Cyber and Technology E&O

If you hold client data — tax returns, medical records, source code, customer lists — a breach carries its own bill: forensics, breach counsel, notice to every affected person under the breach-notification law of each state where they live (every state has one), credit monitoring, data restoration, and lost income while the systems are down. Cyber insurance pays those first-party costs and defends the third-party claims and regulatory inquiries that follow. For a practice holding sensitive records, it belongs in the day-one stack.

Buy the social-engineering endorsement by name. The loss that empties small-business accounts is less often ransomware than a convincing email. A “vendor” sends new wire instructions, a “client” asks for an urgent refund to a different account, and your own employee sends the money. That is social-engineering fraud, and because the transfer was voluntary it falls outside the funds-transfer-fraud coverage of a standard crime policy, which answers only for instructions someone else gave your bank without your authority. Cyber forms typically offer it by endorsement with a sublimit around $100,000; crime endorsements run to $250,000 or so. Coverage is usually conditioned on a call-back to a known number before any change to payment instructions. Adopt the call-back rule as office policy whether or not the policy demands it. The household version of the same threat is in section “Professional Liability and Board Service Coverage”.

Software people need the combined form. For a developer or IT contractor, a bug that corrupts client data is a professional error and a data incident at once. Technology E&O covers the failure of your product or service, and usually the third-party side of a network-security claim, but not your own breach-response costs; standalone cyber covers the breach but not the failed deliverable. Two policies from two carriers invite each to point at the other. Buy the combined technology E&O and cyber form that most specialty carriers now sell, so one claim has one home.