The Complete Cyber Insurance Guide 2026
A consultative guide for healthcare practices, e-commerce brands, and tech/SaaS companies navigating cyber coverage, breach response, and the state privacy law patchwork. Written by Bobby Friel and the Direct Insurance Services team.
Bobby Friel
Partner, Direct Insurance Services
Watch: Cyber Insurance Explained
What cyber actually covers, where the gaps hide, and what carriers now require — in under 2 minutes.
In This Guide
When your data walks out the door, your general liability policy is going to hand you a denial letter — and the bill is going to be bigger than any claim your business has ever faced.
Cyber insurance is unlike any other commercial coverage you own. Property policies respond to physical damage. General liability responds to bodily injury and property damage to third parties. Workers comp responds to employee injuries. None of those policies were designed to handle a world where the most valuable thing your business holds — your data, your customer relationships, your operational uptime — can be stolen, locked, or leaked without anyone setting foot on your premises.
The result: most business owners carry cyber policies they have never read, with sub-limits they don't know exist, conditioned on security controls they can't fully document, and retroactive dates that quietly wipe out coverage every time they switch carriers. This guide exists because Patrick, Bobby, and our team review cyber policies every week — and we see the same preventable gaps in three out of four submissions. Let's fix that.
Who This Guide Is For
- Healthcare practices and medical groups handling protected health information (PHI) under HIPAA — primary care, dental, specialty, therapy, and telehealth — where a single breach triggers OCR inquiry, mandatory notification, and state-law exposure
- E-commerce brands processing card data under PCI-DSS, running Shopify, WooCommerce, BigCommerce, or custom storefronts, where a Magecart skimmer or checkout-provider compromise can erase revenue for weeks
- Tech and SaaS companies protecting source code, customer data, and uptime commitments, where a breach triggers SLA penalties, customer churn, and acquisition-blocking diligence findings
- Businesses subject to overlapping state privacy laws — CCPA, VCDPA, TDPSA, CPA, BIPA, My Health My Data Act, CUPA, TIPA — where regulatory defense costs alone can exceed most businesses' first-party losses
Case Study: How a Single Email Cost $1.8M
The scenario below is illustrative and composite — built from patterns we see repeatedly in healthcare cyber claims. Dollar amounts reflect realistic response costs in 2025-2026. Identifying details have been removed.
A 12-provider Phoenix-area primary care and internal medicine practice — roughly 28,000 active patient records, three locations, and a cloud-hosted EHR — received what looked like a routine vendor invoice in the practice manager's inbox on a Thursday afternoon. The invoice was a spear-phishing payload. The practice manager opened the attachment. Within 36 hours, a ransomware operator had exfiltrated a copy of the patient database, encrypted the practice's local servers, and posted a demand for $650,000 in cryptocurrency.
The practice's IT provider discovered the encryption Friday morning. The EHR was still accessible through the cloud vendor, but the local file shares, imaging archive, and billing systems were locked. The practice called breach counsel — an OCR-experienced firm on their cyber carrier's panel — and activated the incident response plan. Forensic investigators were on site by Saturday morning. Total forensics and incident response cost: $340,000. That work confirmed both encryption and data exfiltration, which under HIPAA triggered mandatory notification to every patient whose PHI may have been compromised.
Notification costs — mailing, call center staffing, and two years of credit monitoring for 28,000 patients — came to $420,000. Breach counsel fees, substitute notice publication, and OCR liaison work added another $195,000. The HIPAA regulatory defense, including the OCR inquiry response and corrective action plan negotiation, ran $75,000 through the first year (with ongoing compliance costs still accruing). State attorney general inquiries from Arizona and two additional states where patients resided added $48,000 in defense costs.
The practice operated at reduced capacity for 11 business days while systems were restored from backups and revalidated. Business interruption loss — cancelled appointments, lost procedure revenue, payroll continuing during the outage, and extra expense for a temporary workstation lease — totaled $380,000. Data restoration and rebuild of the local infrastructure added $125,000. A ransomware payment was ultimately not made because clean backups were recovered — but the extortion negotiation, decryption validation, and dark-web monitoring still generated $60,000 in cyber extortion response costs. PR and reputation management ran $82,000. Patient class-action notice and initial defense through the first 90 days cost $75,000.
Total first-year response cost: approximately $1.8 million. Had this practice carried a $500,000 cyber policy — the limit many smaller practices still buy — more than $1.3 million would have been uninsured. Because they carried $3 million in cyber limits with prior acts coverage, proper regulatory defense language, and a social engineering endorsement covering the BEC vector, the policy responded in full.
