What does cyber insurance cover?

Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.

Does my business really need cyber insurance?

Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.

How fast can I get a quote?

Most clients receive a quote in under 24 hours after we review the details of their business and exposure.

What should I do first after a cyberattack?

Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

San Francisco Cyber Insurance (Request a Quote Online)

Three scenarios dominate the claims data. First, a compromised vendor email chain leads your AP team to redirect a legitimate invoice payment to a new bank account controlled by a criminal. Second, a spoofed executive email instructs your controller to wire funds for a confidential acquisition or urgent tax payment. Third, a threat actor compromises your company's own email system and intercepts outbound payment instructions to your clients, redirecting incoming payments. Each scenario triggers a different coverage grant, and some policies cover only one or two of the three.

Common Wire Transfer Loss Scenarios

A single compromised API key at a Series B startup can trigger a regulatory investigation, a class-action notification obligation, and a seven-figure incident response bill within 72 hours. For software companies, AI firms, venture-backed startups, and fintech operators headquartered in San Francisco, the question is not whether a cyber event will occur but how the policy form responds when it does. Cyber insurance for California tech and finance firms requires more than a checkbox purchase: it demands a line-by-line understanding of insuring agreements, sublimits, and exclusions that separate a policy that pays from one that does not.

This guide covers the specific cyber liability, ransomware, and funds transfer fraud exposures that San Francisco technology and financial services companies face, the coverage components that matter most, and the regulatory framework that shapes how policies must be structured in California. Whether you are buying your first policy ahead of a funding round or renegotiating terms after a claim, the details below will help you ask sharper questions before you bind.

San Francisco's concentration of software, AI, and fintech companies creates a dense target environment. The city's firms process enormous volumes of personal data, financial credentials, and proprietary code, and threat actors know it. A breach at a 50-person fintech company can expose hundreds of thousands of consumer records, triggering obligations under both federal and California state law. The risk profile is not theoretical: cyber insurance claims from technology firms have grown steadily, with ransomware and social engineering losses driving much of the increase.

Software and AI companies hold two assets that attackers prize: large datasets and access to downstream customer environments. A compromised SaaS platform does not just affect the vendor; it creates cascading liability across every client that relies on the service. AI firms face an additional exposure: model training data often includes personal information subject to privacy regulation, and a breach of that data triggers notification duties that can span multiple jurisdictions.

California has also enacted significant AI safety legislation affecting frontier AI developers, adding a regulatory layer that intersects directly with how cyber policies respond to AI-related incidents. If your company builds or deploys AI models, the policy form needs to address these exposures explicitly, not through a generic technology endorsement.

Startups between seed and Series B often operate with lean engineering teams, minimal security operations centers, and infrastructure that scales faster than its security posture. Shared cloud environments, open-source dependencies with unpatched vulnerabilities, and rapid employee onboarding without strict access controls create attack surfaces that mature enterprises have already hardened.

The financial pressure is real, too. A startup burning $400,000 per month cannot absorb a $1.2 million incident response cost without existential consequences. Cyber insurance becomes a balance-sheet protection tool, but only if the policy form actually covers the startup's specific risk profile, including cloud-hosted data, contractor access, and third-party integrations. Bloc Cyber works with venture-backed companies at this exact inflection point, reviewing policy forms at the insuring-agreement level before binding so founders and CFOs understand what triggers coverage and where gaps remain.

We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.

Forensic Investigations: Identifying the Source and Scope

Forensic investigators determine how the attacker got in, what data was accessed, whether exfiltration occurred, and whether the threat actor is still present in the network. Their report drives every downstream decision: which individuals must be notified, whether payment card brands must be alerted, and what remediation steps are necessary. Forensic engagements for mid-market companies commonly run between $30,000 and $150,000, depending on the complexity of the environment. The policy form may impose a separate sublimit on forensic costs or bundle them under a single breach response aggregate. Bloc Cyber reviews these sublimits at the insuring-agreement level before binding, so clients understand exactly how much forensic coverage they are purchasing and where the cap sits relative to their actual exposure.

