Cyber Insurance

As a business owner, you rely on technology to process payments, communicate with customers, manage employee information, store business records and keep your daily operations running.

Unfortunately, every system, account and connected device can create an opportunity for cybercriminals. A data breach, ransomware attack, fraudulent email or system outage could lead to significant recovery expenses, lost income and damage to your company’s reputation.

The right cyber insurance can help protect your business from the financial consequences of a cyberattack or data security incident.

What Cyber Insurance Coverage Do You Need, and How Much?

The cyber insurance your business needs depends on the information you collect, the technology you use and the potential impact an interruption could have on your operations.

What are the risks to your business, employees and customers that cyber insurance can help cover?

Cyberattacks Are Not Just a Large-Business Problem

Many small and midsized businesses assume cybercriminals are primarily interested in large corporations. In reality, smaller businesses can be attractive targets because they may have fewer cybersecurity resources, limited employee training and outdated technology.

A cyber incident could begin with something as simple as:

• An employee clicking a fraudulent email link
• A stolen laptop or mobile device
• A weak or reused password
• An unauthorized wire transfer request
• An infected email attachment
• A compromised vendor or software provider
• A ransomware attack that locks employees out of company systems

Even businesses that do not consider themselves technology companies may store sensitive customer, employee or financial information that could be valuable to criminals.

Types of Businesses That May Need Cyber Insurance

Cyber insurance can be important for nearly any business that uses email, accepts electronic payments or stores information digitally, including but not limited to:

• Accounting firms
• Contractors
• Consultants
• Healthcare practices
• Law firms
• Manufacturers
• Nonprofit organizations
• Professional service companies
• Real estate agencies
• Restaurants and retailers
• Schools and childcare centers
• Small offices
• Technology companies
• Wholesalers and distributors

Cyber insurance is not only for companies that collect credit card numbers or Social Security numbers. Your business may also face cyber risk if it maintains employee files, customer contact information, banking records, proprietary business information or login credentials.

Your level of risk can depend on several factors, including the type and amount of information you store, the number of employees with system access, your cybersecurity practices and how dependent your business is on technology.

Insurance companies may review these risk factors, along with the security measures your business has implemented, when determining your eligibility, pricing and coverage options.

What Does Cyber Insurance Cover?

Cyber insurance is designed to help businesses respond to data breaches, cyberattacks, fraudulent transactions and other technology-related incidents.

Policies vary significantly between insurance companies. A typical cyber insurance policy may include some combination of the following coverage:

Data Breach Response

This coverage can help pay the costs associated with investigating and responding to a breach involving confidential customer or employee information.

Covered expenses may include forensic investigations, legal guidance, customer notification, credit monitoring and identity restoration services.

Cyber Extortion and Ransomware

Cyber extortion coverage can help your business respond when a criminal demands payment to restore access to your systems, prevent the release of information or stop another threatened attack.

Coverage may include access to cybersecurity specialists, negotiation services and certain ransom payments when permitted by law and approved by the insurance company.

Business Interruption

A cyberattack can bring your operations to a halt. Cyber business interruption coverage can help replace income your company loses when a covered cyber incident prevents you from operating normally.

It may also help cover certain additional expenses incurred while restoring systems and resuming business operations.

Data and System Restoration

A cyber incident may damage, delete or encrypt important files and software.

Data restoration coverage can help pay the cost of recovering or recreating electronic information and restoring damaged computer systems following a covered event.

Social Engineering and Funds Transfer Fraud

Cybercriminals frequently impersonate customers, vendors, executives or financial institutions to convince employees to send money or change payment instructions.

Depending on the policy, cyber insurance may include coverage for certain financial losses caused by fraudulent emails, deceptive payment requests or unauthorized electronic transfers.

This coverage may be subject to lower limits, specific verification requirements and separate deductibles.

Network Security Liability

If a cybersecurity failure at your business causes harm to a customer, vendor or another organization, network security liability coverage may help pay legal defense costs, settlements or judgments.

This could apply when your systems unknowingly spread malicious software, allow unauthorized access to information or contribute to another party’s financial loss.

Privacy Liability

Privacy liability coverage can help protect your business if confidential personal or corporate information is exposed, accessed without authorization or improperly handled.

It may help cover lawsuits and claims alleging that your company failed to protect sensitive information.

Regulatory Defense and Penalties

Businesses may face investigations after a data breach or privacy incident.

Cyber insurance may help pay certain legal costs, regulatory defense expenses and eligible fines or penalties, where coverage is permitted by law.

Crisis Management and Public Relations

A highly publicized cyber incident can harm the trust your business has built with customers and the community.

Cyber insurance may help cover public relations, communications and reputation management services following a covered event.

