Managing Ransomware and District-Wide Shutdowns
Ransomware attacks against schools rarely affect a single workstation. Attackers typically move laterally through the network before deploying encryption, locking down student information systems, email, grading platforms, and building access controls simultaneously. The operational disruption is immediate and total.
The start of the 2025 academic year was marked by a wave of cyberattacks that forced multiple districts into emergency response mode. Business interruption coverage in a cyber policy can respond to these events, but only if the waiting period and coverage trigger are properly structured. A 12-hour waiting period may be reasonable for a corporation; for a school district that must open its doors every morning, even a few hours of downtime creates cascading problems. The policy form matters here: the difference between "system failure" and "security event" as a trigger can determine whether the claim is paid.
A single ransomware event can stall operations for weeks, drain six figures from your bank account, and trigger regulatory scrutiny that lasts far longer than the incident itself. For California businesses that collect consumer data, the financial exposure is compounded by some of the strictest privacy statutes in the country. Understanding how cyber liability coverage, breach response protections, and ransomware provisions work together under the CCPA and CPRA is not optional: it is a baseline operational requirement. This guide breaks down what California businesses in technology, healthcare, and media need to know before purchasing or renewing a cyber insurance policy, including how policy forms respond to industry-specific threats, what gaps to watch for, and where compliance obligations create financial exposure that a general liability policy will never touch.
The Evolving Landscape of Cyber Risk in California
California generates more privacy-related enforcement actions than any other state. The California Privacy Protection Agency has steadily expanded its audit and investigation activity since the CPRA took full effect, and the fines have followed. Businesses with 10 to 500 employees are not exempt from scrutiny: enforcement actions in 2026 have targeted mid-market firms that failed to honor opt-out requests or maintain adequate data inventories.
The financial stakes are real. The average cost of a data breach in the United States reached $11.5 million in 2026, an 11% increase over the prior year. For California companies subject to CCPA and CPRA, the per-record statutory damages of $100 to $750 per consumer per incident can push total exposure well beyond what even a well-capitalized firm can absorb out of pocket.
Compliance Requirements Under CCPA and CPRA
The CPRA created the California Privacy Protection Agency with independent rulemaking and enforcement authority. Businesses that meet the revenue or data-processing thresholds must maintain detailed records of data collection, respond to consumer access and deletion requests within defined timelines, and conduct regular risk assessments for high-risk processing activities. The agency's 2026 enforcement priorities include automated decision-making, data broker registration, and children's privacy, but general data security obligations apply broadly.
Failing to implement "reasonable security procedures" is the most common trigger for statutory damages under the CCPA's private right of action. A cyber liability policy form may respond to the defense costs and damages that follow a class action, but only if the policy's definition of a "privacy wrongful act" aligns with the specific allegations.
Why Standard General Liability is Not Enough
A commercial general liability policy covers bodily injury and property damage. Data is not tangible property under most CGL forms, so a breach that exposes 50,000 consumer records will not trigger your GL coverage. The same is true for business interruption tied to a network security failure: your property policy's business income provision typically requires physical damage to covered property.
Cyber liability fills these gaps with dedicated insuring agreements for network security liability, privacy liability, regulatory defense, and first-party costs like forensic investigation and consumer notification. Without a standalone cyber policy, you are self-insuring every dollar of breach response, legal defense, and regulatory penalty exposure.
By: Caden Braly
Founder of Bloc Cyber Insurance
INDEX
Bloc Cyber and Its Licensed Producers Are Authorized to Place Cyber Coverage in All 50 U.S. States and The District of Columbia.
Cyber liability insurance covers the financial losses your business faces after a cyberattack or data breach. This page explains what the coverage includes, who needs it, what it costs, and how Bloc Cyber helps you get protected fast.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
Core Components of a Modern Cyber Liability Policy
A well-structured cyber policy is not a single coverage: it is a collection of insuring agreements, each with its own trigger, retention, and sublimit. Understanding how these components interact determines whether your policy actually responds when you need it.
First-Party vs. Third-Party Coverage
First-party coverage pays for your own losses: forensic investigation, data restoration, business income lost during downtime, crisis communications, and notification costs. Third-party coverage responds when someone else brings a claim against you: a consumer class action alleging negligent data handling, a regulatory investigation by the California Privacy Protection Agency, or a contractual indemnity demand from a business partner whose data you exposed.
