The breach is rarely the expensive part. The response is.
Cyber liability covers breach response, ransomware, and the notification costs that follow an incident. Technology errors and omissions sits alongside it and covers your software or service failing a client.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What cyber and technology actually covers.
Breach response
Forensics, legal advice, notification and credit monitoring after an incident.
Without it — Notification costs scale with the number of records and arrive before you know the cause.
Ransomware and extortion
Negotiation, ransom where lawful, and the cost of restoring systems.
Without it — A small business pays out of cash or stops trading, often both.
Business interruption
Lost income while systems are down.
Without it — A week offline costs the revenue and the customers who left during it.
Technology E&O
Claims that the software or service you provide failed and cost a client money.
Without it — A client’s outage caused by your product is a direct financial claim with nothing responding.
Where cyber and technology shows up.
- Home Health Agency
HIPAA notification costs begin immediately and are not covered by any other line on the policy.
- Medical & Dental Practices
Protected health information is the highest-value data there is, and a breach brings notification costs and regulators.
- Freight Brokers
Double brokering and fictitious pickup are executed by email and spoofed identity, which is a cyber claim before it is a cargo claim.
- Freight Forwarders
Routing instructions and payment details move by email, which is exactly where the diversion fraud in this trade happens.
- Allied Health & Therapy Practices
Treatment notes are health records, and a breach carries notification duties whatever the size of the practice.
- Speech Therapy Practices
Evaluations and treatment notes on children are health records with notification duties attached.
- Occupational Therapy Practices
Clinical records are health data whatever the size of the practice.
- Physical Therapy Practices
Patient records and scheduling systems carry notification duties after a breach.
- Play & Behavioral Therapy
Records about children are the most sensitive data a small practice holds.
- Chiropractic Practices
Patient records and imaging are health data with breach notification duties attached.
- Concierge & Private Duty Nursing
Clinical records on high-profile clients are both health data and a reputational exposure.
- Pharmacist Liability Insurance
Prescription records are health records, and a breach at a small pharmacy carries the same notification duties as one at a hospital.
- Security Guard Companies
Access control, camera systems and guard tour data are client security information held by you.
- Staffing & Temporary Employment Agencies
You hold identity documents, right-to-work evidence and payroll data for a workforce far larger than your own staff.
- Technology Companies
The easy online carriers sell cyber without technology E&O at all, and a contract that names both is not satisfied by one.
- SaaS & Software
A subscription platform is a standing promise about uptime and data. Both halves — the product failing a customer, and the data escaping — need their own answer.
- IT & Tech Consulting
A consultant with admin access carries two exposures at once: your systems, and every client environment your credentials reach.
- IT Staffing & Recruiting
Your placed engineers work inside client systems under your agreement: a claim that one of them caused an incident arrives addressed to you.
- Recording Studios
Sessions, stems and unreleased masters sit on servers, and a leak before release is a commercial catastrophe rather than an IT problem.
- Loan-Out Companies
Scripts, unreleased material and client data sit on your machines, and a leak is a career problem as much as a claim.
- Labels, Agents & Managers
Unreleased masters and artist data on your systems, and payment fraud aimed at your accounts department.
- Content Creators & Influencers
The channel is the business, and an account takeover is the one income loss a policy will actually pay for.
- YouTubers
An account takeover is the one income loss on a channel that a policy will pay, and only if it was bought before the phishing email.
- Farm & Ranch YouTubers
An account takeover is the one way of losing channel income that a policy will actually pay for.
- Journalists & Local News
A hijacked channel or newsletter list, and the cost of notifying subscribers, are cyber claims and not media ones.
- Podcasts
The feed, the subscriber list, the sponsor contracts and the unreleased episodes sit in accounts that get taken over.
- Medical Devices
A connected device is a data exposure and a device exposure at once.
- Laboratories
A clinical lab holds exactly the data that makes a breach expensive.
- Software Developers
Holding a client’s data makes their breach your incident.
- Managed Service Providers
An MSP holds privileged access to every client network it manages.
- Fintech
The highest-value data category there is.
- Law Firms
A firm holds concentrated privileged data and is a deliberate target for it.
