What cyber insurance does not cover, for a US small business

A US cyber policy does not cover war and state backed attacks, your own dishonesty, the vulnerability you already knew about and left open, or the injury and property damage that belong on your general liability policy. Every carrier publishes that list and it is close to useless, because almost nobody loses money to an exclusion. They lose it to a sublimit they never read, or to a definition inside an endorsement they were sure they had bought.

The question worth asking is the other one: what does cyber insurance cover, and up to how much? So I opened the documents. Five carriers, one marketplace, two Travelers application forms, the market report published by the association of the state insurance regulators, a Lloyd’s market bulletin, and a federal court opinion from March 31, 2026, in which a law firm that had bought the social engineering endorsement still lost $158,425.

This is what those documents say, in their words, and there is a checklist at the end you can take to the renewal call.

If you are reading this because a broker just sent you a renewal package with a page of questions about artificial intelligence, that is a different problem with a different answer, and it has its own guide.

What it costs a year, before anything else

Three carriers publish a price, all three are honest, and none of them can be compared with the others. The table puts them next to a size, which is the comparison the published pages do not make. Further down, we explain why each one has to be read with its own fine print.

Business	What is actually published	Our estimate, a year
Under 5 employees, consultant or small practice	The Hartford about $320 a year; Hiscox $29.57 a month, about $355 a year, at a $250,000 limit with a $10,000 deductible. Pages read September 16, 2026	$320 to $700
5 to 20 employees, holding client records	Insureon $129 a month, $1,552 a year, a median across its customers, most of which have fewer than five employees. Page updated April 24, 2026	$700 to $2,000
21 to 50 employees, or funds transfer exposure	nothing published; Chubb quotes online below $100,000,000 of revenue and the rest is placed through brokers	$2,000 to $6,000

The middle column is quoted from the source named in it, and the right column is our own estimate: not a quote, and not an insurer’s figure.

Where it comes from: it places the published prices on the three bands that two independent European sources draw in the same place, Amrae’s LUCY study of 20,996 policies for 2025 (average premiums of €645, €1,600 and €5,000 by company size) and AIG’s own Irish service tiers (€899 or less, €900 to €4,999, €5,000 or more). Your premium comes out of your application, not out of this table.

What the policies actually exclude, and what a marketing page calls an exclusion

There are two kinds of page on this subject and it is worth knowing which one you are reading. The first quotes the policy. The second is an advertisement with a heading that promises exclusions and then sells you something else.

The Hartford came up on the first page of US results for cyber insurance for small business on September 16, 2026. Its page has a heading that reads “What Is Not Covered by Cyber and Data Breach Insurance for Small Businesses?” and underneath it there is not one policy exclusion. There are five other products: general liability, commercial property, employment practices, professional liability, technology professional liability. All true, none of it an exclusion.

For a professional firm the relevant one of those five is professional liability, because whether a disclosure counts as a breach at all often decides which policy is even in play.

Hiscox does the opposite and publishes a real list. Seven items, including criminal proceedings, utility failures, intentional misconduct, incidents you already knew about, and failures of other companies’ systems unless you add dependent system failure coverage. Two of the seven are worth stopping on.

The one that catches people is money

Hiscox writes that “Unless covered under the cyber crime add-on, financial losses from stolen or misdirected funds are excluded”. That is the wire you sent to the wrong account. It is the largest single category of claim in the one US book of business that publishes its numbers, which is measured two sections below, and on that page it sits in the exclusions column with a footnote pointing at an optional extra.