Most policies bundle both, but the sublimits vary dramatically. A policy with a $2 million aggregate limit might cap regulatory defense at $500,000 and notification costs at $250,000. Bloc Cyber reviews these sublimits at the insuring-agreement level before binding, because a headline limit means nothing if the sublimit governing your most likely claim scenario is inadequate.
Ransomware and Cyber Extortion Protection
Ransomware attacks on U.S. businesses continued to escalate through 2026, with mid-market companies increasingly targeted because they often lack dedicated security operations centers. A cyber extortion insuring agreement typically covers the ransom payment itself, the cost of a professional negotiator, and the forensic work needed to determine whether data was exfiltrated before encryption.
The catch is in the conditions. Many forms require prior written consent from the carrier before any payment is made. Some exclude payments to sanctioned entities, which can create a coverage gap if the threat actor is affiliated with a designated group. Waiting periods for business income loss, often 8 to 12 hours, also reduce the effective payout.
Comparison: Basic vs. Comprehensive Cyber Coverage
| Coverage Element | Basic Policy | Comprehensive Policy |
|---|---|---|
| Third-party privacy liability | Included, often with low sublimit | Included, full policy limit |
| First-party breach response | Notification costs only | Forensics, notification, credit monitoring, PR |
| Ransomware/extortion | Excluded or sublimited | Included with negotiation services |
| Regulatory defense and fines | Excluded | Included where insurable by law |
| Business income loss | Excluded | Included with 8-12 hour waiting period |
| Social engineering fraud | Excluded | Optional endorsement, sublimited |
| Dependent business interruption | Excluded | Included for named vendors or broad form |
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
The distinction is not academic. A retailer relying on a BOP endorsement labeled "data breach" may find it provides only $50,000 in notification expense coverage with no provision for PCI assessments, forensic fees, or regulatory defense. That is not cyber insurance; it is a marketing feature.
Some regulatory proceedings involve parallel tracks: the regulator's formal action and an internal investigation your company runs simultaneously. Shadow defense counsel represents your company's interests during the regulatory process without formally appearing before the agency. Monitoring counsel may be appointed under a consent order to oversee your compliance.
The costs for these roles can be substantial. Certain policy forms cover shadow counsel fees as part of the defense cost grant, while others exclude them entirely. Court-appointed monitors in state enforcement actions have generated significant fees that strain organizational budgets, and whether your policy responds to those costs depends on how the form defines "defense costs" and "regulatory proceeding."
Shadow Defense and Monitoring Counsel Roles
Litigation Buyout: Ringfencing Known Legal Disputes
When a target company has pending or threatened litigation, the buyer faces a binary problem: either reduce the purchase price to account for the worst-case outcome or find a way to transfer the risk. A litigation buyout policy does the latter. The insurer assumes the financial exposure of the identified lawsuit in exchange for a one-time premium. Capital commitments in the litigation finance sector rebounded 23% after a two-year contraction, which has expanded insurer appetite for these placements.
| Coverage Element | Basic Cyber Policy | Comprehensive Cyber Policy |
|---|---|---|
| Breach notification costs | Included | Included |
| Forensic investigation | Included, often sublimited | Included with higher limits |
| Regulatory defense (state AG) | Included | Included |
| Government contract disputes | Typically excluded | May be covered by endorsement |
| DFARS 72-hour reporting costs | Not addressed | Can be included |
| Business interruption | Limited waiting period, sublimited** | Lower waiting period, full limit |
| Subcontractor/supply chain liability | Excluded | Available by endorsement |
| CUI-specific breach response | Not differentiated | Addressed in form language |
| False Claims Act defense | Excluded | May be available |
Industry-Specific Risks: Tech, Healthcare, and Media
Each sector carries distinct data exposures that shape how a cyber policy should be structured. A one-size-fits-all form rarely addresses the specific regulatory and contractual obligations that technology, healthcare, and media businesses face in California.
HIPAA and Patient Data Protection for Healthcare
Healthcare organizations handle protected health information governed by HIPAA, and a breach involving PHI triggers both federal and state notification obligations. California law requires notification within specific timeframes, and the penalties for delayed notification compound quickly. The cost per breached healthcare record consistently exceeds every other industry, driven by the sensitivity of medical data and the regulatory complexity of the response.
