| Feature | Commercial General Liability (CGL) | Cyber Privacy Liability |
|---|---|---|
| Covers bodily injury/property damage | Yes | No |
| Covers wrongful collection of data | No (excluded by most ISO forms) | Yes |
| Responds to BIPA claims | Typically excluded or sublimited | Yes, if biometric coverage is included |
| Covers regulatory defense | No | Yes, under most forms |
| Covers class action defense costs | Only for covered claims (rare for privacy) | Yes, subject to policy terms |
| Duty to defend vs. duty to reimburse | Duty to defend (standard) | Varies by form: check your policy |
A tax dispute can stall an acquisition for months, destroy a capital structure, or wipe out the economic benefit of a transaction entirely. For mid-market companies engaged in M&A, restructurings, or tax credit transactions, a single uncertain tax position can represent exposure worth multiples of the deal's profit margin. Tax liability insurance exists to transfer that specific, quantifiable risk to an insurer, and understanding how it works, what it covers, and where it stops is essential before you bind a policy or close a deal. This guide walks through known tax position risk, tax opinion backstops, deal-blocking exposures, interest and penalties, and gross-up provisions so you can evaluate whether this coverage fits your situation. The product is narrower and more technical than most commercial insurance lines, and the details matter.
What is Tax Liability Insurance?
Tax liability insurance is a standalone policy designed to indemnify the insured against a specific, pre-identified tax risk. Unlike general commercial policies that respond to unforeseen events, this product addresses a tax position the insured already knows about, has analyzed, and has typically received a legal opinion on. The insurer underwrites the strength of that position, the applicable law, and the potential financial exposure, then agrees to pay if the taxing authority successfully challenges it.
Policies are written on a claims-made or occurrence basis depending on the jurisdiction and the structure of the underlying transaction. Coverage can apply to income tax, sales and use tax, VAT, transfer tax, property tax, or any other levy where a position creates quantifiable risk. The insured purchases the policy to convert an uncertain liability into a fixed premium cost, which is often a fraction of the potential exposure.
Insuring Known Tax Positions and Opinions
The core function of this product is backstopping a known tax position. A company or its advisors identify a position during due diligence, obtain a "should" or "more likely than not" opinion from tax counsel, and then present that opinion to the insurer. The insurer evaluates the legal analysis, the factual record, and the probability of an adverse determination. If the underwriter agrees the position is defensible, the policy is issued.
This is where the product earns its value. A tax opinion alone does not pay the bill if the IRS or a state revenue department disagrees. The insurance policy does. Tax liability insurance covers positions identified during due diligence that standard indemnity or warranty and indemnity insurance would typically exclude as known risks.
How it Differs from R&W Insurance
Representations and warranties insurance covers breaches of the seller's representations in a purchase agreement. It is designed for unknown risks: the ones nobody spotted during diligence. Tax liability insurance works in the opposite direction. It covers a risk everyone has already identified and quantified. R&W policies routinely exclude known tax exposures from coverage, which is precisely why a separate tax liability policy exists. The two products are complementary, not interchangeable.
By: Caden Braly
Founder of Bloc Cyber Insurance
INDEX
Bloc Cyber and Its Licensed Producers Are Authorized to Place Cyber Coverage in All 50 U.S. States and The District of Columbia.
Cyber liability insurance covers the financial losses your business faces after a cyberattack or data breach. This page explains what the coverage includes, who needs it, what it costs, and how Bloc Cyber helps you get protected fast.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
This comparison underscores why relying on a single policy form without reading the endorsements creates dangerous gaps. A thorough form-level review, the kind Bloc Cyber performs before placement, identifies whether your social engineering sublimit actually matches your average outbound wire size.
This comparison underscores why relying on a single policy form without reading the endorsements creates dangerous gaps. A thorough form-level review, the kind Bloc Cyber performs before placement, identifies whether your social engineering sublimit actually matches your average outbound wire size.
Solving Deal-Blocking Tax Exposures
Certain tax risks are large enough to prevent a transaction from closing. A buyer may refuse to accept the exposure, a seller may refuse to provide an indemnity of sufficient duration, or a lender may decline to finance the deal without certainty on the tax treatment. Tax liability insurance breaks the impasse by shifting the risk to an insurer with a rated balance sheet.
Facilitating M&A and Restructuring
In cross-border M&A, tax insurance supports certainty by removing contingent liabilities from the negotiation table. A seller can deliver a clean exit without a multi-year escrow, and a buyer can close without carrying an open-ended liability on its books. For restructurings, the product protects the intended tax treatment of spin-offs, divisive reorganizations, and intercompany transfers. If a restructuring is designed to be tax-free and the IRS later disagrees, the policy responds.
