The number of cyberattacks in the United States has gradually increased year over year since 2016 (Statista). In fact, three in four companies were at risk for a material cyberattack in 2023. From network intrusion to business email compromise via phishing, cyberattacks cost companies a significant amount of money. IBM’s annual Cost of a Data Breach report lists the global average cost of a data breach in 2024 as $4.88 million, a 10% increase over the last year and the highest total ever.
In addition, cybersecurity incidents cause reputational damage. When a data breach occurs, customers lose trust in the company, especially if the breach compromises their personal information.
In today’s digital landscape, a cybercrime insurance policy is a critical component of an effective risk management program to protect your company from the adverse financial and operational impacts of these increasingly common attacks.
What is Cyber Liability Insurance?
Cyber liability insurance is a type of commercial insurance that provides coverage for financial losses related to cybercrime. The costs incurred from a cyberattack include those associated with legal fees, data recovery, customer notification, public relations efforts, and regulatory fines.
This protection isn’t offered under a general liability insurance policy, which typically covers bodily injury, property damage, and third-party claims resulting from accidents or physical incidents. As businesses increasingly rely on technology, the need for cyber liability insurance becomes crucial to cover the gaps in protection that general liability policies leave unaddressed.
Why do Businesses Need Cyber Liability Insurance?
If you conduct any business online, such as collecting customer data, processing payments, or managing employee records, you are at risk of a cyberattack. The FBI’s 2023 Internet Crime Report shows the Internet Crime Complaint Center (IC3) received 21,489 business email compromise complaints in 2023, with reported losses over $2.9 billion. In addition, they received 1,193 complaints from organizations belonging to a critical infrastructure sector that were affected by a ransomware attack.
Cybercriminals often target businesses of all sizes, exploiting system vulnerabilities to steal sensitive information or disrupt operations. But small businesses are hit especially hard, as they are often viewed as easier targets with less robust security measures. According to an SBA survey, 88% of small business owners feel their business is vulnerable to a cyberattack.
Risks of cyberattacks include:
- Data breaches: Theft of sensitive information such as customer or employee data, leading to identity theft or fraud.
- Reputational damage: Negative public perception and loss of customer trust.
- Business interruption: Downtime that disrupts services, delays operations, and results in significant revenue loss.
- Financial loss: Costs associated with recovering from the attack, including legal fees, fines, and business interruption.
What Does Cyber Liability Insurance Cover?
A typical cyber liability insurance policy covers any damages a business incurs as a result of a cyberattack. This could include:
- Data recovery costs: Expenses related to restoring or recovering lost, stolen, or corrupted data after a cyberattack. This includes restoring compromised software systems, databases, and sensitive customer or business information.
- Customer notification costs: Businesses are legally required to notify affected customers following a data breach. Cyber liability insurance can cover the expenses involved in notifying individuals, regulators, and other relevant parties, including the creation and distribution of notices.
- Credit monitoring services: Offering credit monitoring to affected customers or employees is often necessary after a breach to help protect them from identity theft and fraud. Insurance can cover the costs of providing these services for a specified period.
- Legal defense and settlements: Businesses may face lawsuits from customers, employees, or other stakeholders due to a data breach. Cyber liability insurance helps cover the legal fees associated with defending against these lawsuits, as well as settlements or judgments.
- Public relations and reputation management: A cyberattack can cause significant damage to a company’s reputation. Insurance covers the cost of hiring PR professionals to manage communication strategies, rebuild trust with customers, and mitigate reputational harm.
- Downtime costs: Cyberattacks can halt operations, leading to lost revenue and productivity. Insurance can cover the income loss a business experiences during downtime, as well as the costs of resuming normal operations.
- Regulatory fines and penalties: Coverage may extend to the fines and penalties imposed by regulatory bodies for non-compliance with data protection laws, such as GDPR, HIPAA, or CCPA, following a breach.
How Much Does Cyber Liability Insurance Cost?
The cost of cyber insurance varies based on a number of factors, including the size of your business, how much sensitive data your company handles, and your industry. Small businesses pay an average premium of $145 per month, or about $1,740 annually, for cyber insurance (Insureon).
Steps to Take When Choosing Cyber Liability Insurance
1. Assess Risk
Review which business processes are susceptible to cyberthreats, such as sensitive data handling or online transactions.
2. Determine Coverage Needs
Estimate the worst-case scenario costs of a cyberattack, which includes business downtime, regulatory fines, and data recovery costs. An insurance broker can help with this analysis.
3. Consider the Industry
Your risk is higher in the healthcare industry, which requires HIPAA compliance.
4. Compare Options
Compare the costs, coverage, deductibles, and exclusions of various insurance companies.
5. Evaluate Annually
Once you choose a policy, reassess annually to ensure you’re getting the best rates.