That is all it takes to bring an enterprise to its knees. A cyber risk policy is the difference between an incident and an extinction event — and we underwrite it the way insurance was meant to be done: by people who read the policy form.
Figures from IBM's Cost of a Data Breach Report 2025, Munich Re, Swiss Re, NAIC and industry claims data. The takeaway is not the size of any single number — it is the asymmetry between a tiny trigger and a ruinous bill.
Cyber risk is your exposure to intrusion, data loss and system failure — and the business interruption, reputational harm, regulatory penalties and lost revenue that follow. Most commercial general liability (CGL) policies were never built to answer it. A purpose-built cyber policy is.
Information belonging to customers, patients and partners has real value — and you can be held legally responsible for losing it. Modern contracts bury data-protection clauses that turn one incident into a chain of damage claims. Customer data is exposed in over half of all breaches.
Everything you publish online creates exposure: copyright and trademark claims, defamation, plagiarism allegations, unauthorized use, social posts. The moment your enterprise puts content on the web, liability is created — and it travels.
Crisis management, forensics, data restoration, hardware replacement, downtime, funds-transfer fraud, breach-notification compliance and extortion costs aggregate fast. Nearly half of serious breaches strike organizations with fewer than 1,000 employees — most of whom are not financially prepared.
The exposures of a decade ago were lost laptops and stolen thumb drives. They still happen — but the center of gravity has shifted to ransomware, business email compromise (BEC), supply-chain compromise and, increasingly, AI-assisted attacks. In 2025, phishing overtook stolen credentials as the most common way in.
Because the product is still maturing, no two carriers write the same form. Definitions, sub-limits, retentions and exclusions vary enormously between manuscript policies. That is precisely where underwriting expertise earns its keep — and why an "instant quote" is a fiction.
| Sector | Per breach |
|---|---|
| Healthcare | $7.42M |
| Financial services | $5.56M |
| Industrial | $5.00M |
| Energy | $4.83M |
| Technology | $4.79M |
| Pharmaceuticals | $4.61M |
Source: IBM Cost of a Data Breach Report 2025
We pair you with the right form and the right market — standard or non-standard — backed by carriers with the financial strength to honor the obligation. Here is the coverage we work to secure.
Pays your costs after an incident: forensics and crisis response, data and program restoration, business interruption and lost revenue, cyber extortion, and computer-fraud and funds-transfer-fraud losses.
Protects you when others come after you: claims from customers, employees and regulators, defense costs, and settlements arising from a privacy or network-security failure — with a most-favorable-venue approach where allowed.
Coverage features describe the broad forms we pursue and vary by carrier, jurisdiction and underwriting. The binding policy controls in all cases. We will walk you through exactly what your policy does — and does not — do before you sign.
Three composite scenarios — drawn from the patterns carriers see most often — and the coverages that respond to each.
An employee clicks a convincing invoice. Within hours, files are encrypted firm-wide and a ransom is demanded. Operations halt for nine days while systems are rebuilt from backups.
A spoofed executive email — increasingly polished by AI — directs accounting to pay a fraudulent vendor. The transfer clears before anyone notices. BEC is now among the most common claim types by volume.
An unencrypted device disappears with patient or customer data on it. Breach-notification laws trigger across multiple states, plus a regulator inquiry and class-action exposure.
Scenarios are illustrative composites for education only and are not a representation of coverage. Actual coverage depends on the policy issued.
Roughly one in five cyber claims was denied or partially denied last year, and the single most common reason was failure to maintain the security controls a business declared on its application. Carriers now verify those controls were actually in place at the time of loss.
We do not just place coverage and disappear. Through our partnership with Gibbs Cyber Security, current policyholders can talk through loss-mitigation practices — so the policy pays when you need it. Here are the controls underwriters expect to see in 2026.
Plenty of sites promise an instant cyber quote. That is marketing, not underwriting. Cyber risk is still a comparatively young, manuscript-driven product — every account has to be read and priced on its own facts. We are quick, but no honest broker is instant. Here is how it works.
