Liability

Cyber Liability Insurance

Help with the costs of a data breach, ransomware or another cyber attack that takes your systems down, plus liability if customers, partners or regulators bring claims.

Request a cyber insurance quote Upload your current policy

Cyber insurance is built for the costs that follow a data breach, ransomware attack or other network security event. Most policies combine first-party coverage for your own costs with third-party coverage for claims brought by customers, partners or regulators.

Many policies also give you access to a breach response team — legal counsel, forensic investigators and notification vendors — which can matter as much as the limit when something goes wrong.

Eligibility increasingly depends on your security controls. Insurance companies commonly ask about multi-factor authentication (MFA), backups, endpoint protection and employee training, and gaps can affect terms or whether a policy is offered at all. We help businesses across the U.S. work through those questions and compare what each policy includes.

Standard coverage and optional extensions

Cyber policies aren't all built the same way. Breach response, ransomware and extortion, data restoration and liability for a security or privacy failure form the core of many policies. Other protections are often optional, sublimited (capped at a smaller amount within the main limit), or both:

Social engineering and funds transfer fraud — money sent because of a spoofed email, fake invoice or fraudulent payment instruction.
System failure — an outage caused by something other than an attack, such as a faulty software update or human error.
Dependent business interruption — an outage at a vendor or cloud provider you rely on.

If any of these matter to your business, ask for them by name and check the limit that applies.

Cyber insurance isn't crime insurance

A cyber policy doesn't automatically protect you against employee theft or every kind of payment fraud. Theft of money or property by your own employees (employee dishonesty) is usually addressed by a separate crime policy, and some payment fraud falls under crime coverage rather than cyber, depending on the forms. If you handle wire transfers, invoices or cash, ask how your cyber policy and any crime coverage would work together.

What's typically included

Exact coverage depends on the policy form, endorsements and insurance company.

Breach response

Costs for legal counsel, forensic investigation, notification, credit monitoring and public relations after a breach, often through the insurance company's approved vendors.

Cyber extortion and ransomware

Can include negotiation help and ransom-related expenses, subject to policy conditions, the insurance company's consent and applicable law.

Business interruption

Lost income and extra expense when a cyber attack takes your systems down, after a waiting period — the hours an outage must last before this coverage starts. Outages from non-malicious system failures or at key vendors are often optional extensions.

Data restoration

Costs to restore or recreate data and software damaged in a cyber event that falls within the policy.

Network security and privacy liability

Third-party claims that a failure to protect data or systems harmed others, including defense costs.

Regulatory defense and penalties

Defense of regulatory investigations and, where insurable by law, certain fines and penalties. Payment card industry (PCI) assessments may be included or available separately, depending on the policy.

Optional: social engineering and funds transfer fraud

Losses from fraudulent payment instructions, spoofed emails or altered invoices. Usually an optional extension, often sublimited well below the main limit and subject to conditions such as verifying payment changes by phone.

What to watch for

Social engineering and funds transfer fraud left off the policy, or sublimited far below the main limit, with conditions requiring callback verification of payment changes.
Application answers about MFA, backups and other controls that don't match reality — misstatements can create disputes after a claim.
Business interruption that applies only to attacks when your business depends on systems that could also fail through an error, a bad update or a vendor outage.
Business interruption waiting periods longer than the outage your business can absorb.
Exclusions for unpatched systems, war, infrastructure failure or incidents known before the policy started.
Assuming a cyber policy handles employee theft, or that general liability or crime insurance handles cyber losses — each policy has its own scope and exclusions.

What affects price and eligibility

Industry, annual revenue and the volume of personal records you hold
Security controls such as MFA on email and remote access, backups, endpoint detection and patching
Payment practices and procedures for verifying fund transfers
Prior cyber incidents or claims
Limits, retentions, sublimits and optional extensions requested
Reliance on outside vendors and cloud services

Helpful information for a quote

Have what you can — we'll ask for anything else an insurance company needs. Starting a new business? You can begin without prior policies or loss runs.

Annual revenue and number of employees
Roughly how many personal records you hold for customers, employees or patients
How you handle backups, MFA and remote access
Answers to the security questions on a cyber application
Your current cyber policy declarations, if you have one
Details of any prior cyber incidents or claims

Written by ALP Insurance

Who typically needs it

Businesses that store customer, patient or employee personal information
Companies that accept card payments or regularly send invoices and wire transfers
Professional firms holding client files, financial records or confidential data
Contractors, trucking companies and manufacturers that depend on dispatch, ERP or scheduling systems
Retailers and restaurants using point-of-sale and online ordering systems
Businesses whose client or vendor contracts require cyber coverage

Talk it through with an agent

Not sure what you need? Start a request and choose "Not sure" — a licensed ALP agent will talk through the options with you.

Request a cyber insurance quote

Industry guides

Cyber Liability FAQs

Do I need cyber insurance if my data is in the cloud?

Often, yes. Cloud providers generally limit their responsibility for your data, and you can still face notification costs, ransomware on your own devices or fraudulent payments. A cyber policy can address losses a vendor contract typically won't.

Do insurers require multi-factor authentication?

Many insurance companies ask about MFA for email, remote access and administrator accounts, and not having it can limit options or affect terms. Requirements vary by insurance company and policy size.

What is social engineering fraud?

It is when someone tricks an employee into sending money or changing payment details, often through a spoofed email or fake invoice. Many cyber policies offer it as an optional extension, usually at a lower sublimit and with conditions such as verifying payment changes by phone.

Does a cyber policy respond to employee theft or payment fraud?

Not automatically. Employee theft is usually addressed by a crime policy, and payment fraud may need a social engineering extension on the cyber policy, crime coverage, or both, depending on the forms. Most general liability policies also exclude data breach and cyber losses.

Does cyber insurance respond to outages that aren't caused by an attack?

Sometimes. Lost income from a non-malicious system failure, such as a faulty update or human error, is often an optional extension with its own limit and waiting period. Outages at your vendors are a separate option on many policies.

What should I do first if I suspect a breach?

Notify your insurance company or use its breach hotline promptly, ideally before hiring outside vendors. Many policies require notice and consent before costs are incurred.