Mid-market companies running lean finance teams benefit here. You do not need to maintain a reserve or negotiate a complex indemnity structure. The premium is paid, the risk is transferred, and the balance sheet is clean.
Protecting Tax Credits and Incentives
Renewable energy projects, historic rehabilitation projects, and R&D-intensive companies rely on tax credits that can be challenged or clawed back. Tax credit insurance protects the economic value of those credits. Solar investment tax credits, for example, can be insured against disallowance due to valuation disputes, eligibility questions, or placed-in-service timing issues.
For companies transferring tax credits under the Inflation Reduction Act's transferability provisions, the buyer of those credits faces real risk that the IRS could later reduce or deny them. Insurance makes the credit transfer bankable.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
| Coverage Element | Standard Policy | Comprehensive Policy |
|---|---|---|
| Ransom Payment Sublimit | $100,000 - $250,000 | Full policy limit |
| Negotiation Services | Panel vendor only | Choice of vendor with pre-approval |
| Sanctions Screening | Included | Included with legal counsel |
| Data Restoration | Subject to separate sublimit | Included in aggregate limit |
| System Rebuild | Limited to like-kind replacement | Includes upgrades if required by regulation |
| Business Interruption Waiting Period | 12 - 24 hours | 6 - 8 hours |
| Dependent Business Interruption | Excluded | Included with sublimit |
Internal Threats: When Employee Information is Compromised
Employee data exposure is often overlooked in privacy liability planning. Your HR systems hold Social Security numbers, direct deposit information, health records, and sometimes biometric data. A breach of employee records triggers notification obligations under state law and can generate lawsuits from your own workforce.
Insider threats, whether from a disgruntled employee exfiltrating data or a payroll vendor suffering a breach, create exposure that sits at the intersection of cyber liability and employment practices liability. Not every cyber form covers claims brought by employees: some policies contain an "insured vs. insured" exclusion that bars coverage when the claimant is also an employee. This is a gap that must be identified during the placement process, not discovered during a claim.
The Four Pillars of Policy Coverage
A well-structured tax liability policy covers four distinct categories of loss. Understanding each one determines whether your policy actually protects you or leaves gaps that surface only at the worst possible time.
Interest and Penalties Protection
If a taxing authority prevails, the tax itself is only part of the bill. Interest accrues from the original due date of the return, and penalties can add 20% to 75% of the underpayment depending on the characterization. A policy that covers only the base tax leaves significant exposure on the table. Most tax liability policies include interest and penalties within the definition of "loss," but the specific treatment varies. Some forms cap penalty coverage or exclude fraud-related penalties. You need to read the policy form before binding.
The Gross-Up Provision Explained
This is one of the most important and most misunderstood features of tax liability insurance. When an insurer pays a claim, the insurance proceeds themselves may be taxable income to the insured. Without a gross-up provision, the insured receives the claim payment, owes tax on that payment, and ends up short. A gross-up clause requires the insurer to pay an additional amount so that after the insured pays tax on the insurance proceeds, the insured is made whole. The gross-up can add 30% to 50% to the claim payment depending on the insured's effective tax rate. Confirm that your policy includes this provision and that the gross-up formula reflects your actual tax situation.
Defense Costs and Legal Fees
Defending a tax position through audit, administrative appeal, and potentially litigation generates substantial professional fees. Tax liability policies typically cover defense costs including legal, accounting, and expert witness fees. Some policies pay defense costs in addition to the policy limit; others erode the limit with each dollar spent on defense. The distinction matters enormously. A $10 million policy that erodes by $2 million in legal fees leaves only $8 million for the underlying tax.
Does my general liability policy cover invoice fraud? No. General liability responds to bodily injury and property damage claims, not financial losses from social engineering. You need a crime policy endorsement or a cyber liability policy with funds transfer fraud coverage.
What if my vendor's email was hacked, not mine? Many cyber forms still respond because the loss resulted from a social engineering attack directed at your employee. The key is whether the policy requires the compromise to originate from your own systems or simply requires that your employee was deceived into transferring funds.
Will the carrier pay if my team did not follow callback procedures? Possibly not. Callback verification is a common policy condition. If your form requires a phone call to a pre-established number before changing wire instructions and your team skipped it, the carrier has grounds to deny the claim.
Are there waiting periods for funds transfer fraud? Some forms impose a waiting period, typically 8 to 24 hours, before coverage attaches. This gives banks time to process recall requests. Ask your broker to confirm whether a waiting period applies to your form.
