Cyber liability insurance: a business owner's complete guide

Why cyber insurance is its own policy

Traditional business insurance was built for physical risks: fire, theft, injuries, and property damage. Cyber incidents are different. A single phishing email can lock every computer in an office, expose thousands of customer records, or send a six-figure wire to a criminal's account, with no physical damage at all. Most property and general liability policies exclude or tightly limit losses involving electronic data, which leaves a gap that cyber liability insurance was designed to fill.

A cyber policy combines two kinds of protection. First-party coverage pays your own costs: investigating the incident, notifying affected people, restoring data, responding to extortion, and replacing lost income. Third-party coverage pays to defend and settle claims from customers, partners, card brands, and regulators who say they were harmed by your security failure. Most policies bundle these into one form with an overall limit and sublimits for specific coverages.

What the FBI's 2024 numbers show

The FBI's Internet Crime Complaint Center (IC3) collects complaints from victims of online crime. Its 2024 report combined 859,532 complaints with reported losses of more than $16 billion nationwide. The most frequently reported categories were phishing and spoofing (193,407 complaints), extortion (86,415), and personal data breaches (64,882). Business email compromise generated 21,442 complaints but about $2.77 billion in reported losses, making it one of the most expensive crimes per incident. Ransomware accounted for 3,156 complaints.

These figures count only what victims chose to report, and individuals file many of the complaints, so they are a floor, not a full picture of business losses. Still, they show where criminals focus. The table below lists IC3's 2024 figures for the ten states we serve.

Source: FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report. Figures reflect complaints filed by victims and are not a full count of incidents.

The per-capita column is useful for comparison. Indiana and Nevada recorded more complaints per 100,000 residents than most states, while Texas and Pennsylvania lead our footprint in total volume and reported dollars. State pages break these numbers down with each state's industry mix and breach law.

What a cyber policy typically covers

Coverage details vary by policy. Read our guides to first-party coverage, third-party liability, ransomware, social engineering, business interruption, and regulatory and PCI coverage.

Who needs cyber coverage

Almost every business has some cyber exposure, but the size of the exposure depends on three things: the data you hold, how much you depend on technology to operate, and how money moves through your business.

• Health care providers hold medical and insurance information, which is valuable to criminals and heavily regulated. Clinics, dental offices, home health agencies, and therapists all qualify.
• Professional services firms such as accountants, engineers, architects, consultants, and marketing agencies hold client confidential information and are frequent business email compromise targets.
• Financial and insurance businesses hold account numbers and Social Security numbers and face strict regulatory expectations.
• Retailers and restaurants process payment cards and face PCI exposure.
• Manufacturers and distributors may hold less personal data but depend on operational systems; downtime is their biggest risk.
• Contractors and trades send and receive large payments by wire or ACH, which makes them targets for invoice fraud.
• Nonprofits and schools hold donor, student, and employee information on limited security budgets.

Our city pages use Census County Business Patterns data to show how many health care, professional services, and finance businesses operate in each county, which is a rough guide to where sensitive data concentrates.

How cyber underwriting works

A decade ago, cyber applications were short and coverage was easy to buy. Rising ransomware claims changed that. Today insurers ask detailed questions about your security, and the answers shape whether you are offered coverage, at what retention, and with what sublimits. Some insurers also run an external scan of your internet-facing systems, looking for exposed remote access services, outdated software, and misconfigured email domains.

Underwriters focus on the controls that stop the most common attacks. Multi-factor authentication blocks most attacks that rely on stolen passwords. Endpoint detection and response catches malicious activity on computers and servers. Segregated, tested backups let you recover from ransomware without paying. Patching closes known holes. Email filtering, domain authentication, and training reduce phishing success. A rehearsed incident response plan shortens every incident.

Applications become part of the policy, so accuracy matters. If you answer that multi-factor authentication is enabled everywhere when it is not, the insurer may have grounds to deny a claim. Where a control is partial, describe exactly where it applies and when it will be complete. See the security controls insurers look for and our application checklist.

Breach notification laws in our ten states

Every state has a law that requires businesses to notify people when certain personal information is compromised. The duties follow the affected individuals, so a company in one state with customers in several others may have to satisfy several statutes at once. The laws differ on what counts as personal information, whether a risk-of-harm analysis is allowed, deadlines for notice, and when the attorney general must be told.

Statute names are provided for reference only. Read the current text and talk with counsel about any specific incident.

Notification is one of the largest costs in many breaches, and getting it wrong invites regulatory scrutiny. Breach response coverage usually provides a breach coach, a privacy attorney who directs the investigation and decides who must be notified and when. More detail is on our breach notification laws page.

Ransomware: what happens and what is covered

In a typical ransomware attack, criminals get in through a phishing email, a stolen password, or an unpatched remote access system. They move through the network, steal data, delete or encrypt backups where they can, and then encrypt systems and demand payment, often threatening to publish stolen data. Recovery involves forensics, negotiation, restoration, notification if data was taken, and lost income during downtime.

