Cyber liability is no longer optional for small business

The threat model has flipped

The mental model most small business owners carry — "I'm too small to be a target" — is roughly a decade out of date. Modern ransomware is automated. Attackers run scanners that find vulnerable Exchange servers, exposed RDP, and unpatched VPNs across millions of IPs at a time. They don't care if you're a five-person dental practice or a Fortune 500. They care if your endpoint is unpatched on a Tuesday.

The 2024 IBM cost-of-a-breach study put the average cost of a small business breach (under 500 employees) at $3.31M. The median is much lower — around $120k — but the tail is brutal, and small businesses are more likely to fold within 12 months of a major incident.

What a standalone cyber policy actually covers

There are typically two halves:

First-party (your costs):

• Forensic investigation
• Notification to affected customers (often required by state law)
• Credit monitoring for those customers
• Public-relations crisis management
• Business interruption — lost income while systems are down
• Ransomware payment (where legally permitted) and ransom negotiation
• Data restoration

Third-party (claims against you):

• Regulatory fines (HIPAA, state AG, GDPR if you touch EU customers)
• Customer lawsuits for exposed PII
• Defense costs for the above
• PCI fines if cardholder data is exposed

What most "endorsement" cyber coverage misses

Many general liability and BOP policies now include a "cyber endorsement" of $25k–$100k. That number sounds like real coverage. It usually isn't.

A hypothetical ransomware incident at a 12-person professional firm might cost:

• $48k — forensics
• $22k — notification + credit monitoring (2,400 affected)
• $61k — 9 days of lost billing
• $35k — ransom (paid via negotiator)
• $18k — legal/regulatory response
• = $184k total

In that scenario, a $50k BOP endorsement would leave most of the loss uncovered. A standalone cyber policy with a higher limit is worth comparing.

What we look for when placing the coverage

• No "sub-limits" buried in the policy — full-limit forensics, full-limit ransomware, full-limit business interruption.
• Coverage for social engineering and funds transfer fraud — wire fraud is the #1 small business cyber loss and many cyber policies exclude it unless you add the endorsement.
• No "failure to maintain" exclusions that void coverage if the carrier decides your patching wasn't current.
• An incident-response retainer baked in — a 24/7 number that gets a real forensic firm on a call within an hour. This can be one of the most valuable parts of the policy.

What it costs

Pricing varies widely by industry, revenue, data sensitivity, and security controls. Healthcare, legal, and financial services typically run higher. We can compare available cyber options and walk you through the application questions (which are also a useful security checklist).