. A carrier with experienced breach counsel and forensics on call is worth more than a slightly higher limit with a slow intake line.
Then shop it
Appetite varies enormously by industry, revenue and controls. A risk one carrier prices punitively is another’s preferred class, and with good controls the market is genuinely competitive again.
Send us your policy and we will read the sublimits.
Most owners have never seen what their cyber policy caps social engineering at, or how long the waiting period runs before business interruption begins. Those two numbers tell you more about the policy than the premium does. No cost, no obligation.
Cyber liability, answered plainly
We are small. Are we really a target?+
Small businesses are targeted precisely because they are small. Attacks are automated and indiscriminate, and smaller organisations typically have weaker controls and no dedicated security staff. The damage is also proportionally worse, because a large company absorbs a six-figure incident and a small one frequently cannot.
Does my general liability policy cover a cyber event?+
No. General liability responds to bodily injury and physical property damage, and most policies now carry an explicit cyber exclusion. Property policies exclude data as property. The gap between those two policies is exactly what cyber coverage exists to fill.
What does it actually pay for?+
Two sides. First-party costs are yours: forensics, legal counsel, notification, credit monitoring, public relations, ransom negotiation, and lost income while systems are down. Third-party costs are what you owe others: defence and settlement when customers or partners sue over their data.
Does it pay a ransom?+
Most policies cover extortion payments subject to sanctions law and carrier approval, and just as importantly they provide the negotiators and forensic specialists who handle it. The payment itself is usually the smaller part of the claim; recovery and downtime cost more.
What if an employee is tricked into wiring money?+
That is social engineering or funds transfer fraud, and it is one of the most common losses we see. Many base policies sublimit it heavily or exclude it, so it needs checking specifically rather than assuming the policy covers theft.
What controls do carriers require now?+
Multi-factor authentication on email and remote access is close to universal, and most carriers also want tested offline backups, endpoint detection, and staff training. Applying without MFA now means declines or severely restricted terms. The controls also reduce premium meaningfully.
Are we covered if the breach happens at a vendor?+
Sometimes, and it depends on the wording. Dependent business interruption and contingent coverage address outages at a cloud provider or key supplier, and they are not always included. Given how much runs through third parties now, this is worth confirming explicitly.
Does it cover regulatory fines?+
Where insurable by law, many policies cover regulatory defence and fines, and the defence cost alone is frequently substantial. Insurability varies by jurisdiction, so this is an area where the specific wording and your state matter more than the headline limit.