Does Business Insurance Cover Cyber Attacks?
Learning goal: Know how much cyber protection a standard business policy usually gives, and when a separate cyber policy is worth considering.
Short answer
Only partly, if at all. Triple-I says some insurers include limited cyber coverage in a business owners policy or offer it as an option, but these policies typically cover a limited range of cyber threats. Ransomware, data breaches and fraudulent payment requests usually need a separate cyber policy, which can pay your own costs and claims from others.
Read to the end to complete this lesson.
On this page
The Fuller Picture
A small business can be hit by ransomware, a hacked email account or a breach of customer data. A standard property policy is built for physical damage, and a liability policy for injuries and property damage to others, so most cyber losses fall between them.
Key Takeaways
- Triple-I: some insurers include cyber coverage "in their standard business liability products, such as in a Business Owners Policy (BOP), or offer it as an additional option."
- "However, these policies typically cover a limited range of cyber threats," Triple-I says.
- A cyber policy's first-party coverage pays your own costs, such as restoring systems, notifying customers and lost income.
- Third-party coverage pays when customers or others sue over a breach.
- Social engineering, such as a fake invoice that tricks staff into wiring money, is often covered only if the policy names it.
Real-World Example
Ransomware at a dental office
A dental office's computers are locked by ransomware on a Monday. Its BOP includes a small cyber endorsement with a $10,000 limit, which barely covers the IT firm's first invoice. Patient records were exposed, so the office must notify patients, and three days of closed appointments cost more. A separate cyber policy, with breach response and business interruption coverage, would have been designed for this.
Common Mistakes
- Assuming a BOP or general liability policy covers cyber attacks fully.
- Not checking whether funds transfer fraud and social engineering are included.
- Missing the policy's security requirements, such as multi-factor authentication.
Interactive Exercise
Check your cyber coverage
Use your BOP and any cyber endorsement.
Tick each step as you do it. Your checklist is saved in this browser.
Knowledge Check
Question: What does Triple-I say about cyber coverage included in standard business policies?
Recommended Insurpedia Tools
- Coverage Builder: Answer a few questions about your home, vehicles, family and work, and see insurance topics worth researching for your situation, each linked to a plain-English explanation. It doesn’t tell you what to buy.
Related Insurance Terms
Related Scenarios
Questions to explore next
Questions readers often ask next about this topic:
- What does a cyber insurance policy cover?
- Does cyber insurance cover ransomware payments?
- What security controls do cyber insurers ask for?
See every lesson in the Starting a Small Business journey.
Explore the journey →Sources
The factual claims on this page were checked against these sources. Rules and figures change, so check the source itself if you need to confirm the current version.
- Cyber insurance: a key part of a robust business strategyInsurance Information Institute (Triple-I)
Educational information, not advice: This lesson is for general education only, not legal, financial, or insurance advice. Actual coverage, discounts, and requirements depend on your policy’s wording, your insurer, and the laws of your state. Confirm specifics with your own insurer or a licensed agent before making a decision. Insurpedia does not sell insurance and does not recommend specific insurers. The BOP cyber coverage points come from Triple-I.