The one nobody notices is biometric data

Hiscox describes its privacy liability as covering claims and regulatory investigations tied to data privacy laws, “excluding biometric data”. Illinois has a dedicated biometric privacy statute with a private right of action, which is exactly the kind of claim a small employer with a fingerprint time clock can attract, and that exclusion is written in the same sentence as the coverage.

document	what it is	dated
Hiscox cyber page	a published exclusion list, plus priced examples	read September 16, 2026
Travelers CYB-14202	CyberRisk renewal application	Ed. 01-19
Travelers CYB-14302	social engineering fraud supplement	Ed. 01-19
Chubb cyber products	product list and what sits on an endorsement	read September 16, 2026
Coalition Active Cyber Policy	launch announcement, limits and structure	April 9, 2025
NAIC cyber market report	the whole US market, by premium and policy count	2024 data
Gore v. Spinnaker, N.D. Miss.	opinion and order on a denied claim	March 31, 2026

The Federal Trade Commission publishes a short guide for small business, and it earns its place in the results: it is the only one here that tells you what to look for rather than what to buy. Its three checks are worth copying straight into your own notes.

what to check	the FTC’s own wording
duty to defend	“Defend you in a lawsuit or regulatory investigation (look for ‘duty to defend’ wording)”
excess over other coverage	“Provide coverage in excess of any other applicable insurance you have”
the hotline	“Offer a breach hotline that’s available every day of the year at all times”

(Source: FTC, Cyber Insurance, small business guidance.)

What does cyber insurance cover? Look at the sublimit, not the exclusion list

It is easier to answer whether you have cyber insurance than to say what the limit is. There is a structural reason for that, and the regulators measured it.

In its report on the cyber insurance market, using 2024 data, the National Association of Insurance Commissioners splits US cyber coverage three ways: primary policies, excess policies, and endorsements attached to another policy. Endorsements were 55.1 percent of every cyber policy in force in the country. They were 4 percent of the premium.

55.1%

What that ratio is telling you

More than half the cyber coverage in the United States is a line item bolted onto a business owner’s policy, and all of those line items together account for 4 percent of what the country pays for cyber. There is nothing scandalous about that: the product is doing what it was priced to do. But it means the sentence “we have cyber” is usually a sentence about an endorsement whose limit nobody has looked up.

For a firm of five to fifty people, which is the size we write for, that line item is often the entire cyber program, and its limit was set when the business owner’s policy was written.

Where to look, and what you are looking for

The number is on the declarations page, not in the brochure. What matters is not the headline aggregate but the line items underneath it, because a policy can advertise one million dollars and cap the coverage you will actually claim on at a fraction of it.

Line on the declarations	Amount
Aggregate limit of liability	$1,000,000	incident response expenses run to the same $1,000,000
Business interruption	$250,000	waiting period 8h
Cyber extortion	$250,000
Regulatory defense and penalties	$500,000
Funds transfer fraud	$50,000	sublimit, and the likely claim
Social engineering	$25,000	a separate sublimit line
Retention, each incident	$10,000	defense costs sit within the aggregate limit

Worked example, figures invented.

Two of those lines are the ones that decide whether the policy was worth buying, and neither of them is the million dollars on the top line. The third is the last line, and it is the reason the FTC tells you to look for duty to defend wording.

Defense inside the limit, and what claims-made means

Travelers puts both facts in bold type at the head of its CyberRisk application forms, before a single question. One legend reads “Claims-Made: The information requested in this Application is for a Claims-Made policy. If issued, the policy will apply only to claims first made during the policy period”. The other reads “Defense Within Limits: The limit of liability available to pay losses will be reduced and may be exhausted by amounts paid as defense costs”.

Both are standard wording. But the first means a claim made after you switch carriers may belong to nobody, and the second means every hour your defense lawyer bills is spending your indemnity, not the insurer’s.

The claim you are most likely to make is the one sold as an add on

Coalition publishes an annual claims report from its own book. In the edition covering January 1 to December 31, 2025, business email compromise and funds transfer fraud together accounted for 58 percent of all claims. Not ransomware. Not a breach of a database. Somebody sent money to the wrong account after reading a convincing email.

Of the funds transfer fraud claims, 52 percent began as a business email compromise, with an average loss of $112,000, and 71 percent came from social engineering rather than from a technical intrusion.

