Cyber Liability Insurance
The attack is the short part. What the business owes afterward is the expensive part.
Any business holding data it would have to answer for.
If the business stores customer information, takes payment, or depends on its systems being available in order to trade, the exposure already exists. It does not require a large company to be worth attacking.
- Businesses holding customer records, payment details or other personal information.
- Any operation that stops earning the moment its systems stop working.
- Businesses whose website, ordering or scheduling is the front door to revenue.
- Firms holding client data under contract, who owe those clients a duty for it.
- Businesses running a general insurance program that was never extended to cover a data breach.
A breach is not one cost. It is your own response costs and other people's claims, arriving at the same time.
Cyber liability is a specialized policy written for an exposure most business programs were never built around: an information breach, and everything a business is then obliged to do about it.
The structure is worth understanding before a claim, because the policy really has two halves. One pays what the breach costs you. The other answers for what the breach costs everybody else.
First-party: what the breach costs you
- Notifying customers and clients that their information was exposed.
- Restoring systems and getting the business website back to working order.
- Extortion attempts, and the decisions that come with them.
- Loss of business while systems are compromised or unavailable, which some commercial cyber policies reach and others do not.
Third-party: what the breach costs other people
- Damages claimed by clients, customers and suppliers whose information or operations were caught up in the breach.
- Inadvertently breaching somebody else's copyright, which some cyber policies will cover.
Which of these a given policy actually reaches varies more here than in most lines. The coverage grant is the thing to read, not the product name.
What actually separates one cyber policy from another.
Cyber wordings are less settled than most lines, so the comparison has to be made on terms rather than on price.
- Check whether loss of business is in or out. Some commercial cyber policies cover lost income while systems are compromised or unavailable. Others stop at the cost of the breach itself. For a business that cannot trade offline, this is the most consequential item on the list.
- Confirm the response costs are named. Customer notification, website and system restoration, and extortion are distinct heads of cover. A policy that names them is a different contract from one that gestures at cyber risk in general.
- Understand how the two halves are limited. Your own response costs and claims brought against you can carry separate limits. Buying a headline figure without knowing how it divides can leave one side of the exposure thin.
- Use the underwriting review. Insurers may walk through the current cyber defenses and identify weak points that need filling in. Closing those gaps can help prevent a breach rather than pay for one, which makes the review worth having on its own.
- Ask about copyright and content exposure. Coverage for inadvertently breaching somebody else's copyright is available under some policies. If the business publishes, hosts or distributes content, confirm it rather than assume it.
Cyber questions we hear most
Is a data breach covered by the business policy we already have?
Cyber is sold as a specialized policy precisely because a general business program is built around physical loss and physical injury. Before assuming an existing policy responds to a breach, establish what it actually says about one.
What does a cyber policy pay for after an attack?
The expenses associated with the attack and its aftermath: notifying customers and clients of the breach, restoring the website and systems to working order, dealing with extortion attempts, and paying damages to clients, customers and suppliers. Some policies also cover loss of business while systems are unavailable.
Does cyber insurance cover the income we lose while we are down?
Some commercial cyber policies do and some do not. Because an attack can close a business temporarily, this is worth settling at the quote stage rather than discovering at the claim.
Does buying cyber insurance help prevent an attack in the first place?
It can. Insurers may review the existing cyber defenses and point out weaknesses that need to be addressed. Acting on that review strengthens the security itself, which is a different benefit from the policy paying a claim.
- General Liability Insurance
- Business Owners Policy
- Commercial Property Insurance
- Workers Compensation Insurance
- Business Auto & Fleet Insurance
- Business Interruption Insurance
- Professional Liability & E&O
- Employment Practices Liability
- D&O & Management Liability
- Commercial Umbrella Insurance
- Crime Insurance
- Builders Risk Insurance
- Inland & Ocean Marine Insurance
- Surety & Commercial Bonds
- Liquor Liability Insurance
- Environmental Insurance
- Risk Management
Let's put the right policy in place.
Oxford Risk LLC is an independent agency. We represent you rather than a single carrier, which means we can place your coverage with the company whose appetite actually fits your risk. Tell us what you need to protect and an advisor will take it from there.
- Call (330) 315-3081
- Hours Monday - Friday: 8:00 AM - 4:00 PM
- Offices Fairlawn, OH, Cranberry Township, PA, Columbus, OH, Livonia, MI