Skip to content

What Cyber Liability Insurance Covers

Cyber policies are split into two coverage categories: first-party (your costs) and third-party (other people's claims against you).

First-Party Coverage - Your Direct Costs

These are the expenses you incur directly from a cyber incident:

  • Forensic investigation. Hiring cybersecurity experts to determine what happened, how the attacker got in, what data was compromised, and how to stop the breach. Forensic investigations typically cost $10,000 to $100,000 depending on the scope.
  • Data breach notification. Most states require you to notify every individual whose personal information was compromised. Notification costs include letters, call center setup, and credit monitoring services for affected individuals. At $3 to $5 per record, notifying 10,000 affected customers costs $30,000 to $50,000 just in notification expenses.
  • Credit monitoring. Providing affected individuals with credit monitoring and identity theft protection services, typically for 12 to 24 months.
  • Data recovery and restoration. Restoring lost or corrupted data, rebuilding systems, and getting your technology infrastructure back to operational status.
  • Ransomware payments. If your systems are locked by ransomware and the decision is made to pay the ransom, the policy covers the payment. It also covers the negotiation costs - most carriers have specialized ransomware negotiation teams.
  • Business interruption. Lost income while your systems are down. If a cyberattack shuts down your operations for days or weeks, cyber business interruption covers the revenue you would have earned during that period.
  • Crisis management and PR. Public relations support to manage the reputational damage from a breach. How you communicate after a breach matters - carriers provide access to crisis communication professionals.
  • Extortion. Beyond ransomware, this covers threats to release stolen data, DDoS attacks held for ransom, and other forms of cyber extortion.

Third-Party Coverage - Claims Against You

These are the costs from lawsuits, regulatory actions, and contractual penalties:

  • Lawsuits from affected individuals. Customers, employees, or other parties whose data was compromised can sue you for damages. The policy covers defense costs and settlements.
  • Regulatory fines and penalties. State attorneys general, the FTC, HHS (for healthcare data), and other regulatory bodies can impose fines for failing to protect personal data. Coverage varies by state and regulation.
  • PCI penalties. If you process credit card payments and suffer a breach, payment card brands can impose penalties ranging from $5,000 to $100,000 per month until the vulnerability is resolved, plus the cost of forensic audits.
  • Legal defense. Attorney fees, court costs, and expert witness fees for defending against data breach lawsuits and regulatory proceedings.
  • Contractual liability. If your contract with a client requires you to protect their data and you fail, the resulting claims are covered.

Why Every Business Needs Cyber Coverage Now

The most dangerous assumption any business owner makes about cybersecurity is "we are too small to be a target." The data says the opposite.

Small and mid-size businesses are specifically targeted by cybercriminals because they have weaker defenses than large corporations but still hold valuable data - customer records, bank account information, employee Social Security numbers, and payment card data. You do not need to be a Fortune 500 company to be worth attacking.

The numbers are straightforward:

  • The average cost of a data breach for a small business is $120,000 to $200,000. That includes forensics, notification, legal fees, and lost business.
  • Ransomware demands against small businesses average $50,000 to $200,000. The total cost including downtime and recovery is often double the ransom itself.
  • 60% of small businesses that suffer a major cyberattack close within six months. Not because the attack destroyed them directly, but because the financial and reputational damage was more than they could absorb.

If your business uses email, stores any customer information, processes payments, or operates any part of its business online - and that is every business operating today - cyber liability is not optional coverage anymore. It is as fundamental as general liability.

Who Needs Cyber Liability Insurance

The short answer: every business. The longer answer is about degree of exposure.

Any business that stores customer data. Names, addresses, email addresses, phone numbers, Social Security numbers, payment information, health records - if you collect it and store it, you are legally responsible for protecting it. A breach triggers notification requirements and potential lawsuits.

Businesses that process payments. Credit card, debit card, and ACH transactions create PCI compliance obligations. A breach involving payment data can trigger PCI penalties, card brand fines, and mandatory forensic audits that cost tens of thousands of dollars.

Healthcare providers and businesses handling health data. HIPAA violations from a data breach carry penalties of $100 to $50,000 per record, with annual maximums up to $1.5 million per violation category. The regulatory exposure alone justifies cyber coverage.

Professional services firms. Accountants, attorneys, financial advisors, and consultants hold sensitive client data. A breach exposes both the data and the professional relationship. Pair cyber with professional liability for full protection.