A properly structured cyber liability policy has both first-party and third-party components. First-party coverage responds to your own losses: forensic investigation, business interruption, data restoration, and ransom payments. Third-party coverage responds when someone else sues you or a regulator investigates you: defense costs, settlements, regulatory fines, and notification expenses. The distinction matters because cyber insurance has become a functional utility for businesses of all sizes, and understanding the mechanics is essential to purchasing it correctly.

Ransomware coverage typically sits within the first-party insuring agreement. It may cover the ransom payment itself, the cost of a negotiation firm, forensic investigation, and business interruption losses during the downtime. The catch is in the details: many forms impose coinsurance on ransom payments (requiring you to bear 30-50% of the payment), set sublimits well below the aggregate, or exclude ransomware events that originate from unpatched known vulnerabilities.

Incident response coverage should include pre-approved vendor panels for forensics, legal counsel, and public relations. If your policy requires carrier approval before you engage a breach coach and the carrier takes 48 hours to respond, you have lost critical containment time. Review the waiting period and the approval mechanism before you sign.

Funds transfer fraud coverage responds when an employee is deceived into wiring money to a fraudulent account, typically through a spoofed email from a vendor or executive. Social engineering endorsements are often sold as sublimits within the crime or cyber policy, and those sublimits can be surprisingly low: $100,000 or $250,000 against a potential seven-figure loss.

The policy language matters here. Some forms require a "direct" communication from the fraudster to the employee, which may exclude scenarios where the attacker compromises a vendor's email system and sends instructions that appear legitimate. Others exclude losses discovered more than 30 days after the transfer. If your company processes wire transfers regularly, this endorsement needs careful review.

California's breach notification statute requires companies to notify affected residents "in the most expedient time possible and without unreasonable delay." The cost of notification, credit monitoring, and call center services for a breach affecting 100,000 records can exceed $500,000 before any lawsuit is filed. Third-party coverage should include regulatory defense costs, which are separate from notification expenses and can escalate quickly if the California Attorney General opens an investigation.

FAQ: Does my general business insurance cover hacking?

Almost certainly not. Standard CGL and BOP policies contain electronic data exclusions. Even if your policy has a small "data breach" endorsement, it is typically capped at $50,000 to $100,000, which will not cover a meaningful incident. A standalone cyber liability form provides the breadth and limits required for a real claim.

FAQ: How does a consent order affect my future premiums?

A consent order signals increased risk to underwriters. Expect premium increases at renewal, potentially 25 to 100 percent or more depending on the severity of the order and your compliance track record. Some carriers may decline to renew entirely if the consent order reveals systemic compliance failures.

Law firm cyber coverage is not a commodity product you can purchase by checking a box on a general liability application. The risks are specific: trust account fraud, privileged document exposure, deal data theft, multi-state notification obligations, and business interruption measured in lost billable hours. Your policy needs to reflect those risks at the insuring-agreement level, with sub-limits and retentions that match your actual exposure.

Do not wait for a breach to discover that your social engineering sub-limit is $100,000 on a $1.2 million wire or that your business-interruption waiting period is 24 hours when your systems were down for a week. If you are purchasing your first cyber policy or renewing an existing one, have a specialist review the actual policy form with you. Bloc Cyber's practice is built entirely around cyber, technology E&O, and AI liability placement. You can request a coverage review to have a specialist walk through the insuring agreements, sub-limits, and exclusions specific to your firm's risk profile before you bind.

Coverage Area	General Liability	Cyber Liability
Ransomware payment	Not covered	Covered (subject to sublimits and coinsurance)
Data breach notification	Not covered	Covered under first-party insuring agreement
Regulatory defense (CCPA/CPRA)	Not covered	Covered under third-party insuring agreement
Funds transfer fraud	Not covered	Covered via endorsement or sublimit
Business interruption from network outage	Not covered (no physical damage trigger)	Covered with applicable waiting period
AI-related liability	Increasingly excluded	May be covered depending on policy form

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

Most states have not passed explicit statutes declaring regulatory fines insurable or uninsurable. Instead, the question turns on public policy: courts in some jurisdictions hold that allowing insurance to pay a punitive or regulatory fine would undermine the fine's deterrent purpose. New York, for example, has case law suggesting that certain regulatory penalties are uninsurable on public policy grounds. Texas and California courts have taken different positions depending on the type of fine and the regulatory scheme involved.

