Most small-business cyber claims aren't sophisticated attacks. They're a clicked link, a payment wired to a spoofed vendor, or a laptop left in a car. Cyber liability pays for the response and the fallout — and the response is usually the expensive part.
Cyber splits into what an incident costs you and what you end up owing other people. Here's each piece in plain English.
Negotiation, the payment where it is lawful to make one, and the specialists who handle it. Paying is rarely the first option, and a good policy funds the alternatives too.
The forensics firm that works out what happened, the lawyers who tell you what must be disclosed, and the notifications themselves. This is the piece most businesses underestimate.
Rebuilding data and systems that were corrupted or encrypted. Note this is your data — replacing hardware is a property claim.
Income lost while you're down, plus the extra cost of working around it. Watch the waiting period; many policies won't respond to an outage of only a few hours.
Claims from customers, patients or partners whose information was exposed on your watch, including the cost of defending those claims.
Fines and assessments where they are insurable, and the cost of responding to a regulator. If you take cards, PCI penalties are a distinct exposure worth confirming is included.
The spoofed-invoice wire transfer. Frequently a sub-limit rather than the full policy limit, and sometimes sold on a crime policy instead — worth checking which one you actually hold.
The NY SHIELD Act requires reasonable safeguards for New York residents' private information and sets breach notification duties. A cyber policy funds meeting them; it doesn't remove the duty.
Answered the way we'd answer them on the phone.
Small businesses get targeted precisely because the controls are thinner. The number that hurts isn't the ransom, it's the response — forensics, lawyers and notification add up quickly even for a business with a few thousand customer records.
Sometimes, and it's the question worth asking before you buy. That's social engineering or funds transfer fraud, often a sub-limit well below the headline number, or sitting on a crime policy instead. We'll show you which form yours is on.
Increasingly, controls rather than promises: multi-factor authentication on email and remote access, offline backups you have actually tested, and endpoint protection. Answer the application accurately — a control you claimed but don't have becomes a coverage problem at claim time.
Yes. Using a cloud provider moves where the data sits, not who owes your customers a duty of care. Notification obligations and third-party claims still land on you when the exposed records are yours.
Tell us roughly how many records you hold, whether you take card payments, and what security controls are in place. A licensed NY agent will shop it and flag any control likely to hold the quote up.