What Does Cyber Insurance Cover? A Small Business Checklist

Two cyber policies can cost the same and show the same headline limit while protecting you in completely different ways. The difference is in the details: what is included, what is capped, what is excluded, and which add-ons you assumed were standard. This guide reads a cyber policy the way a careful buyer should.

The short version:

• The headline limit is a ceiling. The sublimits underneath it decide what a claim actually pays.
• Social engineering fraud, where an employee is tricked into wiring money, is one of the most common small business losses and is often missing or capped low.
• Ask for “full prior acts” coverage so a breach that began before you bought the policy is not excluded.
• Your application is part of the policy. Inaccurate answers about your security are the surest route to a denied claim.

This is general information, not insurance advice. Terms vary by carrier and policy form, so confirm the specifics of any policy with a licensed insurance professional.

What pays your own costs (first-party)

First-party coverage pays your business’s own expenses after an incident. A solid small business policy usually includes:

• Forensic investigation. Specialists who work out what happened, what was taken, and whether the attacker is still in your systems. This is almost always the first money spent.
• Breach notification. Telling affected people as state laws require: drafting, printing, mailing, and a call centre. Charged per record, it adds up faster than owners expect.
• Credit and identity monitoring. Offered to affected individuals, commonly for one to two years.
• Data restoration. Recovering or recreating data an attack destroyed or encrypted, from backups where they exist.
• Business interruption. Lost income and continuing expenses while your systems are down, usually after a waiting period (covered below).
• Cyber extortion. Ransom payments where legally permitted, plus the professional negotiators who handle them.
• Crisis management and public relations. Communications help so a bad week does not become a bad year.

What pays when others claim against you (third-party)

The liability half responds when someone else says the incident harmed them:

• Privacy liability. Lawsuits and claims from customers, employees, or partners whose data was exposed.
• Network security liability. Claims that your compromised systems harmed someone else’s. A typical example is your email account sending fake payment instructions to a client.
• Regulatory defence and penalties. Defence against proceedings by state attorneys general or federal regulators, and fines where they are legally insurable.
• Payment card (PCI) assessments. Contractual assessments and mandatory forensic audits after card data is exposed.

Who can bring a claim after a breach

The people who make claims are usually familiar, not faceless:

• Customers whose personal information was exposed, individually or as a class when enough records are involved.
• Employees. Payroll files, tax forms, and HR records are employee data, and a breach of them creates the same duties as a breach of customer data.
• Business partners and clients whose own systems or money were reached through yours. A hacked email account sending fake payment instructions is the classic case.
• Regulators. Every state has a breach notification law enforced by its attorney general, and federal agencies such as the FTC, or HHS for health information, may have jurisdiction too.
• Payment card brands, which can levy assessments and require forensic audits through your contract with your payment processor.

Why your general liability policy will not cover it

“I have general liability, so I’m covered” is a common and expensive assumption.

If your business provides technology services, the line between tech E&O and cyber matters, and some firms need both. If your business simply holds data and uses technology, the liability half of a cyber policy is the cover built for you.

Defence costs: inside or outside the limit

If defence costs sit inside the limit, every dollar spent on lawyers reduces what is left for settlements. Say you buy a $1 million limit with defence inside, and a hard-fought claim costs $600,000 to defend: only $400,000 is left to pay the claim. Defence outside the limit keeps the full amount for settlements and judgments. Ask which one a quote is.

Most cyber policies also require you to use the insurer’s approved lawyers and vendors (panel counsel), or to get consent before hiring your own. Know that rule before an incident, because spending the insurer did not approve may not be reimbursed.

Add-ons that are often missing

This is where quotes that look alike come apart. These coverages are frequently optional, capped, or absent in a base policy:

• Social engineering and funds transfer fraud. An employee tricked into wiring money or changing a vendor’s bank details. Often capped at a fraction of the main limit.
• Invoice manipulation. Attackers alter invoices in your systems so your customers pay them instead of you.
• Dependent (contingent) business interruption. Income you lose when a vendor’s systems go down, such as your cloud host, payroll provider, or practice management platform.
• Bricking. Replacing devices that malware has damaged beyond repair.
• Reputational harm. Revenue lost because customers left after a publicised incident, beyond the immediate downtime.
• Betterment. Upgrades made during restoration. Most policies pay to restore what you had, not to improve it.

