The fake invoice
A vendor's email account is hacked, and your bookkeeper receives a convincing invoice with new bank details. The payment goes to a fraudster.
Social engineering or funds-transfer fraud coverage can respond, up to its sublimit.
Professional & Technology Liability
Cyber liability, for breaches, ransomware and wire fraud.
Cyber liability insurance protects your business when email, systems or data are compromised, whether it's a phished login, a fake vendor invoice, a ransomware attack or a data breach.
What cyber insurance covers.
This isn't just a big-company or tech-company problem. If your business sends invoices, pays vendors, banks online or keeps customer information, it can happen to you. Fraud that starts with a single email is one of the most common ways businesses of every size lose money, and general liability and property policies typically won't respond.
Cyber policies vary widely from carrier to carrier, so the sublimits, exclusions and security requirements matter as much as the headline limit.
- Breach responseForensics, legal guidance, notification and credit monitoring after a breach.
- Ransomware and extortionExpert response and negotiation when systems or data are held hostage, subject to policy terms.
- Business interruption and restorationLost income while systems are down, and the cost to restore data.
- Social engineering and funds-transfer fraudMoney sent to a fraudster through a fake invoice or spoofed instructions, where included and often subject to a sublimit.
- Liability and regulatory defenseClaims from customers or partners whose data was exposed, and defense of regulatory proceedings.
What it typically doesn’t cover
- Fraud excluded or capped lowSome policies exclude social engineering or limit it to a small sublimit. Others place it on a crime policy.
- Missing security controlsCarriers may limit coverage if required controls, like multi-factor authentication, aren't in place.
- Vendor outagesDowntime caused by a cloud, software or payment provider needs dependent business interruption coverage.
- Bodily injury and property damagePhysical harm from a cyber event is generally excluded.
Coverage descriptions are general summaries. Actual coverage is governed by the terms, conditions and exclusions of the policy issued. Availability varies by state and carrier.
Real-world examples
What a claim can look like.
Claims rarely look dramatic at the start. They usually begin with an ordinary day, an email or a phone call.
The phished login
An employee enters their password on a fake sign-in page. Attackers read client emails and send messages in your name.
Breach response can cover forensics, legal guidance and notifications.
The locked screens
Ransomware encrypts your files on a Monday morning and work stops.
Extortion response, data restoration and business interruption can be covered.
Examples are illustrative. Whether a claim is covered depends on the facts and the terms, conditions and exclusions of your policy.
Often paired with
Professional Liability / E&O InsuranceClaims alleging that your professional advice, services or work caused a financial loss.Directors & Officers (D&O) InsuranceProtects company leaders and the organization against claims alleging wrongful management decisions or actions.Commercial Property InsuranceBuildings, equipment, inventory, business income and extra expenses following covered property losses.Employment Practices Liability Insurance (EPLI)Coverage for claims involving harassment, discrimination, wrongful termination and other employment-related practices.Related insights
Does my small business need cyber insurance?5 min readQuestions
Common questions about cyber insurance, answered.
Does my small business need cyber insurance?
If you use email, bank online, pay vendors electronically or store customer information, a cyber incident or email fraud can be expensive. General liability and property policies typically exclude most cyber losses.
Does cyber insurance cover wire fraud?
Many cyber policies offer social engineering or funds-transfer fraud coverage, often with a lower sublimit, and some businesses carry it on a crime policy instead. It needs to be selected and sized deliberately.
What security controls do carriers require?
Most carriers ask about multi-factor authentication, backups, endpoint protection and employee training. Missing controls can raise the price or limit coverage.
How much does cyber insurance cost?
Cyber pricing reflects your revenue and industry, the type and amount of data you hold, and especially your security controls, such as multi-factor authentication, backups and endpoint protection. Claims history, limits and retention also matter. We compare options across our carrier relationships so you see real prices for your business, not an average.
Talk to an advisor
Let's get this fitted properly.
Tell us about your business. A principal will review your needs, shop the market and walk you through the options in plain English.