This scenario is realistic. It is not worst-case — a practice that paid the ransom, had stale backups, or failed to document its security controls could easily see a number well north of $2.5 million. The policy structure your practice carries determines whether a claim like this is a manageable disruption or a business-ending event.
What Cyber Insurance Actually Covers
A modern cyber policy is not a single coverage — it is a stack of six interlocking coverage parts, each with its own triggers, sub-limits, conditions, and exclusions. Here is how each piece works, what it won't do, and how we size it during policy review.
🚨 Data Breach Response
What it covers: The end-to-end response to a confirmed or suspected data breach. That includes forensic investigation, breach counsel (legal guidance on notification obligations), customer notification costs, credit monitoring or identity theft protection for affected individuals, substitute notice publication where required, call center staffing, and public relations support during the incident. This is the first coverage part most cyber claims actually draw against — it responds from the first hour of the incident through the close-out period.
What it doesn't cover: Ransomware payments (that is cyber extortion), lost revenue during downtime (that is business interruption), lawsuits brought by affected customers (that is privacy liability), or regulatory fines (that is regulatory defense). Breach response is the trigger — the other coverage parts respond depending on what happens next.
Typical limit structure: Often shared with the policy aggregate, with internal sub-limits on notification (frequently expressed per affected individual), credit monitoring duration (12 or 24 months), and call center hours. For record-heavy businesses, notification sub-limits become the binding constraint.
Real scenario: An online retailer discovers a Magecart skimmer on their checkout page that has been scraping card data for six weeks. Breach response pays $180,000 for forensic investigation, breach counsel, notification of 14,000 affected customers, and 12 months of credit monitoring. Without breach response coverage, that cost is out-of-pocket before any of the downstream claim pieces are even addressed.
🔒 Cyber Extortion & Ransomware
What it covers: Ransom payments (where legally permissible), ransomware negotiation services, cryptocurrency procurement, decryption validation, dark-web monitoring for exfiltrated data, and extortion demand response regardless of whether a payment is ultimately made. The coverage also typically includes the costs of forensic firms specialized in ransomware containment and recovery.
What it doesn't cover: Ransoms paid to sanctioned entities (OFAC designations may make payment illegal), ransoms paid without carrier pre-approval on many policies, and business interruption loss during the ransomware outage (covered under cyber BI). Some policies also exclude payments to threat actors linked to state-sponsored groups.
Typical limit structure: Most commonly a sub-limit of the aggregate — often 25% to 100% of the policy limit depending on carrier. Nearly all carriers now condition full extortion coverage on documented security controls: MFA, EDR, tested backups, and an incident response plan.
Real scenario: A 40-person SaaS company is hit with ransomware that encrypts their production database. Cyber extortion pays for the negotiation firm, the forensic incident response team, and the ultimate ransom payment (validated against OFAC sanctions lists). Clean backups are later used in parallel, but the extortion response still runs $240,000 through the negotiation alone.
📉 Business Interruption (Cyber)
What it covers: Lost net income and continuing operating expenses (payroll, rent, fixed costs) during a covered cyber event that renders your systems unusable. Most modern policies also include dependent business interruption — coverage when a critical third-party vendor (cloud provider, SaaS platform, payment processor) suffers an outage that stops your operation. Extra expense coverage pays for temporary workstations, third-party processing, and manual workarounds during the outage.
What it doesn't cover: Losses during the policy's waiting period (usually the first 6 to 24 hours), voluntary system shutdowns not tied to a covered event, or BI from causes not covered elsewhere on the policy (e.g., a power outage with no cyber element). Dependent BI typically requires the vendor outage to arise from a cyber event on the vendor's side, not just any unavailability.
Typical limit structure: Shared with the aggregate, with a stated waiting period (hours) and a maximum indemnity period (usually 90 to 180 days). Dependent BI is often a sub-limit of the main BI coverage.
Real scenario: An e-commerce brand's payment processor suffers a 14-hour outage during Black Friday weekend. The brand's own systems are fine — but checkout is broken. Dependent BI pays for the estimated lost revenue attributable to the vendor outage, minus the policy waiting period. Without dependent BI, the brand absorbs the entire loss.
🛡️ Network Security Liability
What it covers: Third-party claims arising from a failure of your network security — transmission of malware to a customer, denial-of-service attacks launched from your compromised infrastructure, unauthorized access that damages a customer's system, or the failure to prevent the compromise of a connected partner network. This is the liability side of a security failure, as opposed to the liability side of a data privacy failure (that is privacy liability).
What it doesn't cover: Physical damage to third-party property arising from cyber events (many policies exclude cyber-physical bridge claims), claims arising from intentional acts, or claims arising from infrastructure operated by an excluded vendor. Pay attention to the “failure of security” definition — some policies require proof of specific control failures, which can complicate coverage.