58%of claims were BEC or funds transfer fraud

$112,000average loss on an FTF claim that began as BEC

71%of FTF claims came from social engineering

Where each carrier puts that coverage

Now compare that with what cyber insurance covers at each of these carriers. At most of them, the claim type behind the majority of claims in that book is not in the policy you are quoted. It is sold alongside it.

carrier	where funds transfer and social engineering coverage sits	source
Chubb	cyber crime, by endorsement	Chubb cyber products page
Hiscox	optional cyber crime coverage, listed under exclusions without it	Hiscox cyber page
Travelers	its own supplemental application	Travelers form CYB-14302
Coalition	inside the base policy since April 15, 2025	Coalition announcement
The Hartford	named in the covered examples, no limit published	The Hartford cyber page

Coalition moved eleven coverages that used to be endorsements into the base form of its Active Cyber Policy, and said that from April 15, 2025, every nonadmitted new business and renewal quote in the US would be issued on that form, with limits up to $15 million. That is a real difference between two quotes that a price comparison will never show you. No redaction tool, ours included, moves that line by a dollar.

A Mississippi law firm had the endorsement and lost $158,425 anyway

Buying the endorsement is not the same as being covered by it, and there is now a clean American example with a docket number.

Gore, Kilpatrick & Dambrino, PLLC is a Mississippi law firm. In May 2024 someone calling himself David Casteel asked it to collect a debt supposedly owed to Brooks Machinery. The impostor signed the fee agreement on June 3, 2024, and on June 5 a check for $158,850 arrived, apparently paying the debt. The impostor told the firm to take its fee and wire the balance. The firm wired $158,425. On June 10 the check came back unpaid.

$158,425

The definition was the coverage

The policy did include a Social Engineering Coverage Endorsement. It defined a Social Engineering Incident as a transfer made in good faith reliance on an emailed instruction purporting to come from an employee, or from “a natural person or entity who exchanges, or is under contract to exchange, goods or services with the Named Insured for a fee”. The claim was denied, the firm sued, and on March 31, 2026, the court granted the motion to dismiss.

The court’s reasoning takes one sentence to state and is worth reading twice: the real Casteel “is not a person who exchanges or is under contract to exchange goods or services with Gore for a fee, because he is not and has never been Gore’s client”. The endorsement was written for a fake invoice from a supplier you already have. It was not written for a fake client walking in the door.

What to do with that in your own renewal

Take the endorsement, find the definition, and read it against how your business actually gets paid. A firm whose money comes from established clients and known vendors is close to the definition. A firm that takes new work from strangers, which is most professional services firms, may not be. The same discipline applies to the application you sign, where every answer becomes part of the contract.

Admitted or surplus lines: the question no comparison page asks

There is one question about a US cyber quote that changes what the policy is worth and that I did not find on any of the comparison pages I opened. Is the carrier admitted in your state?

The NAIC splits the 2024 market three ways by premium: 25 percent US domestic admitted, 57 percent US domestic surplus lines, 18 percent alien surplus lines. Three out of every four dollars of US cyber premium is written on surplus lines paper.

Domestic surplus lines57%

Domestic admitted25%

Alien surplus lines18%

What you give up

The NAIC is blunt about the trade. On its own surplus lines page it writes that “A consumer protection within the admitted market, but not available to the surplus lines market, is the protections of a state guaranty fund”, and that guaranty funds pay claims if an admitted insurer becomes insolvent.

	admitted	surplus lines
licensed in your state	yes	no, nonadmitted
state guaranty fund if the insurer fails	yes	no
share of 2024 US cyber premium	25%	75%

(Premium split: NAIC cyber market report, 2024 data. Licensing and guaranty fund: NAIC surplus lines page.)

What you get

You get coverage the admitted market will not write. The NAIC describes the surplus lines market as nonadmitted specialty insurers covering risks not available within the admitted market, and it adds that the insolvency rate of surplus lines insurers is historically low. Coalition’s newest policy form, the one with the affirmative AI language further down this page, is issued on nonadmitted paper.

Neither one is better across the board. What you cannot afford is not knowing which one you have, and your broker knows it in under a second. Of every question in this guide, this is the one the documents answer fastest.

What carriers require before they quote: MFA, backups, patching, training

The application is where the underwriting actually happens, and the questions are older than the current panic. The CyberRisk renewal application Travelers publishes on its own site today is the 01-19 edition, and it asks for multifactor authentication three separate times.