If your business sends invoices or moves money electronically, treat social engineering cover as essential, and check its sublimit before anything else.

Three pieces of fine print that decide what a policy is worth

Sublimits. A $1 million policy may cap ransomware at $250,000, social engineering at $100,000, and notification costs at $50,000. Make a table of every sublimit in each quote you compare.

Waiting periods. Business interruption cover usually starts only after your systems have been down for a set time, commonly 6 to 12 hours. A shorter waiting period is worth paying for if an hour of downtime is expensive for you.

Retroactive dates. Many policies cover only incidents that began after a “retroactive date”, often the day the policy started. Breaches are frequently discovered months after they begin, so a policy with no retroactive cover can deny a claim for an intrusion that started before you bought it. “Full prior acts” coverage removes this gap. Ask for it by name.

What cyber insurance does not cover

The second row is the one to remember. The application is part of the policy.

How much to buy

There is no universal number, but there is a sensible way to get to yours.

1. Count your records. Customer, patient, card, and employee records. Notification and monitoring are priced per record, so this number anchors everything.
2. Work out what downtime costs. What does a week offline cost in lost revenue and continuing expenses? That sets your business interruption need.
3. Check your contracts. Clients increasingly set a minimum cyber limit in vendor agreements. Meet the largest one you have to sign.
4. Model a scenario. A broker can run a realistic breach against your record count and revenue and show the gap at $500,000, $1 million, and $2 million limits. Buy enough to cover the gap you could not absorb.

For many small businesses the answer is $1 million with carefully chosen sublimits. Data-heavy firms and those driven by contracts often need more. For what these limits cost, see our LLC insurance cost breakdown; for the buying process, see cyber insurance for small business.

Frequently asked questions

Is cyber liability insurance the same as cyber insurance?

In everyday use, yes. Most small business cyber policies bundle first-party cover and liability cover. Strictly, cyber liability is the third-party half, so confirm both halves are on any quote.

I already have general liability. Do I still need cyber cover?

Almost certainly. General liability covers bodily injury and property damage, and standard policies exclude electronic data incidents, so a breach lawsuit would fall outside it.

What does cyber insurance usually not cover?

Incidents you knew about before the policy started, claims undermined by inaccurate application answers, intentional acts by leadership, general infrastructure outages, and, depending on the wording, war or nation-state attacks. Every exclusion list is different, so read the actual form.

Is ransomware covered?

Usually yes: forensics, negotiation, extortion payments where legally permitted, restoration, and downtime. But ransomware is one of the most commonly sublimited coverages. The question to ask is “up to what amount?”

Does it cover an employee who wired money to a scammer?

Only if the policy includes social engineering or funds transfer fraud cover, which is often an optional endorsement with its own sublimit. Check for it explicitly.

What is a retroactive date, and why does it matter?

It is the earliest date an incident can begin and still be covered. Because breaches are often found months after they start, a retroactive date equal to your policy start can leave real claims uncovered. “Full prior acts” coverage closes the gap.

Are regulatory fines covered?

Defence against regulatory proceedings is broadly covered. The fines themselves are covered only where they are legally insurable, which depends on the state and the penalty. Have your broker point to the exact wording.

Official resources

• FTC: Cyber insurance: the FTC’s list of first-party and third-party coverages to look for.
• FTC: Data breach response, a guide for business: the steps a business takes after a breach, which are the costs a policy is meant to pay.
• NIST: Small Business Cybersecurity Corner: plain guides to the security controls insurers ask about.

Where to go from here

Spend thirty minutes listing each quote’s sublimits, waiting period, retroactive date, and exclusions. That list will tell you more than the premiums will.

Then read the main guide to cyber insurance for small business or what insurers ask for in the cyber insurance requirements guide, or see all the business insurance guides. Arhox is an independent publication, not an insurer, broker, or law firm; our editorial policy and disclaimer explain how these guides are prepared. For decisions about your own coverage, talk to a licensed insurance professional.