Your policy form will typically include language stating that fines and penalties are covered "to the extent insurable under applicable law." This shifts the jurisdictional analysis to the time of claim. Bloc Cyber maintains state-by-state fluency in breach-notification triggers and regulatory defense exposure, which matters when your operations span multiple states with different public policy positions on fine insurability.

State-by-State Variations in Public Policy and Uninsurable Fines

Companies with operations in the EU, UK, or Asia-Pacific face additional complexity. GDPR fines imposed by European data protection authorities can reach four percent of global annual revenue. Whether a US-placed policy can respond to a GDPR fine depends on the policy's territorial scope, the choice-of-law provisions, and whether the jurisdiction where the fine is imposed permits its insurance.

Many standard cyber forms limit territorial coverage to the United States and its territories. If your company has employees, customers, or data processing activities in Europe, you need a form with international regulatory coverage or a locally admitted policy in the relevant jurisdiction. The cost of getting this wrong is not theoretical: monitor and compliance fees in cross-border enforcement actions can compound rapidly when multiple regulators coordinate investigations.

International Considerations for Multinational Regulatory Risks

Addressing Known Issues and Exclusions

Any issue identified during diligence that is disclosed to the underwriter becomes a known issue and is excluded from coverage. This is a fundamental principle of R&W insurance: it covers unknown breaches, not problems you already know about. Buyers sometimes assume they can disclose a problem and still obtain coverage for it. They cannot. The underwriter will carve out any known matter, and the buyer must negotiate a specific indemnity from the seller or accept the risk. This is where the interplay between your diligence process and your insurance placement becomes critical: thoroughness in diligence improves your coverage, but every issue you find narrows it.

For companies that carry cyber liability or technology E&O policies, this dynamic should feel familiar. At Bloc Cyber, we see a parallel in how cyber insurers evaluate a company's security posture before binding coverage: known vulnerabilities get excluded or trigger higher retentions, just as known issues do in R&W underwriting.

How much does cyber insurance cost for a small firm?

A firm of 10 to 25 attorneys can typically expect premiums in the range of $3,000 to $12,000 annually for $1 million in coverage, depending on practice areas, security controls in place, and claims history. Firms handling real estate closings or M&A work will pay more because of the wire-fraud exposure.

Your SOC 2 report documents what your controls look like. Your cyber policy form defines what happens financially when those controls fail. A first-party breach response grant typically covers forensic investigation, legal counsel, notification costs, and credit monitoring. A third-party liability grant covers defense costs and settlements arising from claims by affected individuals or businesses. Technology E&O coverage responds when a failure in your product or service causes financial harm to a client.

The critical question is whether the policy form covers the specific failure mode your SOC 2 report flagged. If your report noted an exception in access management and an attacker later exploited that exact weakness, the carrier's claims team will review whether the application was answered accurately. Misrepresentation on an application can void coverage entirely, which is why aligning your SOC 2 findings with your insurance application answers is not optional.

The table above shows that SOC 2 and cyber insurance requirements overlap heavily, but insurance applications often go further on specific technical controls. A SOC 2 report alone does not satisfy every underwriting question.

The California Consumer Privacy Act and its amendment, the California Privacy Rights Act, grant consumers the right to know what data is collected, to delete it, and to opt out of its sale. CPRA also created the California Privacy Protection Agency, which has enforcement authority independent of the Attorney General. Violations can result in fines of $2,500 per unintentional violation and $7,500 per intentional violation, and the private right of action under CCPA allows consumers to sue for statutory damages between $100 and $750 per consumer per incident following a data breach.

Your cyber policy's regulatory defense coverage should explicitly include CCPA/CPRA proceedings. Some forms exclude "regulatory actions" from the definition of a covered claim, which would leave you without defense cost coverage in exactly the scenario where you need it most.