Typical limit structure: Generally shares the aggregate with privacy liability as a combined “cyber liability” limit. For technology companies and SaaS vendors, higher limits and specific endorsements for media liability and professional services can be added.
Real scenario: A managed service provider's network is compromised, and the attacker uses that access to deploy ransomware to three of the MSP's clients. Each client sues for breach response costs and downtime losses. Network security liability responds to the client claims against the MSP.
🕵️ Privacy Liability
What it covers: Third-party claims arising from the unauthorized access, disclosure, or misuse of personally identifiable information (PII), protected health information (PHI), or other protected data you hold. This includes class-action lawsuits under state privacy laws, individual consumer claims, and claims from business partners whose data you held as a custodian. Defense costs are typically included within or in addition to the limit depending on the policy form.
What it doesn't cover: Regulatory fines and penalties (that is regulatory defense coverage), claims arising from violations your business knowingly permitted, or BIPA-specific claims on policies with a biometric privacy exclusion. Pay close attention to the definition of “personal information” — narrow definitions can exclude biometric, behavioral, and inferred data elements.
Typical limit structure: Usually combined with network security liability under a single third-party limit equal to the aggregate. Defense-within-limits versus defense-outside-limits is a material term to check — defense-outside-limits preserves indemnity for settlements and judgments.
Real scenario: A tech company's misconfigured cloud storage bucket exposes 180,000 customer records for three weeks. A class action is filed in California under CCPA's private right of action for reasonable security failure. Privacy liability responds to defense costs and ultimate settlement.
⚖️ Regulatory Defense & Penalties
What it covers: Defense costs and, where insurable by law, fines and penalties assessed by regulators investigating a covered cyber or privacy incident. That includes HHS Office for Civil Rights investigations under HIPAA, state attorney general inquiries under consumer privacy statutes, FTC investigations, and PCI Security Standards Council assessments. Some policies also include defense for SEC cybersecurity disclosure matters for public companies and certain regulated entities.
What it doesn't cover: Fines deemed uninsurable in the applicable state (punitive fines are sometimes excluded), fines arising from willful violations, and criminal penalties. The insurability of privacy fines varies by state — most states permit coverage, but a handful restrict it.
Typical limit structure: Commonly a sub-limit of the aggregate, with a separate retention. For multi-state operations, confirm the coverage extends to each applicable statute — CCPA/CPRA, VCDPA, TDPSA, CPA, BIPA, My Health My Data Act, CUPA, TIPA, HIPAA, and PCI.
Real scenario: A healthcare group's breach affects patients in California, Virginia, and Texas. Three state attorneys general open inquiries in addition to the OCR matter. Regulatory defense pays legal fees across all four proceedings and the insurable portion of the eventual settlement. Without multi-state regulatory coverage, defense alone can run into six figures per jurisdiction.
8 Mistakes That Expose Your Business
These are the eight most common gaps we find in cyber policy reviews across healthcare, e-commerce, and tech. Each one is preventable. Each one, left unaddressed, can convert a manageable claim into an uninsured loss.
Does your cyber policy actually cover ransomware — or is it sub-limited and conditioned on security controls you may not have?
Over the past three renewal cycles, carriers have quietly rewritten their ransomware coverage. Many policies now carry a sub-limit on cyber extortion that is a fraction of the aggregate — sometimes 25% or less — and that sub-limit is often conditioned on specific security controls: multi-factor authentication everywhere, endpoint detection and response, air-gapped backups, and a tested incident response plan. If you attested to those controls on your application and you don't actually have them, the carrier can deny the ransomware portion of the claim even while paying the breach response. Most business owners never read the warranties on their cyber application. We do — line by line — before you sign.
How we fix this: Before your next renewal, we map every security control your carrier assumes you have against what your IT team or MSP can actually document. Where there's a gap, we either close it before binding or rewrite the application so the policy terms match reality. A policy you can actually collect on is worth more than one that quotes 10% cheaper on the surface.
In reviews we ran across healthcare and e-commerce clients in 2025, roughly 4 out of 10 cyber applications contained security attestations the client could not fully support if a claim were investigated.
What happens if your BEC loss is excluded because you didn't have the social engineering endorsement?
Business email compromise is the most common cyber claim we see — an attacker impersonates a vendor or executive, convinces the accounting team to wire funds to a fraudulent account, and the money is gone before anyone notices. Here's the problem: most base cyber policies cover the breach, the forensics, and the notification costs, but not the wire transfer loss itself. Coverage for funds transferred voluntarily at the direction of an impostor requires a specific social engineering fraud endorsement, and that endorsement typically has its own sub-limit that is often a fraction of the cyber aggregate. Without it, a six-figure wire fraud loss is uninsured even though you carry $3M in cyber coverage.