How much coverage do I need? Look at your largest single outbound payment over the past 12 months. Your sublimit should at least match that figure. A $100,000 sublimit is inadequate if you routinely wire $500,000 to a single vendor.
Can I buy standalone invoice fraud coverage? Standalone social engineering policies exist but are uncommon. Most buyers obtain this coverage through a cyber liability policy or a crime policy endorsement. The cyber route typically offers broader terms and higher sublimits.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
| Coverage Element | Commercial General Liability | Cyber Insurance |
|---|---|---|
| Data breach notification costs | Not covered | Covered under first-party |
| Ransomware payment | Not covered | Covered (subject to sublimit) |
| Regulatory defense | Not covered | Covered under third-party |
| Business interruption from cyberattack | Not covered | Covered with waiting period |
| Funds transfer fraud | Not covered | Covered via cyber crime endorsement |
| Third-party lawsuit over data loss | Excluded or severely limited | Covered under third-party liability |
| Technology product failure | Not covered | Covered under Tech E&O |
Carriers view social engineering as a high-frequency, controllable-risk exposure. Unlike a data breach that may involve millions of records, a wire fraud loss is often the result of a single procedural failure. Insurers price and limit accordingly. A company with a $1 million crime policy might carry only $250,000 in social engineering coverage. If a single BEC attack costs $400,000, the policy pays $250,000 and the insured absorbs the rest. Some endorsements also apply co-insurance, meaning the carrier pays only 50% or 75% of the loss up to the sublimit. On a $250,000 sublimit with 50% co-insurance, your maximum recovery is $125,000.
Why Social Engineering Limits are Lower Than Policy Aggregate
Social engineering losses are almost always first-party: your company sent money to a criminal. The loss belongs to you, not to a customer or third party filing a claim against you. This distinction matters because third-party liability coverage on a cyber form will not respond. You need a first-party coverage grant, either within a crime policy or as a standalone endorsement, that explicitly names social engineering or fraudulent impersonation as a covered peril.
The Importance of First-Party vs. Third-Party Loss
Comparing Policy Structures and Limits
Policy structures vary by insurer, risk type, and transaction context. The table below highlights key differences between a standard and a comprehensive policy form.
Table: Comparison of Standard vs. Comprehensive Tax Coverage
| Feature | Standard Policy | Comprehensive Policy |
|---|---|---|
| Base Tax Coverage | Included | Included |
| Interest | Included | Included |
| Penalties | Capped or excluded | Included (excluding fraud) |
| Gross-Up | Not always included | Included with formula |
| Defense Costs | Erode the limit | Paid in addition to limit |
| Policy Term | Statute of limitations + 1 year | Statute of limitations + 3 years |
| Successor Insured | Requires consent | Automatic for permitted transfers |
| Minimum Premium | Lower | Higher |
The right structure depends on the size of the exposure, the complexity of the tax position, and the insured's risk tolerance. A company using Bloc Cyber for its cyber liability and technology E&O placement understands the value of reading the actual policy form before binding. The same discipline applies here: you need to know what triggers the policy, what erodes the limit, and where coverage stops.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
Common Questions About Tax Insurance
FAQ: What does tax liability insurance actually pay for?
The policy pays the additional tax owed if a taxing authority successfully challenges the insured position, plus interest, applicable penalties, defense costs, and (if included) a gross-up to account for the taxability of the insurance proceeds themselves.
FAQ: Does this insurance cover tax evasion or fraud?
No. Tax liability insurance covers good-faith tax positions supported by a legal opinion. Fraud, intentional misrepresentation, and criminal tax evasion are excluded from every policy form on the market. Negligence penalties may or may not be covered depending on the form.
FAQ: How long does the coverage last after a deal closes?
Most policies run through the applicable statute of limitations plus a tail period of one to three years. For federal income tax, that typically means coverage extends seven to ten years from the filing date, though the specific term depends on the risk and the jurisdiction.
FAQ: Will the insurance company help if the IRS audits me?
Yes, in most cases. The insurer typically has the right to participate in the defense and must consent to any settlement. Many policies require the insured to notify the insurer promptly upon receiving an audit notice or inquiry related to the covered position.
FAQ: How much does a policy typically cost?
Premiums generally range from 2% to 6% of the policy limit, paid as a single upfront amount. A $5 million policy might cost $100,000 to $300,000. Pricing depends on the strength of the tax opinion, the complexity of the position, and the jurisdiction involved. Tax insurance has become a recognized tool for managing deal risk across a wide range of transaction sizes.