Venture capital firms increasingly require portfolio companies to carry cyber insurance as a condition of funding. The expectation is not just that you have a policy, but that the policy meets minimum standards: aggregate limits of $1 million to $5 million depending on stage, coverage for regulatory proceedings, and incident response provisions that include pre-breach planning.

Insurance requirements for AI startups have become a focal point in due diligence, particularly as investors evaluate operational risk alongside product-market fit. If you are preparing for a funding round, having a policy form reviewed at the endorsement level, not just the declarations page, demonstrates operational maturity that investors notice.

The gap between a basic crime policy and a comprehensive fraud protection program is significant. The table below highlights key differences.

This comparison illustrates why a general liability policy, even one with a broad "personal and advertising injury" grant, will not respond to a regulatory proceeding. The coverage must be placed specifically under a cyber or technology E&O form that includes regulatory defense as a named insuring agreement.

Coverage Feature	Basic Crime Policy	Comprehensive Cyber with Fraud Coverage
Computer Fraud	Typically included	Included
Social Engineering	Optional endorsement, low sublimit	Included, higher sublimits available
Push Payment Fraud	Often excluded	May be covered as separate grant
Account Takeover	May fall under computer fraud	Explicitly covered
Forensic Investigation	Not covered	First-party expense coverage
Legal and Regulatory Costs	Not covered	Included
Callback Verification Required	Yes, strict condition	Yes, but terms vary by form
Typical Sublimit Range	$100K - $250K	$250K - $1M+

R&W retentions function similarly to a deductible but are typically structured as a percentage of enterprise value. A common retention for mid-market deals sits between 1% and 3% of the transaction value. On a $50 million deal, that means the buyer absorbs the first $500,000 to $1.5 million of covered losses before the insurer pays anything. The retention exists because underwriters expect the buyer's own diligence to catch smaller issues. Retention levels are negotiable and vary by carrier, deal size, and the quality of the diligence package presented during underwriting.

How Retention Works as a Deductible

The Transition from Retention to Drop-Down Coverage

Most R&W policies include a drop-down feature that reduces the retention, often by half, after a specified period, typically 12 months post-closing. If the original retention is $1 million, it drops to $500,000 after the first year. This mechanism reflects the assumption that the most significant breaches surface early. The reduced retention in the later period provides the buyer with more accessible coverage for claims that emerge after the initial post-closing adjustment period. Some policies offer a full drop to zero retention after 18 or 24 months, though this depends on the specific terms negotiated with the underwriter.

How much cyber coverage does a 50-person software company need? Most companies in this range carry $1 million to $3 million in aggregate limits. The right number depends on your data volume, contractual requirements, and revenue. A company processing payment card data has a different exposure profile than one building internal developer tools.

What is a typical retention (deductible) for a cyber policy? Retentions for small to mid-market companies generally range from $5,000 to $50,000. Higher retentions reduce premium but increase your out-of-pocket cost on smaller claims.

Does cyber insurance cover employee mistakes? Yes, most forms cover "wrongful acts" that include negligent acts or omissions by employees. The key is whether the specific act falls within the policy's definition of a covered event.

How long does a cyber claim take to resolve? Simple breach notification claims may resolve in 60-90 days. Complex ransomware or regulatory defense matters can take 12-18 months or longer.

Will my policy cover a vendor's data breach that affects my customers? Dependent business interruption and contingent liability endorsements may respond, but many forms limit this coverage to vendors specifically listed on the application or subject to a sublimit. Review this language carefully.

Are fines and penalties covered? Coverage for fines and penalties depends on the policy form and the jurisdiction. California permits insuring certain regulatory fines, but the policy must explicitly include them, and some forms cap this coverage at a sublimit.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

State-by-State Variations in Public Policy and Uninsurable Fines

International Considerations for Multinational Regulatory Risks

Addressing Known Issues and Exclusions

Post-Incident Forensic and Legal Obligations

After a SCADA or OT intrusion, you will likely face parallel investigations: your own internal forensic team, your insurer's panel forensics firm, CISA, and potentially your state public utility commission. A coordinated attack on Minnesota water utilities demonstrated how quickly a regional incident can trigger multi-agency scrutiny.