- Accountants & CPAs
A tax practice holds the highest-value identity data there is.
- Consultants
Consultants routinely hold client data on their own laptops.
- DOT & FMCSA Compliance Services
Driver data is regulated, and the notification cost lands on whoever was holding it.
- Mortgage Brokers
You hold complete financial identity files on every applicant.
- Property Managers
Rent and deposit transfers are a social engineering target.
- E-commerce & Online Sellers
An online store is a payment processor with a storefront attached.
- Medicaid Waiver Providers
Notification duties start the day a laptop is stolen, and no other policy on this page pays for them.
- Home Care Agencies
Notification costs start immediately and are covered by no other policy here.
- Mental Health Clinics and Facilities
HIPAA notification duties start the day a laptop is stolen or an inbox is phished, and mental health records are the most sensitive data a small organization holds.
- Domestic Violence Shelters
A leaked file can reveal where a survivor is. Federal confidentiality rules make that a legal exposure as well as a safety one.
- Private Colleges and Universities
Colleges hold student financial and identity data and are frequent ransomware targets.
- The Hartford
Written standalone or packaged into the BOP, and it is real tech E&O rather than a miscellaneous form with data claims carved out.
- Chubb
The distinction between cyber and a breach-notification add-on is most of what decides a cyber claim.
- CNA
Keeping them on one program is usually cheaper and always simpler at claim time.
- Marketing Agencies
One phished login can reach every client account the agency manages, and the client’s loss becomes your liability.
- Advertising Agencies
Agencies hold client assets, logins and audience data, and a compromised account can run up spend before anyone notices.
- PR Firms
A PR firm holds unannounced news, crisis files and executive contacts, which makes it a target and its breach a client claim.
- Graphic Designers
One phished password can reach every client folder you share, and the client’s claim follows.
- Web Designers & Developers
An unpatched plugin is a common way into a small business site, and the client will ask who was maintaining it.
What clients with cyber and technology ask us.
We are tiny. Are we really a target?
Small businesses are targeted more, not less, because the attacks are automated and the defenses are thinner. Nothing about a ransomware campaign is selective. The relevant question is not whether you are interesting but whether you could fund a forensic investigation and a notification exercise from cash.
Does my general liability cover a data breach?
No. Modern general liability policies carry explicit electronic data exclusions, and the ones that do not still require bodily injury or physical property damage, which a breach is not. The gap is deliberate on the insurer’s side rather than accidental.
A client contract requires $10M of cyber. Can we actually get that?
Yes, but not from a website. Limits of that size are placed as a primary policy with an excess layer above it, by an underwriter who reads how many personal records you hold, what security and endpoint detection you run and what your client agreements make you responsible for. The excess is priced off the primary, so the whole tower turns on how the primary underwriter reads your business. We place these for technology and staffing firms who arrived after the marketplaces stopped short.
Does cyber insurance cover deepfake fraud and AI-driven attacks?
Increasingly by name. A deepfake voice or video that tricks staff into paying a fake invoice is social engineering, covered under the funds-transfer or social-engineering part of a cyber policy up to its own sublimit, which is usually lower than the policy limit. Coalition added deepfake wording to its cyber forms in December 2025 and an affirmative AI endorsement stating that a loss caused by an autonomous AI model is covered like one caused by a human. Ask what the sublimit is and whether AI is covered affirmatively; both answers vary by carrier.
Guides on cyber and technology.
- First-Party vs Third-Party Cyber InsuranceA cyber policy is built from two halves that pay for different things, and the words first-party and third-party describe who suffered the loss rather than who caused it. Knowing which half a coverage sits in tells you what a policy will actually do on the day something goes wrong.
- Tech E&O vs Cyber InsuranceTechnology errors and omissions and cyber insurance are two different coverages that are usually sold together on a single policy. The distinction decides which one responds when a release goes wrong, when a client sues over an outage, or when customer records are exposed.
- Cyber applicationFive controls open the door: multi-factor authentication everywhere, endpoint detection on every device, backups that cannot be encrypted and have been tested, an incident plan, and staff training. The application is a check that they are real, and a wrong answer is a claim denied.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.