The Cyber Risk Reality
Most small business owners think cyberattacks only target large corporations. The data says otherwise:
- 43% of cyberattacks target small businesses (Verizon Data Breach Report)
- 60% of small businesses that suffer a cyberattack close within 6 months
- The average breach cost for a small business: $120,000-$150,000
- 91% of cyberattacks begin with a phishing email — something every business receives daily
A single phishing email, a ransomware infection, or a data breach can generate costs that dwarf most small businesses' cash reserves. Cyber insurance is the safety net.
What Cyber Insurance Actually Covers
First-Party Coverages (Your Costs)
- Breach notification: All 50 states require businesses to notify affected individuals after a data breach. This alone can cost $50-$150 per record.
- Forensic investigation: Determining what happened, what was accessed, and how to prevent it from happening again.
- Credit monitoring: Providing affected individuals with identity theft monitoring services.
- Business income loss: Revenue lost while your systems are down or your operations are disrupted.
- Data restoration: Rebuilding corrupted or destroyed data from backups.
- Ransomware payments: Including negotiation specialists and the payment itself if necessary.
- Crisis management: PR and reputation management to control the damage.
Third-Party Coverages (Claims Against You)
- Liability for data you held: If client data is breached, those clients can sue you.
- Regulatory fines and penalties: HIPAA, PCI-DSS, state privacy laws all carry financial penalties.
- Legal defense: Attorney costs to defend against lawsuits and regulatory actions.
- Settlements and judgments: Payments to resolve claims.
Who Needs Cyber Coverage
The short answer: every business. The longer answer includes any business that:
- Stores customer personal information (names, addresses, SSNs, financial data)
- Accepts credit or debit card payments
- Uses email (phishing is the #1 attack vector)
- Has employees who access systems remotely
- Relies on computer systems for daily operations
- Has a website that collects any user information
In practice, this describes virtually every business operating today. The only businesses without cyber exposure are the ones with zero digital presence — and those essentially do not exist anymore.
The Agent Opportunity
Cyber insurance is one of the fastest-growing lines in commercial insurance — and one of the least penetrated. Only about 20-30% of small businesses carry cyber coverage. This means 70-80% of your commercial clients likely have no cyber protection.
Every commercial gap analysis should include a cyber coverage question: "Do you have cyber liability coverage?" When the answer is no — and it usually is — you have an immediate opportunity to add meaningful protection and demonstrate consultative value.
The conversation: "If someone hacks your email or steals your customer data, the legal costs alone could be $100,000+. A cyber policy covering $1M costs about $1,000-$3,000 per year. It is one of the most affordable commercial coverages relative to the exposure it addresses."
Why CGL Does Not Cover Cyber
A common misunderstanding: business owners (and some agents) believe their CGL policy covers cyber events. It does not. CGL policies contain specific exclusions for electronic data, cyber incidents, and most privacy-related claims. Some BOP policies include limited cyber endorsements, but these typically cap at $25,000-$100,000 — a fraction of what a real breach costs.
Standalone cyber policies are the only adequate solution for meaningful cyber protection. Agents who explain this distinction clearly win clients who thought they were covered — and were not.