A cyber policy for a healthcare business should include a HIPAA-specific insuring agreement or endorsement that covers OCR investigations, corrective action plan costs, and the defense of enforcement actions. If your form does not explicitly reference HIPAA, ask your broker why.
Errors and Omissions (E&O) for Technology Firms
Technology companies face a dual exposure: a security failure can trigger both a cyber liability claim and a professional liability claim from a client whose operations were disrupted. Many cyber forms exclude claims arising from professional services, and many tech E&O forms exclude claims arising from network security failures. This gap between the two policies is where claims fall through.
Bloc Cyber places cyber and technology E&O as a combined or coordinated program so the insuring agreements do not conflict. For a SaaS company or managed service provider, this distinction is not academic: it determines whether a client's breach-related lawsuit triggers any coverage at all. Technology companies facing CCPA obligations should review both policy forms side by side before binding.
Intellectual Property and Libel Coverage for Media
Media companies face claims that most cyber policies do not contemplate: defamation, copyright infringement, invasion of privacy through published content, and unauthorized use of a person's likeness. A media liability or media E&O endorsement addresses these exposures, but it is rarely included in a standard cyber form.
If your business publishes content, whether editorial, advertising, or user-generated, your cyber policy needs a media liability insuring agreement or a companion media E&O policy. The CCPA's private right of action adds another layer: consumer data collected through digital media properties is subject to the same breach notification and security obligations as any other business.
Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:
- A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
- An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
- A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.
Average defense costs for technology professional liability claims range from $50,000 to $150,000 depending on complexity and jurisdiction. Settlement amounts vary widely, but six-figure demands are common even for small firms.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
| Coverage Element | Commercial General Liability | Cyber Insurance |
|---|---|---|
| Data breach notification costs | Not covered | Covered under first-party |
| Ransomware payment | Not covered | Covered (subject to sublimit) |
| Regulatory defense | Not covered | Covered under third-party |
| Business interruption from cyberattack | Not covered | Covered with waiting period |
| Funds transfer fraud | Not covered | Covered via cyber crime endorsement |
| Third-party lawsuit over data loss | Excluded or severely limited | Covered under third-party liability |
| Technology product failure | Not covered | Covered under Tech E&O |
How much does a typical PCI forensic investigation cost?
PFI engagements range from $20,000 for a simple, small-merchant investigation to $120,000 or more for complex environments with multiple locations or e-commerce platforms. The card brands dictate the scope, and the merchant pays.
MFA for Remote Access and Privileged Accounts
| Coverage Element | Regulatory Proceedings | Private Right of Action (Data Breach) |
|---|---|---|
| Trigger | AG or CPPA enforcement action | Consumer lawsuit under § 1798.150 |
| Damages Type | Administrative fines ($2,500-$7,500/violation) | Statutory damages ($107-$799/consumer) |
| Defense Costs | Usually covered under regulatory defense | Usually covered under third-party liability |
| Fines/Damages | Often excluded or sublimited | May be covered if "loss" includes statutory damages |
| Insurability | Varies by jurisdiction and intent | Generally insurable in California |
| Typical Sublimit | $250K-$1M on many mid-market forms | Full policy limit if no sublimit applies |
| Consumer Rights Violations | Deletion/access failures can trigger fines | Only data breaches trigger private right of action |
Managing the Breach Response Process
The first 72 hours after discovering a breach determine the trajectory of your legal, regulatory, and financial exposure. A cyber policy's breach response provisions should function as a playbook, not just a reimbursement mechanism.
Legal Defense and Regulatory Fines
California's CCPA private right of action allows consumers to seek statutory damages without proving actual harm. Defense costs in a class action can reach seven figures before any settlement discussion begins. A cyber policy's regulatory defense coverage should extend to investigations by the California Privacy Protection Agency, the state Attorney General, and, for healthcare entities, the HHS Office for Civil Rights.
Not all regulatory fines are insurable under California law. Your policy form may cover the defense costs but exclude the fine itself, or it may cover fines only "where insurable by law." Understanding this distinction before a claim arises is critical. Early 2026 CPPA enforcement actions have reinforced that mid-market companies are squarely within the agency's enforcement scope.