How we fix this: Add a social engineering fraud endorsement with a limit that matches your largest realistic wire exposure. Pair it with a documented payment verification protocol — callback verification for any wire change request — because most carriers will reduce or deny BEC claims where the client failed to follow a basic verification step.
Median BEC loss across our small-business book over the past 24 months sits between $40,000 and $180,000. Most of those clients did not carry adequate social engineering sub-limits when the loss occurred.
Does your business interruption trigger for cyber events, or only for physical damage?
This is one of the most misunderstood coverage gaps in commercial insurance. Traditional business interruption coverage on a property policy is triggered by physical damage to covered property — a fire, a burst pipe, a windstorm. A ransomware attack that takes your network offline for a week does not involve physical damage, so the property BI does not respond. You need cyber business interruption — a separate coverage part on a cyber policy — to pay for lost revenue, extra expense, and dependent business interruption (where your cloud provider or key vendor suffers an outage). Many policies carry a waiting period of 8, 12, or even 24 hours before BI coverage begins, which meaningfully reduces the payout on short outages.
How we fix this: We review your cyber policy's business interruption coverage against a realistic downtime scenario for your operation. What does 48 hours offline actually cost you in revenue, payroll, and extra expense? What's the waiting period on your current policy? Does dependent business interruption cover your cloud and SaaS vendors by name? These questions get answered before you bind, not after an outage.
For e-commerce brands we underwrite, each hour of downtime during peak season commonly translates to 5-figure revenue loss. A 12-hour waiting period can erase the first full day of the claim.
If your third-party vendor breach leaks customer data, who's on the hook for notification costs?
You collect customer data. You hand it to a SaaS vendor — a CRM, an email marketing platform, a payroll provider, a billing processor. That vendor gets breached. Your customer data is exposed. Under almost every state privacy law in the United States, the obligation to notify affected customers falls on you — the data controller — not the vendor that suffered the breach. Most business owners assume the vendor's cyber policy will pay for notification, credit monitoring, and regulatory defense on your behalf. In practice, vendor policies cover the vendor's own obligations; your notification and regulatory costs come out of your cyber policy. If your policy's sub-limits on notification and credit monitoring are low, you discover the gap at the worst possible time.
How we fix this: We inventory every third-party vendor that touches customer data, confirm your cyber policy's dependent business interruption and vendor breach language covers each one, and verify your notification and credit monitoring sub-limits are sized for your full record count — not just your direct exposure.
In healthcare and e-commerce, vendor-caused breaches now account for roughly 60% of reported incidents. Most clients with a vendor-side breach discover sub-limit issues within 72 hours of learning about the incident.
Has anyone mapped your state privacy law exposures (CCPA, VCDPA, TDPSA, BIPA, etc.) to your policy language?
The state privacy law landscape in 2026 is a patchwork. California (CCPA/CPRA), Virginia (VCDPA), Texas (TDPSA), Colorado (CPA), Illinois (BIPA), Washington (My Health My Data Act), Utah (CUPA), Tennessee (TIPA), and a growing number of other states have enacted consumer privacy or biometric privacy statutes — each with its own definitions, private rights of action, statutory damages, and attorney general enforcement authority. Your cyber policy's regulatory defense coverage needs to extend to every state where you have customers, not just your headquarters state. BIPA in particular has generated massive class-action exposure for biometric data (facial recognition, fingerprints, voiceprints) — and some carriers have specifically excluded BIPA from their cyber policies.
How we fix this: Our review includes a state-by-state privacy law exposure map based on where your customers and employees actually are. We confirm your regulatory defense coverage extends to every applicable statute — including BIPA, CCPA private right of action, and the My Health My Data Act. Where exclusions exist, we negotiate removal or document the gap so you see it in writing.
Our 2025 cyber renewal reviews found roughly 30% of policies contained a BIPA or biometric privacy exclusion the client was not aware of.
Does your policy's retroactive date cover claims from incidents that already happened but haven't surfaced?
Cyber insurance is written on a claims-made basis. That means the policy responds to claims first reported during the policy period, subject to a retroactive date that determines how far back into your operational history the coverage reaches. If a breach actually occurred six months ago but was not discovered until last week, the policy in force today must have a retroactive date that predates the breach — otherwise the claim is excluded. When clients switch carriers, we often see the new retroactive date default to the new policy's inception, which effectively wipes out coverage for any undiscovered breach from the prior policy period. IBM's cost of a data breach studies consistently find average dwell time — the time between compromise and discovery — of around 200 days.
