Cyber coverage can respond to ransomware, payment fraud, data breaches, and business interruption. We match the policy to the risks your business has today.
Cyber policies split into money you lose, money you owe others, and the specialists who show up on day one.
Negotiation, forensic investigation, restoration, and — where lawful and unavoidable — the ransom itself. The recovery cost usually exceeds the demand. Sub-limits and coinsurance on this coverage are common and worth reading closely.
Lost income while systems are down, including in many policies an outage at a vendor you depend on. Waiting periods here are measured in hours, and the difference between an eight-hour and a twenty-four-hour retention is substantial for an operating business.
The most common loss we actually see. An email that appears to come from an executive or a known vendor redirects a payment. Many policies cover this only by endorsement and at a lower sub-limit, so it must be requested specifically rather than assumed.
Claims from customers or employees whose data was exposed, plus regulatory investigations and fines where insurable. Notification obligations are set by state law and trigger faster than most businesses expect.
The practical value on day one: a breach coach, forensics, legal counsel, notification services, and credit monitoring. Most small businesses have no plan for the first forty-eight hours, and this is the coverage that supplies one.
Multi-factor authentication, offline or immutable backups, endpoint detection, email filtering, and employee training. These are increasingly conditions of coverage rather than discounts — and a misstatement on the application can jeopardize a claim.
Coverage differs more between cyber carriers than in almost any other line.
Almost always in the sub-limits rather than the headline number.
A modest cyber add-on is useful as a first layer and inadequate for a genuine ransomware event. The limit is frequently a fraction of what recovery costs.
The most frequent loss is often the one excluded. Funds-transfer fraud commonly requires a specific endorsement and carries its own lower sub-limit.
Cyber applications ask direct questions about MFA, backups, and training. Answering aspirationally rather than accurately can void coverage precisely when it is needed.
If business interruption does not begin until twenty-four hours in, a twelve-hour outage that cost real money produces no recovery.
Usually beginning with whether they are a target at all.
Small businesses are targeted precisely because their controls are lighter and their ability to pay is real. Most attacks are automated and opportunistic rather than chosen. If you hold customer data, move money, or depend on systems to operate, the exposure exists.
Generally no. Most general liability forms exclude electronic data and cyber events explicitly. This is a standalone coverage for a reason.
Multi-factor authentication on email and remote access is close to universal now, along with tested backups kept offline or immutable, endpoint detection, and documented employee training. These have shifted from discounts to prerequisites over the last several years.
Only if the policy includes social engineering or funds-transfer fraud coverage — often an endorsement with its own sub-limit rather than part of the base form. It is the first thing we check on any policy someone already holds.
What data do you hold, and how does money leave the business? Start there and we will size the rest.