Your policy should not restrict your choice of forensic investigators to a panel that lacks OT expertise. If the form requires you to use a pre-approved vendor, confirm that vendor has ICS forensic capability. The wrong forensic team can miss artifacts specific to industrial protocols like Modbus or DNP3, leaving you with an incomplete investigation and a disputed claim.

How much does cyber insurance cost for a small firm?

The right cyber insurance program for a San Francisco tech or fintech company is not a product you select from a menu. It is a coverage structure built around your specific data flows, regulatory obligations, contractual requirements, and growth trajectory. A pre-revenue AI startup and a $30 million ARR fintech platform need fundamentally different policy architectures, even if both face ransomware and social engineering threats.

What separates adequate coverage from a policy that fails at claim time is the form-level detail: how the insuring agreements define a covered event, where sublimits restrict recovery, what waiting periods apply to business interruption, and whether AI-related exposures are affirmatively covered or silently excluded. Cyber liability coverage continues to evolve as a core business expense in 2026, and the companies that treat it as a strategic decision rather than a compliance task are the ones that recover from incidents without existential damage.

If you are evaluating cyber coverage for the first time or questioning whether your current policy would actually respond to a claim, request a review with a specialist who will walk through the policy form with you, identify gaps before a claim finds them, and structure coverage around your actual risk profile.

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Get In Touch

San Francisco Cyber Insurance

Common Wire Transfer Loss Scenarios

Cyber Risks for San Francisco Tech and Finance Firms

Why Software and AI Companies are High-Value Targets

The Vulnerabilities of Venture-Backed Startup Infrastructures

Forensic Investigations: Identifying the Source and Scope

Core Components of Modern Cyber Liability Coverage

Ransomware Protection and Incident Response

Funds Transfer Fraud and Social Engineering Scams

Data Breach Notification and Legal Defense Costs

FAQ: Does my general business insurance cover hacking?

FAQ: How does a consent order affect my future premiums?

Comparing Coverage: General Liability vs. Cyber Liability

Comparison Chart: Where General Liability Falls Short

State-by-State Variations in Public Policy and Uninsurable Fines

International Considerations for Multinational Regulatory Risks

Addressing Known Issues and Exclusions

How much does cyber insurance cost for a small firm?

California Compliance and Regulatory Requirements

Navigating CCPA and CPRA Regulations

Cyber Insurance Standards for VC Funding Rounds

How Retention Works as a Deductible

The Transition from Retention to Drop-Down Coverage

Common Questions About Cyber Coverage

FAQ: Understanding Limits, Deductibles, and Claims

State-by-State Variations in Public Policy and Uninsurable Fines

International Considerations for Multinational Regulatory Risks

Addressing Known Issues and Exclusions

Post-Incident Forensic and Legal Obligations

How much does cyber insurance cost for a small firm?

Making the Right Choice for Your Growth Stage

Caden Braly

Cyber Coverage Built for Your Industry

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

Healthcare

One foundation.Ten industry-specific builds.

A policy you can actually read.Structured in three clean blocs.

First-Party

Third-Party

Specialty

Cyber Liability Insurance, Explained

What does cyber insurance cover?

Does my business really need cyber insurance?

How much does cyber insurance cost?

What is the difference between first-party and third-party cyber coverage?

How fast can I get a quote?

What should I do first after a cyberattack?

Field notes from the placement desk.What carriers are asking right now.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Defense Contractor Cyber Risk: Protecting Controlled Unclassified Information

Retail Cyber Risk: Payment Data, Loyalty Systems and Seasonal Exposure

Tell us about your business.We’ll come back with terms.

One foundation.
Ten industry-specific builds.

A policy you can actually read.
Structured in three clean blocs.

Field notes from the placement desk.
What carriers are asking right now.

Tell us about your business.
We’ll come back with terms.