Forensic Investigations and Notification Costs
A forensic investigation determines the scope of the breach: what data was accessed, how the attacker gained entry, and whether exfiltration occurred. California law requires individual notification to affected consumers and, in breaches exceeding 500 residents, notification to the Attorney General. The costs add up quickly: forensic firms typically bill $300 to $500 per hour, and per-record notification costs, including credit monitoring, can run $5 to $30 per individual.
Your policy's breach response sublimit should reflect the volume of records you hold. A company with 200,000 consumer records and a $100,000 notification sublimit is functionally uninsured for its most probable breach scenario.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
No. A data breach or cyberattack is a cyber liability exposure, not a technology E&O exposure. You need a separate cyber liability policy form to cover breach response, notification costs, regulatory defense, and third-party claims arising from a security incident. Many technology companies carry both policies because the exposures are distinct.
FAQ: Does this cover me if I get hacked?
P2PE encrypts cardholder data from the point of interaction (the card reader) to the payment processor's secure decryption environment. A validated P2PE solution removes your systems from PCI scope for those transactions, which directly reduces both your compliance burden and your risk profile. Underwriters recognize P2PE as a meaningful risk reduction and may offer premium credits for merchants using validated solutions.
Implementing Point-to-Point Encryption (P2PE)
FAQ: Will my insurance pay for a CMMC assessment audit?
Standard cyber liability forms do not cover voluntary compliance audits. Some policies include a "cybersecurity improvement" sublimit after a covered incident, but pre-breach assessment costs are a business expense, not an insurable loss.
FAQ: How does NIST 800-171 compliance help if I get hacked?
Documented compliance demonstrates you took reasonable measures to protect CUI. This strengthens your defense in regulatory proceedings and can support your claim that the breach was not caused by negligence. It also reduces the likelihood of a carrier denying your claim based on failure to maintain represented security controls.
Common Questions About California Cyber Insurance
Does my business really need this if I use the cloud?
Yes. Cloud providers operate under a shared responsibility model. Your provider secures the infrastructure; you are responsible for access controls, data classification, and compliance with California privacy law. A breach caused by a misconfigured cloud environment is your liability, not your provider's.
How much does a typical policy cost in California?
Premiums for California businesses with 10 to 500 employees generally range from $1,500 to $25,000 annually, depending on revenue, industry, data volume, and security posture. Healthcare and technology firms typically pay more due to elevated risk profiles.
Will insurance pay the ransom if I'm hacked?
A cyber extortion insuring agreement may cover ransom payments, but the carrier must typically approve the payment in advance. Payments to OFAC-sanctioned entities are excluded. The policy may also cover negotiation costs and forensic expenses related to the extortion event.
Does this cover me if an employee loses a laptop?
If the laptop contains unencrypted personal information and triggers a notification obligation, your cyber policy's first-party breach response coverage should respond. The key variable is whether the data was encrypted: California's breach notification statute exempts encrypted data from mandatory notification.
What is the difference between cyber and data breach insurance?
Data breach insurance is a subset of cyber insurance focused on notification costs and credit monitoring. A full cyber liability policy includes data breach response but also covers network security liability, business income loss, ransomware, regulatory defense, and media liability. The broader form is what most California businesses need.
Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:
- A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
- An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
- A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.
Average defense costs for technology professional liability claims range from $50,000 to $150,000 depending on complexity and jurisdiction. Settlement amounts vary widely, but six-figure demands are common even for small firms.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
| Coverage Element | Commercial General Liability | Cyber Insurance |
|---|---|---|
| Data breach notification costs | Not covered | Covered under first-party |
| Ransomware payment | Not covered | Covered (subject to sublimit) |
| Regulatory defense | Not covered | Covered under third-party |
| Business interruption from cyberattack | Not covered | Covered with waiting period |
| Funds transfer fraud | Not covered | Covered via cyber crime endorsement |
| Third-party lawsuit over data loss | Excluded or severely limited | Covered under third-party liability |
| Technology product failure | Not covered | Covered under Tech E&O |
Will my policy pay for the fines if I'm not compliant?
This depends entirely on the policy form. Some forms cover PCI fines only if the merchant was making good-faith compliance efforts. Others exclude fines arising from known non-compliance. Read the exclusions carefully before binding.
How much does a typical PCI forensic investigation cost?