Additional Optional Coverage

Additional coverage may be available depending on your insurance company, industry and cybersecurity risks.

Options may include:

• Technology errors and omissions
• Media liability
• Computer fraud
• Telecommunications fraud
• Bricking coverage for damaged equipment
• Dependent business interruption
• Reputational income loss
• Invoice manipulation
• Cryptojacking
• Cybercrime reward expenses

Because cyber policies differ significantly, it is important to review the definitions, exclusions, sublimits and security requirements included in each proposal.

Does General Liability Insurance Cover Cyberattacks?

Business owners sometimes assume their general liability or business owners policy will cover a cyberattack. However, traditional business insurance policies may provide little or no coverage for many cyber-related losses.

General liability insurance is primarily designed to address claims involving bodily injury, property damage and certain personal or advertising injuries. It is generally not designed to cover the costs of restoring data, notifying affected customers, responding to ransomware or recovering lost income after a system outage.

Some business policies may include a small amount of data breach or cyber coverage. However, these endorsements may have limited protection and may not provide the broader response services available through a dedicated cyber insurance policy.

A standalone cyber policy can provide more specialized coverage and access to experienced cybersecurity, legal and crisis-response professionals.

Does Cyber Insurance Cover Employee Mistakes?

Potentially, yes.

Many cyber incidents are caused by human error rather than a sophisticated technical attack. An employee may click a malicious link, send confidential information to the wrong person, lose a company laptop or follow fraudulent payment instructions.

Cyber insurance may cover certain incidents caused by employee mistakes, subject to the terms and conditions of the policy.

However, coverage may be affected by the cybersecurity procedures your company has in place. Insurance companies increasingly ask businesses to use protections such as multifactor authentication, regular backups, employee security training and payment verification procedures.

What Cybersecurity Measures May Be Required?

Cyber insurance companies may ask detailed questions about how your business protects its systems and information.

You may be asked whether your company uses:

• Multifactor authentication
• Endpoint detection and response software
• Antivirus and firewall protection
• Regular data backups
• Offline or separate backup storage
• Email security and filtering
• Employee cybersecurity training
• Strong password requirements
• Software updates and security patches
• Formal incident response procedures
• Payment and wire-transfer verification processes
• Restricted administrative access
• Vendor and third-party security controls

Your answers can affect whether coverage is offered, the amount of coverage available and the price of the policy.

It is important to answer all cyber insurance application questions accurately. If your business states that a security measure is being used, that protection should be fully implemented and maintained.

How Much Cyber Insurance Does a Business Need?

There is no single coverage amount that is right for every business.

A small professional office may have different cyber risks than a healthcare provider, manufacturer, retailer or company that processes thousands of customer transactions.

When determining an appropriate coverage limit, consider:

• The amount and type of sensitive information you store
• The number of customer and employee records you maintain
• Your annual revenue
• The cost of notifying affected individuals
• Your dependence on computer systems
• The potential income lost during an interruption
• Your contractual requirements
• The cost of legal and forensic services
• The amount of money your business transfers electronically
• The cybersecurity risks created by vendors and service providers

Many cyber policies also contain sublimits for specific losses, such as social engineering, funds transfer fraud, cybercrime or system restoration. The overall policy limit may not be available for every type of claim.

An independent insurance agent can help you compare the limits, sublimits, deductibles and coverage terms offered by different insurance companies.

How Holley Insurance Can Help

Cyber insurance is one of the fastest-changing areas of business insurance. Coverage terms, security requirements and available options can vary widely from one insurance company to another.

An independent insurance agency like Holley Insurance can help you evaluate your cyber risks and compare coverage from multiple insurance carriers.

We will take the time to learn how your business operates, what information you store and how you use technology.

We may ask questions such as:

• What type of business do you operate?
• How many employees have access to your systems?
• What customer or employee information do you store?
• Do you accept credit cards or electronic payments?
• Does your business send or receive wire transfers?
• Do you use multifactor authentication?
• How frequently is your data backed up?
• Where are your backups stored?
• Do employees receive cybersecurity training?
• Would your business be able to operate if its systems were unavailable?
• Do your contracts require cyber insurance?
• Have you experienced a previous cyber incident or data breach?

These questions help us identify potential coverage gaps, provide accurate information to insurance companies and find cyber insurance options that fit your business.

If you are looking for cyber insurance in Virginia, or if you already have coverage but are unsure whether it provides adequate protection, Holley Insurance will give you an open and honest assessment.

We are your friends in insurance, and we are here to help protect the business you have worked so hard to build.

Request a Cyber Insurance Proposal

A cyber incident can happen quickly, but the financial and reputational effects may last much longer.

Contact Holley Insurance today to review your risks and request a cyber insurance proposal for your Virginia business.