The repetition is deliberate: those are three different attack paths, and a firm can honestly hold one and not the others.

The three MFA questions, as the form puts them

question on the form	what it is really asking
“Multi-factor authentication for administrative or privileged access”	can an admin account be taken with a password alone
“Multi-factor authentication for remote access to the Applicant’s network and other systems”	is the VPN or remote desktop protected
“Multi-factor authentication for remote access to email”	can your webmail be opened from anywhere with one factor

(Source: Travelers CyberRisk Renewal Application, CYB-14202 Ed. 01-19.)

The same form asks whether backup and recovery procedures are in place for all important business and customer data, whether staff get privacy and information security training, and whether critical patches are installed within 30 days of release. That is the baseline. None of it requires buying software, and all of it can be evidenced from things you already have.

The control that is not technical at all

At-Bay lists, among the things a cyber policy may not cover, losses where the policyholder “uses unapproved or unlicensed software”. Read that next to how people actually work now and it stops being a formality about pirated Photoshop. If nobody has written down which tools are approved, the answer is a shrug, and a shrug is an argument the insurer gets to make later. Writing the list down is an afternoon’s work.

War, state backed attacks, and the attribution clause worth reading

A cyber policy will exclude war. Since 2023 a standalone cyber policy written at Lloyd’s has also had to exclude state backed cyber attacks that are not war, and the reason is a single Lloyd’s instruction.

Market bulletin Y5381, issued on August 16, 2022, and taking effect “From 31 March 2023 at the inception or on renewal of each policy”, requires every standalone cyber policy written in risk codes CY and CZ to carry a state backed cyber attack exclusion in addition to any war exclusion. Lloyd’s set out five minimum requirements for the clause.

Lloyd’s is not a US regulator and this is not US law. It matters to a US buyer because alien surplus lines insurers wrote 18 percent of US cyber premium in 2024, and because if your quote comes from Lloyd’s the clause is not optional.

The fourth requirement is the one to read

the clause must, at a minimum	what it decides
exclude war, where there is no separate war exclusion	nothing new
exclude state backed attacks that significantly impair a state’s ability to function, or its security capabilities	the wider half
be clear about computer systems outside the affected state	whether your cloud region is in or out
set out how an attack is attributed to a state	who decides, and on what evidence
ensure all key terms are clearly defined	where the argument will happen

(Source: Lloyd’s Market Bulletin Y5381, August 16, 2022. The fourth is quoted in full below.)

Four of the five are what you would expect. The fourth is different: the clause must “set out a robust basis by which the parties agree on how any state backed cyber-attack will be attributed to one or more states”.

That sentence is the whole exclusion in practice. An attack becomes uninsured at the moment somebody decides a government was behind it, and the clause says who gets to decide and on what evidence. Some wordings defer to the affected state’s own government. Government attribution of a specific intrusion can take years, and your business interruption claim does not wait that long.

Nothing any vendor sells, ours included, changes a word of this clause. It is the one part of the policy that turns entirely on who your attacker is later found to be.

AI: the cyber policy is opening while the liability policy is closing

This is where the market is moving in two directions at once, and the direction most people assume is the wrong one.

On the cyber side, coverage is being written in on purpose. Coalition published an Affirmative Artificial Intelligence Endorsement on March 26, 2024, that expands a security failure to include “an AI security event, where artificial intelligence technology caused a failure of computer systems’ security”, and expands the funds transfer fraud trigger to include a fraudulent instruction sent by deepfake. From April 15, 2025, that coverage sits in the base Active Cyber Policy rather than in an endorsement.

On the general liability side, coverage is being written out

In January 2026 the Insurance Services Office introduced endorsement CG 40 47 01 26, the Generative Artificial Intelligence Exclusion, which Gallagher reports is “beginning to appear on commercial general liability (CGL) policies”.

Gallagher is specific about what it does: it removes both Coverage A and Coverage B for harm arising out of generative artificial intelligence, the wording “may apply even when AI is only one contributing factor to a loss”, and it can apply “whether AI is used directly by the insured or indirectly through vendors, consultants, or project systems”.