A full application lets us understand your operations, data, revenue and security posture. The more complete it is, the better the terms we can find.
We take your account to standard and non-standard carriers, comparing forms — not just prices — for the broadest coverage at a fair rate.
Before you bind, a real person walks you through key coverages, sub-limits, retentions and any conditions, so there are no surprises at claim time.
Once you're covered, our security partners remain available to discuss loss mitigation and keep your declared controls intact.
A cyber policy combines first-party coverage (your own costs — forensics, data restoration, business interruption, cyber extortion, funds-transfer fraud) with third-party liability coverage (claims, defense and settlements brought by customers, employees or regulators after a privacy or security failure). Most policies also fund breach notification, credit monitoring and crisis communications.
Almost never. Standard commercial general liability (CGL) and property forms were written for bodily injury and physical property damage, and most now contain explicit exclusions for data and network events. To cover cyber exposures you need a dedicated cyber policy — or, in some cases, a cyber endorsement that has been carefully reviewed for gaps.
Premiums depend on your revenue, industry, data volume, claims history and — increasingly — your security controls. After two years of softening rates, the market is expected to firm again in 2026. The strongest lever you control is your security posture: businesses that can demonstrate MFA, EDR, tested backups and an incident-response plan consistently get better terms. We price each account individually rather than quoting a generic number.
Because honest cyber underwriting requires reading the risk. Coverage forms are manuscripted and vary widely between carriers, so the same business can receive very different terms depending on the form. We move quickly, but a real underwriting review is what stands between you and a policy that won't pay. Anyone promising a binding "instant" cyber quote is selling the fiction, not the coverage.
Every size. Nearly half of serious breaches hit organizations with fewer than 1,000 employees, yet only around four in ten small businesses carry cyber coverage — compared with the vast majority of large enterprises. Smaller firms are often less able to absorb the cost, which makes the protection gap most dangerous exactly where it is widest.
The leading reason for denial is failing to maintain the security controls you declared on your application. If you said you had MFA or working backups and you didn't at the time of loss, the carrier can contest the claim. Keep your declared controls genuinely in place, document them, and treat the application as an ongoing promise rather than a one-time form. We help current policyholders stay aligned with what their policy assumes.
Broad forms do — typically through cyber-extortion coverage for the response and negotiation, business-interruption coverage for downtime, and data-restoration coverage to rebuild. Terms, sub-limits and conditions vary significantly between carriers, and some now require specific controls before extortion coverage applies, so this is an area where the form details matter most.
Cyber policies generally respond to the outcome — fraud, breach, extortion, interruption — regardless of whether attackers used AI to get there. In 2025 roughly one in six breaches involved attackers using AI, most often to craft phishing and deepfake impersonations. What matters for coverage is how your form defines the triggering events, which we review with you before binding.
CyberRiskPolicy.com is a joint venture between the Poindexter Surety Group — insurance and surety specialists since 1994 — and Gibbs Cyber Security. You get insurance placement expertise on one side and practical security guidance on the other, with a real person available for coverage discussions and loss-mitigation support.
Plain-language references our clients actually use — researched, cited and kept current.
CyberRiskPolicy.com is a joint venture between the Poindexter Surety Group, an insurance and surety specialist since 1994, and Gibbs Cyber Security. We've spent serious time identifying the cyber insurers that offer the broadest forms, because your business and its continuity matter to us.
When you call, you reach a real person — yes, an actual human — ready to discuss the key coverage elements of a cyber risk policy, whether you're shopping for the first time or reviewing what you already hold. Current policyholders can also tap our security experts to discuss loss-mitigation practices.
Three decades placing specialty insurance and surety.
Human underwriting and human answers.
Gibbs Cyber Security on loss mitigation.
Standard and non-standard, financially strong.
Start an application or talk it through with an underwriter. No bots, no "instant" theater — just a straight read on your risk and the coverage that answers it.