PFI engagements range from $20,000 for a simple, small-merchant investigation to $120,000 or more for complex environments with multiple locations or e-commerce platforms. The card brands dictate the scope, and the merchant pays.
What is the difference between a fine and an assessment?
A fine is a penalty for non-compliance with PCI DSS standards. An assessment is a cost-recovery mechanism: the card brands and issuing banks recoup their actual losses (fraud charges, card replacement costs) from the breached merchant. Both are financial obligations, but they arise from different triggers and may be treated differently under a policy form.
Before You Buy a Policy
Purchasing cyber coverage for a California business is not a matter of selecting the lowest premium or the highest limit. The policy form itself, its insuring agreements, exclusions, sublimits, and conditions, determines whether you have real protection or an expensive document that does not respond when you file a claim. Your industry, data volume, regulatory obligations under the CCPA and CPRA, and contractual requirements from clients and partners all shape what the right policy looks like.
If you are buying your first cyber policy or renewing an existing one, have a specialist review the actual form with you before you bind. Bloc Cyber works at the insuring-agreement level to identify gaps that a bundled quote will not reveal.
Request a coverage review and know exactly what your policy will and will not do before a claim tests it.
ABOUT THE AUTHOR
Caden Braly
— Founder, Bloc Cyber
I'm Caden Braly, founder of Bloc Cyber, the specialty cyber insurance arm of Braly Insurance. I built Bloc Cyber around one idea: businesses deserve coverage that actually responds when a cyberattack happens. I work closely with clients to understand their exposure, place the right policy through specialty carriers, and stand with them through the claim. My goal is simple — give every business straight answers and protection they can trust.
Full profile → caden@bloccyber.com LinkedIn
Industries We Protect
Cyber Coverage Built for Your Industry
Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.
Healthcare
Banking
Retail / E-Commerce
Legal
Technology / SaaS
Education
Energy / Utilities
Manufacturing
Construction
Defense
Healthcare
HIPAA-grade protection for patient data
725
healthcare breaches disclosed in 2024
HIPAA-grade protection for patient data
▣ Ransomware on EHR systems
▣ PHI exfiltration
▣ Medical device exploits
▣ Business email compromise
Sub-sectors we place
Hospitals and health systems
Physician practices and specialty clinics
Dental practices and DSOs
Behavioral health and addiction treatment centers
Medical billing and revenue cycle management firms
Typical turnaround for indication of terms: 1 business day.
Banking
Coverage that meets FFIEC and NYDFS expectations
$5.9M
average cost of a financial sector breach
Common threats we underwrite against
▣ Wire fraud and BEC
▣ Credential stuffing
▣ Third-party vendor risk
▣ Ransomware
Sub-sectors we place
Community banks
Credit unions
Mortgage lenders and loan originators
Wealth management and RIAs
Payment processors and merchant acquirers
Typical turnaround for indication of terms: 1 business day.
Retail / E-Commerce
PCI-DSS aligned coverage for every checkout
42%
of retailers hit by ransomware in the last year
Common threats we underwrite against
▣ Magecart / card skimming
▣ POS malware
▣ Account takeover
▣ Supply-chain intrusion
Sub-sectors we place
Direct-to-consumer (DTC) brands
Shopify and marketplace sellers
Brick-and-mortar multi-location retailers
Restaurants and QSR franchises
Grocery and specialty food retail
Typical turnaround for indication of terms: 1 business day.
Legal
Privilege, client files, and trust-account safeguards
1 in 4
law firms reported a breach in 2024
Common threats we underwrite against
▣ Wire-transfer fraud
▣ Privileged data theft
▣ Email account compromise
▣ Ransomware
Sub-sectors we place
AmLaw / large firms
Boutique litigation firms
Personal injury and plaintiffs’ firms
Estate planning and trust attorneys
Title and real estate closing firms
Typical turnaround for indication of terms: 1 business day.
Technology / SaaS
SOC 2 and ISO-aligned risk transfer
$4.88M
avg. cost of a SaaS breach in 2024
Common threats we underwrite against
▣ Supply-chain attacks
▣ Cloud misconfiguration
▣ Token and key theft
▣ Zero-day exploits
Sub-sectors we place
B2B SaaS platforms
Managed service providers (MSPs) and MSSPs
Fintech startups
AI and machine learning companies
Cloud hosting and infrastructure providers
Typical turnaround for indication of terms: 1 business day.
