Cybersecurity · Insurance
Size the policy from four of your own numbers. Then, before you look at the headline limit again, find the social engineering sublimit.
Add up response, downtime, extortion, liability
Social engineering sublimits are often small
Confirm everything with your broker
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time on the calendar below. Or call 954-539-5678.
Most small firms I talk to have a cyber limit somebody picked because it was a round number. A $1 million limit is a reasonable starting point for many businesses with 10 to 100 employees, but you should size it from four numbers of your own: what a breach response would cost, what a week or two of downtime would cost, what an extortion demand might look like, and what clients or regulators could claim from you. Add them up, round up, and then, before you look at the headline limit again, read the sublimits. That last step is where most of the surprises live.
A short disclaimer, because it matters: this is general information to help you have a better conversation with your broker. It isn’t insurance or legal advice, and policies differ a lot. Confirm everything with your broker and read the actual policy wording.
Cyber policies are split into two halves, and it helps to think about them separately.
First-party coverage pays your own costs: incident response (forensic investigators, a breach lawyer, notification letters, credit monitoring for affected people), restoring data and systems, business interruption while you can’t work, extortion payments and negotiation, and sometimes funds transfer or social engineering fraud.
Third-party coverage pays when others come after you: clients or individuals whose data was exposed, regulators, card brands after a payment-card breach, and claims that your systems passed malware to someone else.
Each of those parts can have its own limit, its own deductible, and for business interruption a waiting period (often several hours before cover starts). So “$1 million” on the declarations page can mean much less for the specific thing that goes wrong.
Picture a 40-person engineering firm with $8 million in annual revenue. It keeps project files in Microsoft 365, holds personal data on about 2,000 employees and contacts past and present, and pays subcontractors by wire, the largest of which run to about $180,000. These figures are illustrative assumptions for the arithmetic, not quotes; your broker and your own records will give you better ones.
That adds up to about $720,000. Rounding up, a $1 million aggregate limit looks right for this firm, and $2 million would be worth pricing if its biggest client contracts require it. So far, so ordinary.
Now the line that matters. This firm wires up to $180,000 at a time. If someone in accounts is tricked by a convincing email from a “subcontractor” with new bank details, the loss is $180,000 in a single afternoon. If the social engineering sublimit is $50,000, the firm is underinsured on the most likely large loss it faces, regardless of what the headline says. For this firm I’d want that sublimit at $250,000, or a separate crime policy with a dedicated limit.
I think the social engineering sublimit is the most overlooked number in small-business cyber cover. The headline limit gets all the attention, but in my view the large loss a small firm is most likely to suffer is a payment sent to the wrong account. The FBI’s Internet Crime Complaint Center recorded more than $3 billion in reported business email compromise losses in 2025, and those are only the ones people reported.
Meanwhile, social engineering cover is often a small sublimit inside the cyber policy, or absent until you ask for it. Vouch, an insurer for startups and small businesses, gives the example of a company with $2 million of cyber cover and only $250,000 for social engineering fraud within that policy, and notes that these sublimits are often a flat carve-out rather than scaled to what you could actually lose. To be fair to insurers, there’s a reason: this is a loss that good process prevents (call the supplier back on a number you already have before changing bank details), and they don’t want to pay for skipped steps. Be that as it may, you should know your number. A sensible rule is that the sublimit should be at least as large as the biggest payment your staff can send without a second person checking it.
If you want an outside view of where your controls stand before you renew, our free Technology Health Assessment covers cybersecurity and business continuity in plain language. It’s 30 minutes of data collection and a report the next day, yours to keep. Pick a time here.
If your own estimate feels high, it probably isn’t. According to published summaries of NetDiligence’s 2025 Cyber Claims Study (I’m going by those summaries, not the full report), the five-year average incident cost for small and medium enterprises was about $246,000 per claim. Its SME category covers organizations with less than $2 billion in revenue, so it isn’t a perfect match for a 40-person firm, but it’s the right order of magnitude. The same summaries say claims involving business interruption averaged more than 650% higher than claims without it, and that insurance payouts covered 32% of total incident costs across all organization sizes (69% for SMEs over five years). Even at the better SME figure, roughly a third of the cost stayed with the business. Some of that is deductibles; some is losses nobody insured.
That last one deserves a moment. Claims can be disputed when the application said MFA was everywhere and it wasn’t. Our guide to cyber insurance requirements lists what insurers ask, and our cybersecurity service includes help with those questionnaires, so the answers match reality. For premiums, see what cyber insurance costs.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
For many firms with 10 to 100 employees it is a sensible starting point, but it depends on your revenue per day, how much personal data you hold and what your contracts require. Work through your own estimate, and check the sublimits inside that $1 million, especially for social engineering and business interruption.
It’s a smaller cap inside the policy for losses where someone is tricked into sending money, such as a fake invoice or a spoofed email from the CEO. Many policies cover this at a fraction of the headline limit, or only if you add it. If you regularly wire large sums, ask for it specifically.
Often, yes. Some larger clients require vendors to carry a minimum amount of cyber or technology liability coverage, written into the contract. Read your biggest contracts before you talk to your broker.
It usually affects whether you can get coverage at all and on what terms. Insurers ask about MFA, backups, endpoint protection and training on the application. Weak answers can mean higher premiums, exclusions or a declined application. This is general information, so confirm the specifics with your broker.
