Cyber Liability Insurance for California Businesses

Almost never in a meaningful way. General liability responds to bodily injury and physical property damage, and most modern forms carry an electronic data exclusion that removes cyber losses on purpose. Some business owners policies offer a small cyber endorsement — often $25,000 or $50,000 — which sounds reassuring until you price out forensics, legal counsel, and notifying a few thousand people. That endorsement also tends to cover your own costs while leaving out the liability side, so a client lawsuit lands on you. If your business holds customer data, takes electronic payment, or would stop functioning without its systems, a standalone cyber policy is a different product with a different job.

Because you're rarely a target in the deliberate sense. Most attacks are automated and indiscriminate — scanning for exposed remote access, reused passwords, and unpatched systems, then working through whatever they find. Smaller businesses get hit disproportionately hard precisely because there's no security staff, backups are untested, and one compromised email account has access to everything. Attackers also work down the supply chain, using a small vendor's credentials to reach the larger client. Size protects nobody here; it mostly determines how badly a single incident hurts.

More than the ransom, and the rest usually costs more. A proper grant funds an incident response firm to determine scope, a negotiator who deals with the attackers, the payment itself if it is lawful and the right call, and then the recovery work — rebuilding systems, validating backups, and reconstructing data that was never backed up correctly. It should also pick up income lost while you're down. Watch three things on the quote: whether the ransomware sublimit matches the policy aggregate or sits well below it, the waiting period before business interruption starts paying, and any backup warranty. Carriers ask hard questions about offline, tested backups because that single factor drives both your recovery and their loss.

Only if the policy includes social engineering or funds transfer fraud coverage, and only up to that grant's sublimit — which is often far smaller than the headline limit and sometimes absent entirely from base forms. This scenario, where nothing was technically hacked and an employee was simply deceived into sending money, is one of the most frequent losses we handle, and it's also the one people assume is automatically included. Many carriers additionally require a documented verification step, such as calling a known number before changing payment instructions. We ask for the coverage by name, check the sublimit against what a realistic wire from your business would be, and tell you what procedure the carrier expects you to follow.

Expectations have tightened considerably. Multi-factor authentication on email and any remote access is close to universal now, and its absence will get an application declined outright at many markets. Beyond that, carriers commonly look for offline or immutable backups that have been tested, endpoint detection and response rather than basic antivirus, prompt patching, separated administrative accounts, and a written procedure for verifying payment changes. Answer these accurately — an overstated control on the application is a defense the carrier can raise later. If you're missing something, tell us; there are usually markets that will still write you, and knowing the gap is more useful than guessing at it.

It depends on how many records you hold, how much revenue you'd lose per day offline, whether you process payment cards, and what your contracts require. Many smaller California operations land in the $1 million range, while businesses holding health information, financial records, or large customer databases need considerably more. Rather than picking a number, we work through what a realistic incident would actually cost you — notification volume, downtime, restoration, and defense — and size the limit to that. If a client, lender, or landlord is imposing a specific requirement, send us the contract language and we'll confirm the policy satisfies it before you sign.