How we fix this: We insist on full prior acts coverage at every cyber renewal, or at minimum a retroactive date matching your original cyber policy inception. Where the new carrier refuses full prior acts, we evaluate extended reporting period (tail) options on the expiring policy to avoid a gap.
Average time from breach to discovery exceeds 200 days across most industries. If your retroactive date moves forward at renewal, more than half a year of your actual breach exposure becomes uninsured.
What happens when your panel-counsel clause prevents you from using your preferred breach lawyer?
Every cyber policy contains a panel counsel clause — a list of pre-approved breach counsel, forensic firms, public relations vendors, and credit monitoring providers the carrier has negotiated rates with. When a claim hits, the carrier typically requires you to use a firm from their panel. That is not inherently bad — panel firms have experience and rates are capped — but if your business has an existing relationship with specific breach counsel (for example, healthcare clients who have worked with the same OCR-defense firm for years), forcing you onto a different firm at the worst possible moment creates real operational friction. Some policies allow off-panel counsel with carrier consent; others are strict.
How we fix this: During policy review, we ask whether you have a preferred breach lawyer or forensics firm. If yes, we either negotiate that firm onto the panel before binding, confirm off-panel consent language is flexible, or document the trade-off so you make an informed choice. This is not a deal-breaker for most clients — but it should be a known decision, not a surprise.
Most cyber claims we see resolve faster when the insured has an established relationship with breach counsel before the incident. Panel-counsel conflicts can add days to initial response — which on a ransomware claim is expensive time.
If your cyber BI waiting period is 12+ hours, what's your actual business continuity cost?
Cyber business interruption coverage almost always includes a waiting period — a deductible expressed in hours, not dollars. The policy does not begin paying BI loss until after that waiting period expires. Common waiting periods are 6, 8, 12, or 24 hours. For an e-commerce brand doing $100,000 per day in revenue, a 12-hour waiting period means the first $50,000 of BI loss is your responsibility every time. For a medical practice running a full schedule, it might mean an entire day of visits is uninsured. Shorter waiting periods cost more in premium but can be worth it for operations where every hour of downtime hits revenue.
How we fix this: We run a downtime cost calculation specific to your operation — average hourly revenue, payroll continuing through the outage, extra expense to restore operations — and size the waiting period accordingly. Where it makes financial sense, we buy down the waiting period; where your operation can absorb the first several hours, we leave it longer and spend the premium elsewhere.
For healthcare practices and e-commerce brands, shortening the BI waiting period from 12 hours to 6 hours typically costs a modest premium increase but roughly doubles the effective BI recovery on a typical outage.
Healthcare, E-Commerce, & Tech-Specific Guidance
Cyber coverage is never one-size-fits-all. The risk profile of a 10-provider healthcare practice is fundamentally different from a direct-to-consumer e-commerce brand, which is fundamentally different from a B2B SaaS platform. Here is how we tailor cyber coverage by industry.
🏥 Healthcare Practices
Healthcare is the highest-exposure industry in cyber for three reasons: the data is the most valuable on the dark market, HIPAA creates mandatory notification obligations with short timelines, and OCR enforcement has grown materially more aggressive. A breach involving protected health information (PHI) triggers a cascade of obligations — individual notification within 60 days, HHS notification, media notice for breaches affecting 500 or more individuals in a state, state attorney general notification in most jurisdictions, and often a multi-year OCR corrective action plan.
Vendor risk. Most healthcare breaches we see now originate at a vendor — the EHR platform, the billing service, the transcription provider, the laboratory integration. Business associate agreements (BAAs) allocate some responsibility, but the covered entity (your practice) remains on the hook for notification under HIPAA. Your cyber policy must include dependent business interruption and vendor breach coverage sized to your full patient record count, not just your internal systems.
Telehealth and remote access. The expansion of telehealth since 2020 introduced new attack surface — home networks, personal devices, and video platforms integrated with EHRs. Carriers are increasingly asking about telehealth-specific controls: how you authenticate patients, how sessions are recorded and stored, and how you secure clinician access from non-office locations.
Ransomware in healthcare. Threat actors know healthcare practices cannot operate without access to records, so ransomware demands are higher and pressure to pay is stronger. Clean, tested, segregated backups are the single most important control — and the control carriers audit most closely during claims. Our team walks through your backup and restoration plan with your IT provider before the application goes to market.
Biometric data. Practices using biometric patient identification, voice analysis, or AI-assisted diagnostics should verify their policy does not exclude BIPA or biometric privacy claims. Illinois plaintiffs have extended BIPA theories into the healthcare space, and coverage for biometric claims is not uniform across carriers.
