The assumption that attackers only chase large enterprises has been wrong for years. Small firms are targeted because they hold useful data and rarely have a dedicated security team.
What cyber liability pays for
Forensics to work out what happened, legal counsel, notification of affected individuals, credit monitoring, regulatory defence, and — where covered — extortion payments and lost income during downtime.
First-party vs. third-party
First-party covers your own losses. Third-party covers claims brought against you by customers or partners. Cheap policies often trim the first-party side, which is where most small-business losses actually land.
Social engineering is a separate endorsement
The most common real-world loss is an employee wiring money to a convincing fake invoice. That is fraud, not a data breach, and it needs its own endorsement. Check the sub-limit.
Controls affect price
Multi-factor authentication, offline backups and endpoint detection now materially reduce premium — and some carriers will not quote without them.
