Cyber insurance quoted from one short application — nationwide.

No — and this is the most expensive assumption in small-business insurance. General liability responds to bodily injury and physical damage to tangible property, and courts have generally held that electronic data is not tangible property. On top of that, standard GL policies now carry explicit exclusions for access to or disclosure of confidential or personal information, added across the market after early data-breach lawsuits. Commercial property policies have the same problem: they cover the server hardware, not the data on it or the income lost while your systems are locked. Cyber insurance exists as a separate line precisely because it covers what those policies deliberately carve out — breach response, ransomware, data restoration, and privacy lawsuits. If a client contract requires “cyber liability,” a GL certificate will not satisfy it.

A modern policy has two sides. First-party coverage pays your own costs after an incident: forensics to determine what happened, breach counsel, the notification letters state law requires you to send, credit monitoring for affected people, ransomware and extortion response, business income lost during an outage, and the cost of restoring data. Third-party coverage defends and pays when others come after you: lawsuits from customers or employees whose data was exposed, claims that malware spread from your systems, regulatory investigations, and PCI assessments from the card brands. Most policies add crime-style endorsements for social engineering and funds-transfer fraud, where many real-world losses now occur. The Federal Trade Commission’s Data Breach Response guide shows how many moving parts a breach involves — a good cyber policy funds and coordinates essentially all of them.

Underwriting has shifted from “fill out a form” to “show us your controls.” The near-universal baseline is multi-factor authentication (MFA) on email, remote access, and admin accounts — many carriers will not quote without it. Beyond MFA, carriers commonly ask about endpoint detection and response (EDR) rather than plain antivirus, backups that are kept offline or immutable and actually tested, timely patching, and employee security-awareness training; larger risks are asked for an incident response plan. Many carriers also scan your public-facing systems during underwriting, so exposed remote desktop ports or end-of-life software can sink a quote you never see. None of this is arbitrary — the same controls are what CISA and the NIST Cybersecurity Framework recommend for every organization. We review your setup against carrier expectations before submitting, so gaps get fixed or explained rather than declined.

It depends on revenue, industry, the volume and sensitivity of the data you hold, the limits and retention you choose, your claims history, and — increasingly — your security controls, so any flat number you read online is only directional. As a rule, businesses that handle regulated data (healthcare, financial services, anything with large volumes of personal information) pay more than those that don’t, higher limits and lower retentions cost more, and strong controls like MFA, EDR, and tested backups earn measurably better pricing because they change how underwriters score the risk. For many small businesses with clean history and decent controls, a starter cyber policy costs less than they expect — often less than their general liability. The only reliable number is a quote built on your specifics, which is exactly what one short application gets you.

Social engineering (sometimes called funds-transfer fraud or cybercrime coverage) responds when an employee is deceived into sending money — a spoofed email from the “CEO” ordering a wire, a vendor’s hacked account sending new bank details on a real invoice. It matters because no system is breached in the classic sense: your own employee, with proper authority, voluntarily sends the funds, which is why base cyber and crime policies historically excluded it. Carriers now offer it back as an endorsement, but almost always at a sublimit — often a fraction of the full policy limit — because these losses are frequent, fast, and hard to claw back. Carriers also attach conditions, most commonly a callback or out-of-band verification requirement before payment changes are honored; skip the callback and the claim can be denied. When you compare quotes, the social-engineering sublimit and its conditions deserve as much attention as the headline limit, and higher sublimits can often be negotiated for businesses with strong payment controls.

Most cyber policies are claims-made: the policy that responds is the one in force when the claim is made against you (or the incident is discovered), not the one in force when the hacker first got in. That matters in cyber more than almost any line, because intrusions are routinely discovered weeks or months after they begin. The retroactive date sets how far back covered incidents can reach — a breach that started before your retroactive date is excluded, even if you discover it mid-policy. When you switch carriers, the goal is to carry your original retroactive date forward (called full prior acts, or nose coverage); resetting it to the new policy’s start date quietly erases coverage for anything already lurking in your systems. Continuous coverage without lapses protects that date. This is one of the places a licensed advisor earns their keep at renewal — a cheaper quote with a reset retroactive date is not actually cheaper.

Yes — smaller organizations are targeted precisely because they hold valuable data with fewer defenses, and much of today’s attack traffic is automated and doesn’t care how big you are. The scale is public record: the FBI’s Internet Crime Complaint Center logged 1,008,597 complaints with $20.9 billion in reported losses in its 2025 Internet Crime Report — and IC3 only counts what victims report. Business email compromise, ransomware, and payment fraud consistently rank among the costliest categories, and all three hit small companies routinely. A small firm also feels an incident harder: a week of downtime or a six-figure fraudulent wire that a large enterprise absorbs can be existential for a 15-person company. State breach-notification laws apply regardless of size, so even a modest incident triggers real legal obligations and costs. Cyber insurance is how a small business rents an enterprise-grade response team for the day it needs one.

Most standalone cyber policies include cyber extortion coverage that can reimburse a ransom payment along with the costs that surround it — professional negotiators, forensics, and system restoration — subject to the policy limit and carrier consent, which is required before anything is paid. There is an important legal wrinkle: the U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned many ransomware operators, and paying a sanctioned entity is prohibited, so carriers and their negotiators screen every demand and will not fund a payment that would violate sanctions. In practice, insurers and law enforcement both push recovery over payment — the federal government’s official guidance at StopRansomware.gov discourages paying, since payment funds the next attack and doesn’t guarantee your data back. That is why the coverage that matters most in a ransomware event is usually restoration and business interruption, not the ransom line itself, and why underwriters lean so hard on tested offline backups. If ransomware is your core concern, buy the policy for the response team and the recovery dollars — and treat the ransom reimbursement as a last resort the carrier controls.