We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.
| Coverage Element | Commercial General Liability | Cyber Insurance |
|---|---|---|
| Data breach notification costs | Not covered | Covered under first-party |
| Ransomware payment | Not covered | Covered (subject to sublimit) |
| Regulatory defense | Not covered | Covered under third-party |
| Business interruption from cyberattack | Not covered | Covered with waiting period |
| Funds transfer fraud | Not covered | Covered via cyber crime endorsement |
| Third-party lawsuit over data loss | Excluded or severely limited | Covered under third-party liability |
| Technology product failure | Not covered | Covered under Tech E&O |
It depends on your policy. Many standard policies require a specific "Cyber Crime" endorsement to cover losses from being tricked into sending money to a fraudster.
Does cyber insurance cover social engineering scams?
Is deepfake fraud covered under standard impersonation terms?
It depends entirely on the policy language. Many forms written before 2024 reference only email or written communication. If the endorsement does not explicitly include voice or video impersonation, a deepfake-based claim may fall outside the coverage grant. Ask your broker to confirm the form addresses synthetic media.
Making the Right Choice for Your Risk
Tax liability insurance is a precision instrument, not a general-purpose product. It works when you have a specific, identifiable tax position, a supporting legal opinion, and a quantifiable financial exposure. The policy transfers that exposure to an insurer for a fixed premium, and the coverage includes the base tax, interest, penalties, defense costs, and, in a properly structured form, a gross-up to make the insured whole after tax on the proceeds.
For mid-market companies, this product is most valuable during acquisitions, restructurings, and tax credit transactions where a single position can represent material risk to the balance sheet. The discipline of reviewing policy forms at the insuring-agreement level, something Bloc Cyber applies to every cyber and technology E&O placement, is equally critical here. Know what your policy covers before you need it to pay.
If you are evaluating a tax position that could affect a transaction or your ongoing operations, a specialist review of the policy form is the right first step. Request a review to have a specialist walk through the coverage structure, exclusions, and limits with you before you bind.
ABOUT THE AUTHOR
Caden Braly
— Founder, Bloc Cyber
I'm Caden Braly, founder of Bloc Cyber, the specialty cyber insurance arm of Braly Insurance. I built Bloc Cyber around one idea: businesses deserve coverage that actually responds when a cyberattack happens. I work closely with clients to understand their exposure, place the right policy through specialty carriers, and stand with them through the claim. My goal is simple — give every business straight answers and protection they can trust.
Full profile → caden@bloccyber.com LinkedIn
Industries We Protect
Cyber Coverage Built for Your Industry
Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.
Healthcare
Banking
Retail / E-Commerce
Legal
Technology / SaaS
Education
Energy / Utilities
Manufacturing
Construction
Defense
Healthcare
HIPAA-grade protection for patient data
725
healthcare breaches disclosed in 2024
HIPAA-grade protection for patient data
▣ Ransomware on EHR systems
▣ PHI exfiltration
▣ Medical device exploits
▣ Business email compromise
Sub-sectors we place
Hospitals and health systems
Physician practices and specialty clinics
Dental practices and DSOs
Behavioral health and addiction treatment centers
Medical billing and revenue cycle management firms
Typical turnaround for indication of terms: 1 business day.
Banking
Coverage that meets FFIEC and NYDFS expectations
$5.9M
average cost of a financial sector breach
Common threats we underwrite against
▣ Wire fraud and BEC
▣ Credential stuffing
▣ Third-party vendor risk
▣ Ransomware
Sub-sectors we place
Community banks
Credit unions
Mortgage lenders and loan originators
Wealth management and RIAs
Payment processors and merchant acquirers
Typical turnaround for indication of terms: 1 business day.
Retail / E-Commerce
PCI-DSS aligned coverage for every checkout
42%
of retailers hit by ransomware in the last year
Common threats we underwrite against
▣ Magecart / card skimming
▣ POS malware
▣ Account takeover
▣ Supply-chain intrusion
Sub-sectors we place
Direct-to-consumer (DTC) brands
Shopify and marketplace sellers
Brick-and-mortar multi-location retailers
Restaurants and QSR franchises
Grocery and specialty food retail
Typical turnaround for indication of terms: 1 business day.
Legal
Privilege, client files, and trust-account safeguards
1 in 4
law firms reported a breach in 2024
Common threats we underwrite against
▣ Wire-transfer fraud
▣ Privileged data theft
▣ Email account compromise
▣ Ransomware
Sub-sectors we place
AmLaw / large firms
Boutique litigation firms
Personal injury and plaintiffs’ firms
Estate planning and trust attorneys
Title and real estate closing firms
Typical turnaround for indication of terms: 1 business day.