So the AI exclusion arriving at small US businesses in 2026 is not in the cyber policy. It is in the general liability policy, which for most small firms means the business owner’s policy sitting next to it. Fenwick, writing on June 15, 2026, reached the same split and called cyber “the most stable source of coverage for AI-related risks”.

Neither policy answers who may read the text, and in ChatGPT that list includes your own admin. Google prints a warning on exactly that point, and it is quoted here in Google’s own words.

Meanwhile the carrier websites say nothing at all

I read the public cyber pages of five US carriers on September 16, 2026, and searched each for any mention of artificial intelligence. The Hartford, Travelers, Chubb and Hiscox mention it zero times. At-Bay mentions it five times, every one of them in the site navigation describing its own security products built on AI, and none of them in connection with what the policy covers.

0 of 5

The AI vendors, by contrast, do put their side in writing: Anthropic’s own pages set out the consumer default, and its two exceptions, for training on your data.

The rules that do exist point at the insurer, not at you. The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence by Insurance Companies in December 2023, and it governs how carriers use AI in underwriting and claims. Nothing in it says whether your own use of an AI tool is covered. That answer is in your endorsement schedule or nowhere, and the questionnaire guide covers the form that asks.

When you ask your broker, name the tool, because “an AI tool” is not one thing: Microsoft alone ships four products called Copilot, and four different answers on your data.

The three published prices, and why none of them is comparable

Each of these three numbers answers a different question, and seeing that is the most useful thing in this guide.

who	the published number	what the page says it buys
Hiscox	$29.57 a month, illustrative	$250,000 limit, $10,000 deductible
Insureon	$129 a month, $1,552 a year	no limit attached to the price
The Hartford	about $320 a year	“data breach coverage”, limit not stated

(Hiscox and The Hartford pages read September 16, 2026. Insureon page marked “Updated: April 24, 2026”.)

Read the small print under each one

Hiscox is the most useful of the three because it publishes the limit alongside the price: a business consultant in Texas at $29.57 a month and an accountant in Massachusetts at $42.73 a month, both at a $250,000 occurrence and aggregate limit with a $10,000 deductible. Note the ratio. The deductible is 4 percent of the entire limit.

Insureon’s figures come with a methodology note and a quiet inconsistency. The page says small businesses “pay an average of $129 per month”, and the note underneath says “Our figures are calculated using the median cost of policies sold”. An average that is really a median is not an error, but it is a different number. The same note adds that “Most of our customers have fewer than five employees”.

The Hartford’s number carries no date and no methodology at all. The page states that its customers pay about $320 annually for data breach coverage, and the footnote says only that costs are estimates. A price with no date is a price you cannot check next year.

What to compare instead

Divide the premium by the limit and you get a rate. Then check the retention, the funds transfer sublimit, and whether defense sits inside the limit. If a broker or an external IT provider hands you a number with no limit attached, that is a price, not a quote.

Two quotes at the same price can differ by a factor of ten on the only line you are ever likely to claim on, and nothing on any comparison page will tell you that.

How to compare two cyber quotes, question by question

Here is the checklist: twelve questions, each with what a good answer sounds like and the document that proves it. Every question comes from a document cited in this guide. Copy it, take it to the renewal call, write the answers down as you go, and keep them with the quote. If an external IT provider will be on that call, questions 7 and 8 are theirs to answer, not yours.

The limits, the sublimits and who pays the defense

#	Question	What a good answer sounds like	The document that proves it
1	“What is the aggregate limit, and what is the sublimit for funds transfer fraud and for social engineering?”	Three separate dollar figures, and whether each sublimit sits inside the aggregate or on top of it	The declarations page, not the brochure
2	“Is the social engineering wording written so that a new client counts, or only an existing client, vendor or employee?”	The definition covers an instruction from any third party, not only a party you already exchange goods or services with for a fee	The endorsement, and its definition of the incident
3	“Do defense costs come out of the limit, or sit on top of it?”	Either, so long as it is said out loud. Inside the limit is normal and you should price it in	The Defense Within Limits legend, and the insuring agreement

