Cyber liability insurance for New York businesses
Cyber liability insurance helps a business respond and recover when data is stolen, systems are locked by ransomware, or a convincing email tricks someone into wiring money to a criminal. For New York firms that keep client files, card data or medical records, it has become as basic as a lock on the office door.
Gordon Companies is an independent, family-owned brokerage in Midtown Manhattan. Cyber forms vary more than almost any other business policy, so we compare them across carriers line by line, and a real person explains what each one actually covers.
What cyber insurance covers
Most cyber policies combine two kinds of protection: costs your own business incurs, and claims brought by others.
First-party coverage: your own losses
- Forensic investigation to find out what happened and what was taken
- Notifying affected people and offering credit monitoring or identity restoration
- Breach response lawyers and public relations help
- Ransomware and cyber extortion response
- Restoring data and repairing affected systems
- Lost income while your systems are down
Third-party coverage: claims against you
- Lawsuits from clients or customers whose information was exposed
- Regulatory investigations and, where insurable, fines and penalties
- Claims that your systems passed malware to someone else
- Media liability for content on your website or social channels
Many carriers also give policyholders access to a breach response team, which can matter as much as the money when you are in the middle of an incident.
Why your other policies probably fall short
General liability insurance is built for bodily injury and physical property damage, and most forms now exclude data breach and electronic data losses. Standard business interruption coverage usually depends on physical damage to property, so a network outage from a cyber attack often is not included.
Professional firms should also look at how cyber works alongside professional liability insurance. If a client blames your firm for a loss tied to a security failure, the wording of both policies decides which one responds.
What New York businesses should know
New York’s SHIELD Act requires businesses that hold private information about New York residents to maintain reasonable security safeguards and to notify affected people after certain breaches. That applies even if your business is based elsewhere, and notification and legal costs are exactly what cyber coverage is designed to pay.
If your firm is regulated by the New York State Department of Financial Services, its cybersecurity regulation adds its own requirements. Businesses that handle health information, payment cards or client funds, from medical practices to property managers, should expect carriers to ask detailed questions.
How we shop cyber and what affects cost
Carriers price cyber on your industry, revenue, the type and volume of data you keep, and the security controls in place. Multifactor authentication, tested backups, endpoint protection and employee training often affect both eligibility and price.
When we compare policies, the gaps we look for include:
- Social engineering and funds transfer fraud, which are often excluded or carry a low sublimit
- Outages at a cloud provider or other vendor you depend on
- Mistakes by employees, not just outside attacks
- Waiting periods before income loss coverage starts
- Whether you must use the carrier’s breach vendors
Cyber can also overlap with management liability. Shareholders sometimes pursue leadership after a major breach, which is where directors and officers insurance comes in.
Questions we hear about cyber liability insurance
Is my business too small to be a target?
No. Many attacks are automated and aimed at anyone with an email account and a weak password. Small businesses often have fewer defenses and less ability to absorb the cost of a breach.
Does cyber insurance pay a ransom?
Many policies include cyber extortion coverage, which can cover the response and in some cases a payment, subject to the policy terms and the law. Some carriers have narrowed this coverage, so it is worth checking.
What if an employee is tricked into wiring money?
That is social engineering fraud, and it is not covered by every cyber policy. When it is, it often has a separate sublimit, so we look at that amount closely.
I use cloud software. Doesn’t my provider handle this?
Your provider secures its own platform, but your business is usually still responsible for the data you collect and for notifying the people affected. Provider contracts also tend to limit what they will pay.
Related coverage
Start your cyber liability quote
Tell us what kind of data you keep and how your systems are set up, and we will compare cyber options across carriers. Request a quote online or call 212-687-2525, Monday to Friday, 9am to 5pm, to speak with Aaron Gordon or another real person on our team.
