«We are too small to be attacked.» It is what we hear most from business owners in Puerto Rico, and it is exactly what makes small businesses an attractive target. Most attacks are not personal: they are automated, looking for any vulnerable email, password or computer, and small companies tend to have fewer defenses and less technical staff.
How it usually happens
- Fake emails that look real. A supplier «changes» its bank account and you pay the invoice to the scammers.
- Ransomware. Malicious software locks your files and demands a ransom to release them. The business stops.
- Data theft. Customer or employee data leaks: names, Social Security numbers, accounts, medical records.
- Account takeover. Someone gets into your email, online banking or social media with a stolen password.
Beyond the direct damage, an incident involving personal data may require you to notify affected people and authorities under the laws of Puerto Rico and of the states where you have customers. That costs money and time, even before anyone sues you.
What a Cyber Liability policy covers
Policies vary, but they generally have two parts:
- First-party losses: forensic investigation to find out what happened, data and system restoration, legal advice, notification of affected people, credit monitoring, public relations, lost income while the business is down and, in some policies, the response to an extortion demand.
- Third-party liability: claims and lawsuits from customers, employees or partners over the leak of their information, and certain fines or regulatory proceedings where the law allows them to be insured.
Many policies also include a 24/7 response line with specialized attorneys and technicians. In the first hours of an incident, that access is worth as much as the money.
Why your business policy is not enough
General liability and commercial property policies were designed for physical damage: fires, falls, accidents. Most exclude or tightly limit data losses and cyber events. If you have never bought cyber coverage, you most likely have none today.
What does it cost?
There is no single premium. It depends mainly on:
- your revenue and industry (healthcare, professional services and card-based retail tend to be higher risk);
- how many personal records you handle;
- the limits and deductible you choose;
- the controls you already have: two-factor authentication, offline backups, up-to-date software and employee training.
For many small businesses, the annual premium is modest compared with the cost of a single incident. The only way to know for sure is to get a quote with your real information.
The three questions to ask your agent
- Does it cover social engineering fraud and fraudulent transfers? It is the most common loss for small businesses, and many policies exclude it or apply a low sublimit.
- How is business interruption paid? Ask how many waiting hours apply before it starts paying and whether it covers outages at a technology vendor, not just your own systems.
- What controls does the insurer require, and what happens if I do not meet them? Many applications ask about two-factor authentication and backups. If an answer on the application is not true, the claim may be at risk.
Let’s talk about your business
We help you understand your exposure and compare Cyber Liability options across several insurers. Call us at (787) 754-8090 or request guidance online.
This article is general information. Coverage, sublimits and exclusions depend on the terms of each policy.