🛒 E-Commerce Brands
E-commerce cyber risk is dominated by three patterns: card data compromise via checkout-page skimmers (Magecart and its successors), customer data exfiltration from e-commerce platforms, and revenue loss during outages or payment processor disruptions. A brand processing cards has obligations under PCI-DSS that run alongside — and often in conflict with — state consumer privacy obligations.
PCI-DSS exposure. A confirmed card data breach triggers mandatory forensic investigation by a PCI Forensic Investigator (PFI), card brand assessments (Visa, Mastercard, and others), potential card brand fines, mandatory notification to acquirers, and often a mandatory upgrade to PCI compliance level. Your cyber policy should include PCI DSS assessments as a named covered cost — and the sub-limit should reflect your realistic card volume, not a token amount.
Checkout-provider risk. Most e-commerce brands do not operate their own card processing — they integrate with a payment provider, a checkout page, or a hosted payment form. When the provider is compromised, the brand still owns the customer relationship and still has notification obligations. Dependent business interruption and vendor breach coverage must be structured for this dependency.
Peak-season downtime. An e-commerce brand doing a meaningful share of annual revenue in November and December cannot tolerate a 12-hour BI waiting period during that window. We model your hourly revenue across the year and right-size the waiting period for your peak exposure — often buying down the waiting period during high-revenue quarters.
Customer data exfiltration. Beyond cards, e-commerce brands hold email addresses, shipping addresses, purchase history, and sometimes behavioral and biometric data (for fraud detection). A pure customer data breach — no cards involved — still triggers state privacy law notification obligations in nearly every state. Your privacy liability and regulatory defense coverage should extend to every state where your customers reside.
💻 Tech & SaaS Companies
Tech and SaaS companies carry a different cyber risk profile: the assets at risk are not just customer records but source code, internal intellectual property, and the operational uptime you have contractually committed to customers via service-level agreements. A cyber incident at a SaaS company is simultaneously a first-party problem (your data, your systems) and a third-party problem (your customers' data, your customers' uptime).
Intellectual property and source code exposure. A breach that exfiltrates source code, pre-release roadmap data, or proprietary algorithms creates competitive and valuation harm that cyber policies often handle unevenly. Some policies include IP restoration and recovery; others carve it out. We ask this question explicitly during review.
Customer data breach as a SaaS vendor. When your customers use your platform, they hand you their data. A breach of your platform exposes their data, which triggers their notification obligations, which triggers their claims against you. Your network security liability and privacy liability limits should reflect the aggregate downstream exposure — not just your own.
SLA penalties and downtime commitments. SaaS SLAs typically promise 99.9% uptime or better, with service credits or contractual damages for missed availability. A cyber incident that blows through your SLA window creates direct contractual exposure. Some cyber policies explicitly exclude contractual liability, which can strip SLA-related losses from coverage. We read the contractual liability exclusion carefully and, where needed, negotiate carve-backs.
Acquisition and diligence readiness. Tech companies anticipating an acquisition, a funding round, or a strategic investment face an increasingly thorough cyber diligence process. Buyers now expect evidence of a live, well-structured cyber policy, documented incident response plan, and clean incident history. Our team pre-stages cyber coverage for clients preparing for a transaction — both to meet buyer expectations and to avoid surprise exclusions in the final deal.
Tech E&O integration. Most tech companies should carry a combined Tech E&O and Cyber policy — one integrated form that covers both professional services failures and cyber events, eliminating coverage gaps between two separate policies. We evaluate stand-alone vs. integrated structures based on your customer contracts and risk profile.
Cost Drivers: What Really Changes Your Premium
Cyber pricing is not a rate card. Two businesses in the same industry with the same revenue can be quoted at very different premiums — or one of them can be declined outright — based on the factors below. Rather than quote a dollar range that would not apply to your business, we walk you through the underwriting factors that move your number the most.