Technology / SaaS
SOC 2 and ISO-aligned risk transfer
$4.88M
avg. cost of a SaaS breach in 2024
Common threats we underwrite against
▣ Supply-chain attacks
▣ Cloud misconfiguration
▣ Token and key theft
▣ Zero-day exploits
Sub-sectors we place
B2B SaaS platforms
Managed service providers (MSPs) and MSSPs
Fintech startups
AI and machine learning companies
Cloud hosting and infrastructure providers
Typical turnaround for indication of terms: 1 business day.
Education
FERPA-aligned coverage for student and research data
80%
of K–12 districts hit by ransomware since 2022
Common threats we underwrite against
▣ Ransomware on district networks
▣ Student PII theft
▣ Fake invoice fraud
▣ DDoS on exam platforms
Sub-sectors we place
K-12 public school districts
Private and charter schools
Colleges and universities
EdTech platforms
Tutoring, test prep, and online learning providers
Typical turnaround for indication of terms: 1 business day.
Energy / Utilities
OT and IT coverage for critical infrastructure
24/7
operational-tech monitoring requirements
Common threats we underwrite against
▣ ICS/SCADA intrusion
▣ Nation-state actors
▣ Ransomware on OT
▣ Insider threat
Sub-sectors we place
Municipal utilities (water, electric, gas)
Oil and gas operators
Pipeline and midstream companies
Renewable energy (solar, wind) developers
Electric cooperatives and rural utilities
Typical turnaround for indication of terms: 1 business day.
Manufacturing
Business interruption protection for connected plants
25%
of all ransomware attacks target manufacturing
Common threats we underwrite against
▣ Ransomware halting production
▣ IP theft
▣ ICS exploits
▣ Vendor compromise
Sub-sectors we place
Industrial and heavy equipment manufacturers
Food and beverage processing
Pharmaceutical and medical device manufacturers
Automotive and parts suppliers
Aerospace component manufacturers
Typical turnaround for indication of terms: 1 business day.
Construction
Protection for project files, wires, and jobsite tech
$200K+
average wire-fraud loss in construction
Common threats we underwrite against
▣ Wire-transfer diversion
▣ BEC on project payments
▣ Stolen bid data
▣ Ransomware
Sub-sectors we place
General contractors
Commercial HVAC, electrical, and plumbing subs
Civil and infrastructure contractors
Homebuilders and residential developers
Architecture and engineering (A&E) firms
Typical turnaround for indication of terms: 1 business day.
Defense
CMMC, DFARS, and CUI-compliant risk transfer
CMMC
2.0 compliance required by 2026
Common threats we underwrite against
▣ CUI exfiltration
▣ Nation-state APTs
▣ Supply-chain compromise
▣ Cleared-personnel targeting
Sub-sectors we place
DoD prime contractors
CMMC-regulated subcontractors
Defense software and systems integrators
Aerospace and satellite contractors
Federal IT and cleared staffing firms
Typical turnaround for indication of terms: 1 business day.
The Bloc system
One foundation.
Ten industry-specific builds.
The Bloc mark is built from stackable planes — each one a different angle on the same core structure. That’s how we place coverage: one underwriting discipline, tuned and re-tuned for every industry we serve.
Coverage
A policy you can actually read.
Structured in three clean blocs.
01
First-Party
Your direct losses when an incident hits your business.
✓
Incident response & forensics
✓
Business interruption
✓ Data restoration
✓ Cyber extortion / ransomware
✓ Funds transfer fraud
✓ Reputational harm
02
Third-Party
Your liability to clients, partners, and regulators.
✓
Network security liability
✓
Privacy liability (HIPAA, GDPR, state laws)
✓ Regulatory defense & fines
✓ PCI-DSS fines and assessments
✓ Media liability
✓ Breach notification costs
03
Specialty
Advanced coverages for complex risks and contracts.
✓
Technology E&O
✓
Social engineering fraud
✓ Contingent business interruption
✓ Systems failure
✓ Bricking & hardware replacement
✓ CMMC / regulatory-specific endorsements
Typical limits placed
$1M / $1M starter
$5M / $10M mid-market
$25M+ layered towers
Custom retentions
Common Questions
Cyber Liability Insurance, Explained
What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.
Insights
Field notes from the placement desk.
What carriers are asking right now.
Start a quote
Tell us about your business.
We’ll come back with terms.
We’ll review your stack, your contracts, and your exposure — then place the program against the right markets. Most intakes get indicative terms back within one business day.
01
Quick intake
We only ask what the carriers actually need.
02
Benchmark
Side-by-side terms from 10+ specialty cyber carriers.
03
Bind
Plain-language policy review, e-signed and in force.