Technology companies. If you build, host, or manage technology for other businesses, a security failure in your systems can cascade to your clients. Your contractual liability exposure is significant.

Contractors and Construction - Yes, You Have Cyber Exposure

Contractors often assume cyber risk is someone else's problem. It is not. Here is what cyber exposure looks like in a construction business:

  • Payroll data. You store employee Social Security numbers, bank account information for direct deposit, and tax records. A breach of your payroll system is a data breach with notification requirements.
  • Client financial information. Bond applications, credit reports, financial statements, and banking details that flow through your office during the bonding and insurance process.
  • Electronic funds transfer fraud. Phishing emails targeting your accounting staff to redirect wire transfers or change payment instructions on invoices. Construction businesses are prime targets because they routinely send and receive large wire transfers for project payments.
  • Project bidding systems. Online bid submission platforms, project management software, and estimating tools that contain proprietary pricing information.
  • Subcontractor and vendor data. W-9s, certificates of insurance, contracts, and contact information for your entire supply chain.

The most common cyber claim we see in construction is funds transfer fraud - a phishing email that spoofs a subcontractor's invoice with different banking instructions. The contractor's accounting department wires $150,000 to the wrong account. That money is gone in minutes. Cyber liability covers that loss.

What Cyber Liability Costs

Cyber insurance is still one of the more affordable commercial coverages relative to the exposure it covers. General premium ranges:

  • Small businesses (under $1M revenue, limited data): $500 to $2,000 per year
  • Mid-size businesses ($1M to $25M revenue): $2,000 to $10,000 per year
  • Larger operations or high-data-volume businesses: $10,000 to $50,000+ per year

Factors that affect the premium:

  • Revenue. Higher revenue typically means more data, more transactions, and more exposure.
  • Industry. Healthcare, financial services, and technology companies pay more due to regulatory requirements and data volume. Construction and professional services typically pay less.
  • Amount and type of data stored. The more sensitive the data (health records, Social Security numbers, payment card data), the higher the premium.
  • Security practices. Multi-factor authentication, encrypted data storage, regular employee training, and incident response plans can all lower your premium. Many carriers now require MFA as a condition of coverage.
  • Prior incidents. A previous breach or cyber claim increases your premium significantly and may limit your coverage options.
  • Policy limits. Standard limits range from $500K to $5M. Higher limits cost more but may be necessary based on your data volume and contractual requirements.

Cyber Insurance vs General Liability

Your general liability policy does not cover cyber events. Period. Here is why:

General liability covers third-party claims for bodily injury and tangible property damage arising from your business operations. Data is not tangible property under standard GL policy language. A cyberattack does not cause bodily injury. Ransomware does not damage physical property.

GL policies have explicit exclusions for electronic data, cyber events, and technology-related losses. Even if a creative attorney tried to argue a cyber loss under your GL policy, the exclusions are clear and courts have consistently upheld them.

Cyber liability is a separate coverage for a separate risk. You need both - GL for physical-world claims and cyber for digital-world claims. One does not substitute for the other under any circumstances.

Frequently Asked Questions

Do I need cyber insurance if I do not store customer data online?

Yes. If you have employee records with Social Security numbers, use email, process any electronic payments, or use any cloud-based software - you have cyber exposure. Most cyber claims come from email compromises and phishing attacks, not database hacks. If your business uses email and a bank account, you are a target.

Does my BOP include cyber coverage?

Some Business Owners Policies include a small cyber sublimit - typically $10,000 to $50,000. That is not nearly enough for most breach scenarios. A standalone cyber policy provides proper limits, dedicated breach response resources, and coverage for the full range of cyber events. The BOP sublimit is a starting point, not a solution.

What is the first thing I should do if I think I have been breached?

Call your insurance agent immediately. Your cyber policy includes access to a breach response team - forensic investigators, legal counsel, and notification specialists who handle breaches every day. Do not try to investigate or remediate on your own. Do not turn off systems unless the breach response team tells you to. Preserving evidence matters for both the investigation and your claim.

Get Cyber Liability Coverage

Cyber risk is not going away. It is growing every year, and the criminals are getting better at targeting small and mid-size businesses that think it will not happen to them. A standalone cyber policy costs a fraction of what a single breach costs - and it comes with a response team that knows exactly what to do when the worst happens.

The Grit team places cyber liability for businesses across every industry - from contractors and professional services to healthcare and technology. We match the policy to your actual data exposure and security posture, not just a revenue bracket.

Call us at (801) 505-5500 or request a quote online.