| Cost Driver | Why It Moves Your Premium |
|---|---|
| Industry & data sensitivity | Healthcare (PHI), financial services, and legal sit at the top. E-commerce with card data is next. Professional services with limited consumer data sit lower. Industry class can be a 2–4x swing on identical revenue. |
| Annual revenue & record count | Record count is often a stronger driver than revenue — notification costs scale per affected individual. A 500,000-record business faces a very different worst-case than a 10,000-record business. |
| Security controls (MFA, EDR, backups, IR plan) | Carriers increasingly require specific controls as a condition of quoting. Missing MFA on privileged accounts can disqualify you. Documented, tested backups can unlock better ransomware terms. |
| Third-party vendor inventory | Each vendor handling your data is an aggregated risk. Carriers ask about cloud providers, payroll, HR systems, email, CRM, and billing. A thin vendor inventory can signal either low risk or undocumented exposure — and carriers probe the difference. |
| Prior incident history | A reported cyber claim — even a small one — triggers specific questions at the next renewal. Prior incidents without remediation language attract higher premiums and tighter terms. |
| Regulatory profile | Multi-state operations with CCPA, HIPAA, PCI, BIPA, or My Health My Data Act exposure draw higher regulatory defense loads. Single-state, low-regulation profiles price lower all else equal. |
| Geographic scope & customer footprint | Where your customers live determines which state privacy laws apply. A business with customers in California, Illinois, and Washington faces more regulatory variables than a single-state operator. |
| Employee count & training posture | Social engineering and phishing remain the top attack vectors. Carriers ask about security awareness training frequency, phishing simulation results, and onboarding security processes. |
| Selected limits & retentions | Higher limits cost more but open access to broader regulatory coverage. Lower retentions (self-insured amount per claim) cost more in premium but reduce out-of-pocket on frequency claims. |
| Coverage breadth (endorsements & carve-backs) | Social engineering, reputational harm, bricking coverage, system failure, and biometric privacy carve-backs all move premium. Our team decides which ones are worth the load for your profile. |
Every cyber profile is different. Rather than guess at a premium from a generic table, get a consultative review from our team — who will map your actual risk profile to the policy terms that matter.
Assess Your Cyber Risk ProfilePrivacy Laws by State
Cyber coverage does not exist in a vacuum — it responds to the legal obligations created by federal and state law. Here is the framework our team walks clients through, with the laws that most commonly drive claim activity.
Federal Framework
- HIPAA. Governs protected health information for covered entities and business associates. Breach notification obligations, OCR enforcement, and corrective action plans flow from HIPAA. Every healthcare practice needs regulatory defense sized to multi-year OCR exposure.
- GLBA. Governs nonpublic personal information at financial institutions and their service providers. Safeguards Rule obligations have tightened materially over the past three years.
- FTC Act Section 5. The FTC has brought dozens of cybersecurity enforcement actions under its unfair-and-deceptive-practices authority. Defense coverage for FTC investigations is a named coverage on most modern cyber policies.
- SEC cybersecurity disclosure rules. Public companies and certain regulated entities now face specific cybersecurity disclosure obligations. Cyber coverage for SEC investigation defense is increasingly available as an endorsement.
Key State Privacy & Breach Notification Laws
| State | Statute | Key Feature |
|---|---|---|
| California | CCPA / CPRA | Private right of action for reasonable-security failures; AG enforcement; broad consumer data definition. |
| Virginia | VCDPA | Controller/processor model; AG enforcement only; consumer rights including access, correction, deletion. |
| Texas | TDPSA | AG enforcement; consumer rights modeled on VCDPA; applies broadly to businesses doing business in Texas. |
| Colorado | CPA | Rulemaking authority; universal opt-out mechanism recognition; sensitive data consent requirements. |
| Illinois | BIPA | Biometric data statute with private right of action and statutory damages per violation — the most-litigated privacy statute in the country. |
| Washington | My Health My Data Act | Broad definition of consumer health data with a private right of action — impacts wellness apps, fitness trackers, and telehealth. |
| Utah | CUPA | AG enforcement; narrower scope than CCPA; consumer rights including access and deletion. |
| Tennessee | TIPA | AG enforcement with NIST Privacy Framework affirmative defense for conforming businesses. |
| All 50 states | Breach notification laws | Every state has its own breach notification statute with varying triggers, timelines, and AG notification thresholds. |
The state privacy patchwork is growing. New statutes in Connecticut, Oregon, Montana, Delaware, Iowa, Indiana, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Rhode Island, and others have either been enacted or are in active rulemaking. Cyber policy wording must keep pace — which is why the regulatory defense language and the definition of “privacy regulation” matter every time we review terms.
We write cyber coverage for clients across the 29 states we serve. Our team confirms — before binding — that your regulatory defense coverage extends to every statute applicable to your customer and employee footprint. See all 29 states we serve.
How to Choose the Right Cyber Coverage
When we evaluate cyber policies side-by-side for a client, we work through six criteria in order. A policy that wins on premium but fails on these criteria is not the right policy.
1. Breadth and definition of “covered event”
Does the policy cover a full range of cyber incidents — unauthorized access, malware, ransomware, denial of service, social engineering, human error, insider events, vendor events, system failure — or does it define “cyber incident” narrowly? Broader definitions cost more but avoid the painful discovery, mid-claim, that your event doesn't trigger coverage.