A cyber policy can respond to each of those costs under different insuring agreements. Extortion coverage pays for negotiators and, where lawful and approved, the payment itself. Business interruption replaces lost income after a waiting period. Data restoration pays to rebuild systems. Breach response pays for notification if data was stolen. Some policies apply coinsurance or sublimits to ransomware specifically, so read those terms before you buy.

Business email compromise and payment fraud

Business email compromise does not require malware. A criminal compromises or imitates an email account and asks someone to change payment instructions or send a wire. Because an employee authorizes the transfer, standard computer fraud coverage may not apply. Social engineering coverage, typically sublimited, fills the gap.

Prevention is straightforward but must be consistent: verify any change in payment instructions by calling a known number, require dual approval above a threshold, and train staff to slow down when a request is urgent and unusual. If a fraudulent transfer happens, call your bank immediately and file at ic3.gov; speed matters for recovering funds.

Cyber insurance and other business policies

Cyber coverage works alongside the rest of your insurance program, and the edges matter. A business owners policy or commercial property policy may offer a small data breach endorsement, but those endorsements usually carry low limits and narrow definitions. Commercial crime insurance covers employee theft and some forms of computer and funds transfer fraud, and some crime forms add social engineering coverage; coordinate crime and cyber so that a fraudulent wire is covered somewhere, without two retentions or an exclusion in each policy pointing at the other. Professional liability, also called errors and omissions, covers mistakes in your professional services, while cyber covers security and privacy failures; technology companies often buy a combined technology errors and omissions and cyber form.

General liability policies typically exclude claims arising from access to or disclosure of confidential or personal information. Do not assume your general liability or property coverage will respond to a breach. Ask your broker to review the exclusions and endorsements across your program so the gaps are visible before an incident, not after.

Vendors, the cloud, and shared risk

Many businesses now run on cloud email, cloud accounting, practice management software, and outsourced IT. That shifts some technical risk to vendors, but not the legal responsibility for your customers' data. If a vendor that holds your customer data suffers a breach, notification duties may still fall on you as the data owner, depending on your contracts and the applicable laws. Cyber policies differ in how they treat data held by vendors and outages at vendors, so ask whether breach response covers data in the care of third parties and whether dependent business interruption is included.

Review your key vendor contracts too. Look for security obligations, breach notice timelines, indemnification, limitations of liability, and insurance requirements. Managed service providers deserve special attention, since an attacker who compromises one provider can reach every client it manages. Ask your provider how it secures its own remote management tools.

How to choose limits and retentions

There is no single right limit. Start with the contracts you sign, since clients often require a minimum. Then estimate your notification exposure from the number of records you hold, your income at risk during a week or two of downtime, and the size of payments that move through your accounts. Consider whether you need higher sublimits for social engineering or dependent business interruption.

Retention, the cyber equivalent of a deductible, is often a flat dollar amount, and business interruption usually carries a waiting period measured in hours. Higher retentions lower premium but increase what you pay on each claim. Read our guide to what affects cyber insurance cost.

Comparing cyber quotes

• Aggregate limit and sublimits: check ransomware, social engineering, PCI, and regulatory sublimits.
• Retention and waiting period: how much you pay and how long before income loss is covered.
• Panel requirements: whether you must use the insurer's vendors.
• Defense inside or outside limits.
• Exclusions: war, infrastructure failure, unencrypted devices, prior known incidents, and failure to maintain stated controls.
• System failure: whether non-malicious outages are covered.
• Dependent business interruption: whether outages at your cloud and software vendors are covered.

What to do in the first hour of an incident

1. Call your insurer's incident hotline or claims line before calling outside vendors.
2. Isolate affected machines from the network, but do not wipe or rebuild them; evidence matters.
3. Preserve logs and email.
4. If money was sent, call your bank's fraud department and file a report with the FBI at ic3.gov.
5. Do not contact the attackers or pay anything without guidance from your breach coach and insurer.
6. Document what you see and when.

An incident response plan written in advance makes these steps automatic.

How to use this site

Choose your state to see IC3 complaint and loss data, the breach notification statute, the state's mix of data-heavy industries, and guides for the largest cities. Read the coverage and guide pages that match your business, then send a quote request. A quote is not a binder; coverage is subject to underwriting and the policy issued.

Find your state

• Washington
• Oregon
• Idaho
• Nevada
• Arkansas
• Arizona
• South Dakota
• Pennsylvania
• Texas
• Indiana

Coverage and guides

• First-party cyber coverage
• Third-party cyber liability
• Ransomware and cyber extortion coverage
• Social engineering and funds transfer fraud
• Cyber business interruption
• Regulatory defense and PCI coverage
• Data breach notification laws by state
• Security controls cyber insurers look for
• Cyber insurance application checklist
• What affects cyber insurance cost
• Building a cyber incident response plan

Cyber insurance questions

Last updated October 15, 2026 · How we research