Education
FERPA-aligned coverage for student and research data
80%
of K–12 districts hit by ransomware since 2022
Common threats we underwrite against
▣ Ransomware on district networks
▣ Student PII theft
▣ Fake invoice fraud
▣ DDoS on exam platforms
Sub-sectors we place
K-12 public school districts
Private and charter schools
Colleges and universities
EdTech platforms
Tutoring, test prep, and online learning providers
Typical turnaround for indication of terms: 1 business day.
Energy / Utilities
OT and IT coverage for critical infrastructure
24/7
operational-tech monitoring requirements
Common threats we underwrite against
▣ ICS/SCADA intrusion
▣ Nation-state actors
▣ Ransomware on OT
▣ Insider threat
Sub-sectors we place
Municipal utilities (water, electric, gas)
Oil and gas operators
Pipeline and midstream companies
Renewable energy (solar, wind) developers
Electric cooperatives and rural utilities
Typical turnaround for indication of terms: 1 business day.
Manufacturing
Business interruption protection for connected plants
25%
of all ransomware attacks target manufacturing
Common threats we underwrite against
▣ Ransomware halting production
▣ IP theft
▣ ICS exploits
▣ Vendor compromise
Sub-sectors we place
Industrial and heavy equipment manufacturers
Food and beverage processing
Pharmaceutical and medical device manufacturers
Automotive and parts suppliers
Aerospace component manufacturers
Typical turnaround for indication of terms: 1 business day.
Construction
Protection for project files, wires, and jobsite tech
$200K+
average wire-fraud loss in construction
Common threats we underwrite against
▣ Wire-transfer diversion
▣ BEC on project payments
▣ Stolen bid data
▣ Ransomware
Sub-sectors we place
General contractors
Commercial HVAC, electrical, and plumbing subs
Civil and infrastructure contractors
Homebuilders and residential developers
Architecture and engineering (A&E) firms
Typical turnaround for indication of terms: 1 business day.
Defense
CMMC, DFARS, and CUI-compliant risk transfer
CMMC
2.0 compliance required by 2026
Common threats we underwrite against
▣ CUI exfiltration
▣ Nation-state APTs
▣ Supply-chain compromise
▣ Cleared-personnel targeting
Sub-sectors we place
DoD prime contractors
CMMC-regulated subcontractors
Defense software and systems integrators
Aerospace and satellite contractors
Federal IT and cleared staffing firms
Typical turnaround for indication of terms: 1 business day.
The Bloc system
One foundation.
Ten industry-specific builds.
The Bloc mark is built from stackable planes — each one a different angle on the same core structure. That’s how we place coverage: one underwriting discipline, tuned and re-tuned for every industry we serve.
Coverage
A policy you can actually read.
Structured in three clean blocs.
01
First-Party
Your direct losses when an incident hits your business.
✓
Incident response & forensics
✓
Business interruption
✓ Data restoration
✓ Cyber extortion / ransomware
✓ Funds transfer fraud
✓ Reputational harm
02
Third-Party
Your liability to clients, partners, and regulators.
✓
Network security liability
✓
Privacy liability (HIPAA, GDPR, state laws)
✓ Regulatory defense & fines
✓ PCI-DSS fines and assessments
✓ Media liability
✓ Breach notification costs
03
Specialty
Advanced coverages for complex risks and contracts.
✓
Technology E&O
✓
Social engineering fraud
✓ Contingent business interruption
✓ Systems failure
✓ Bricking & hardware replacement
✓ CMMC / regulatory-specific endorsements
Typical limits placed
$1M / $1M starter
$5M / $10M mid-market
$25M+ layered towers
Custom retentions
Common Questions
Cyber Liability Insurance, Explained
What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.
Insights
Field notes from the placement desk.
What carriers are asking right now.
Start a quote
Tell us about your business.
We’ll come back with terms.
We’ll review your stack, your contracts, and your exposure — then place the program against the right markets. Most intakes get indicative terms back within one business day.
01
Quick intake
We only ask what the carriers actually need.
02
Benchmark
Side-by-side terms from 10+ specialty cyber carriers.
03
Bind
Plain-language policy review, e-signed and in force.