2. Limit structure and sub-limits
What is the aggregate limit? Which coverage parts share the aggregate vs. carry stand-alone limits? Which pieces are sub-limited — cyber extortion, social engineering, regulatory defense, reputational harm, bricking? Two policies with the same headline limit can behave very differently at claim time based on sub-limit design.
3. Retroactive date and prior acts
Full prior acts is the gold standard. Where full prior acts is not available, a retroactive date matching the inception of your original cyber policy is the next-best answer. A retroactive date equal to the current policy inception is a quiet gap — almost always worth negotiating.
4. Security control warranties and ransomware conditions
Read the application warranties and any ransomware co-insurance clauses. What exactly did you attest to? Can you document it? Does the ransomware coverage sub-limit adjust based on security posture? A policy with stiff conditions you can meet beats a policy with loose conditions you can't.
5. Regulatory coverage scope and insurability of fines
Does the regulatory defense coverage extend to every state statute applicable to your footprint? Are HIPAA, PCI, and FTC matters clearly included? Are fines covered where insurable by law? Is BIPA specifically included or excluded?
6. Claims handling and panel resources
Who handles claims for the carrier? Who is on the breach response panel? How quickly does the carrier respond to a first notice of loss? A carrier with excellent policy language but a slow or inexperienced claims operation will underdeliver during the worst 72 hours of your business life.
What We Review Before You Bind
Most insurance agents quote cyber based on a short application: industry, revenue, record count, done. They never see the third-party vendor inventory, the security control documentation, the incident history, or the regulatory footprint that actually drives coverage fit. We do it differently. Before we issue a proposal, Patrick reviews every quote against the underlying risk profile — and we walk you through what we found.
Data types review
We inventory the categories of data you hold — PHI, PCI cardholder data, PII, biometric data, behavioral data, employee data, third-party customer data as a processor — and map each to the applicable regulatory regime. This determines sub-limit sizing on notification, credit monitoring, and regulatory defense.
Vendor review
We inventory every third-party vendor that handles your data — cloud providers, SaaS platforms, payroll, HR, CRM, billing, payment processors, analytics. We confirm your policy's dependent business interruption and vendor breach language covers each one by category, and we size vendor-side sub-limits to match your real exposure.
Security controls review
We walk through carrier-required controls — MFA coverage, EDR deployment, backup strategy, email security, patching cadence, network segmentation, privileged access management — with your IT team or MSP. Gaps get addressed before the application goes to market, so your policy responds as expected.
IR plan review
We review your incident response plan — or help you document one if you don't have a written plan. Carriers increasingly require a documented, tested IR plan as a condition of quoting, and a well-designed plan meaningfully improves claim outcomes.
Prior incident review
We disclose prior incidents with remediation language that protects your renewal pricing. An event with clear remediation documented beats a bare disclosure every time, and our team helps you present prior events in a way that reflects the controls you have added since.
Then we present our findings to you on a video call, in plain English. No jargon, no pressure — just a clear explanation of where your coverage stands, where the gaps are, and what your options are. This is what we call a consultative review, and it is included at no cost for every cyber client.
This consultative approach is the same process we bring to restaurant insurance for operators with POS and loyalty data, HOA insurance for associations managing homeowner data, and commercial property insurance for landlords with tenant and payment records.
Exploring growth capital alongside cyber coverage? Working capital and equipment financing can fund the security controls carriers now require.
Frequently Asked Questions
What is cyber insurance and who needs it?
How is cyber different from general liability?
Does my general liability policy cover a data breach?
What's the difference between first-party and third-party cyber coverage?
Do I need cyber insurance if I use a cloud provider like AWS?
How does cyber insurance respond to ransomware?
What is a retroactive date and why does it matter?
Can cyber insurance cover HIPAA or state privacy law fines?
How much cyber insurance should I carry?
What security controls do cyber carriers now require?
Ready to Take the Next Step?
Whether you're reviewing current cyber coverage, preparing for a renewal, or buying cyber for the first time, these tools will help you move forward with clarity.
About the Author
Bobby Friel
Partner, Direct Insurance Services
Bobby Friel is a partner at Direct Insurance Services (Insurance Service 365), where he and his team specialize in commercial insurance for healthcare practices, e-commerce brands, tech and SaaS companies, contractors, HOA associations, restaurants, and commercial landlords across 29 states. Bobby's consultative approach means every cyber client gets a full data, vendor, security, and regulatory review before binding — because the right coverage starts with understanding what your business actually holds, who touches it, and where the law says you have to protect it.
Have a question about your cyber coverage? info@insuranceservice365.com.