The shape of the policy: admitted, claims-made, retention

#	Question	What a good answer sounds like	The document that proves it
4	“Is this an admitted policy in my state, or surplus lines?”	A straight yes or no in one second, plus the words state guaranty fund and what happens without one	The surplus lines notice on the policy, and the state department of insurance carrier lookup
5	“Is it claims-made, and what is the retroactive date?”	A retroactive date at least as old as your first cyber policy with any carrier, so switching does not open a gap	The declarations, retroactive date item
6	“What is the retention, and is there a waiting period before business interruption starts to pay?”	The retention in dollars and the waiting period in hours, and whether the waiting period runs per event or per policy year	The declarations, and the business interruption agreement

What you promised, and what is excluded

#	Question	What a good answer sounds like	The document that proves it
7	“Which security controls did the underwriter assume when pricing this?”	They are named, one by one. MFA on privileged access, on remote access and on email, tested backups, a patching window	The signed application, which becomes part of the policy
8	“What happens if one of those controls lapses in the middle of the term?”	A named clause, not a shrug. Ask whether it is a warranty, a condition precedent, or nothing at all	The conditions section, and any minimum practices endorsement
9	“Does the policy exclude a state backed cyber attack, and who decides attribution?”	It almost certainly does. What matters is the sentence naming who attributes an attack to a state, and on what evidence	The war and state backed cyber attack clause

AI, and who answers the phone

#	Question	What a good answer sounds like	The document that proves it
10	“Does anything in this policy mention artificial intelligence?”	Yes with an endorsement number, or no with an acknowledgment that the policy is silent on it	The endorsement schedule of this policy
11	“Does my general liability or business owner’s policy now carry an AI exclusion?”	A yes or no given after actually looking, with the form number. The ISO form is CG 40 47 01 26	The liability policy’s endorsement schedule, not the cyber one
12	“Who answers the phone at two in the morning, and does using my own lawyer affect the coverage?”	A hotline number, a panel list, and the consent clause that governs using counsel who is not on the panel	The incident response section, and the approved vendor panel

Before you bind: Nothing above is advice about which policy to buy. It is a list of questions and the documents that answer them. The person who can advise you is a licensed insurance producer in your state, and the NAIC defines that as someone who sells, solicits or negotiates insurance. Insurance is regulated by the states, not federally, so the rules that govern that person are your state’s.

What a tool can do here, and what no tool can do, including ours

We build Mac and Windows apps that hide the client data in a document when you ask them to, before it goes into an AI chat window, so it would be convenient to end this by telling you that it improves your insurance position. It does not, or not much, and being specific about that is more useful than being enthusiastic. Where it matters more is under the rules on what a US practice may paste into ChatGPT at all.

What it actually touches

One of the twelve questions above, and one exclusion. Data minimization is part of the answer to question 7, on the controls the underwriter priced, and an approved tool list is part of the answer to the unapproved software exclusion. What the app keeps on your disk, and the usage count it sends once a day without a word of your text, are set out on the security page.

It does nothing about the claim type behind 58 percent of claims in Coalition’s book, because a wire to the wrong account is a payment process problem, not a text problem. A callback rule beats any software on this page, ours included.

And a sentence we are not going to write

This guide does not say that redacting identifiers puts you in compliance, and it is not a condition of being insurable. Nobody requires it. If a vendor tells you their product is what an insurer expects, ask them for the question on the application form that says so, and check it against what the forms actually ask.

If you buy nothing at all, do these five things

After reading all this, it is perfectly reasonable to decide the premium is not worth it for your firm. The five items below cost nothing, and two of them are questions on the application form you will fill out if you change your mind.

1. Turn on MFA in three places, not one. Privileged accounts, remote network access, and email. Those are three separate questions on the Travelers form and they are three separate doors.
2. Write down which tools are approved. One page, dated, and circulated. It answers the unapproved software question and it is the document the policy template produces.
3. Put a callback rule on payment changes. Any change of bank details gets verified by phone on a number you already held. This is the control aimed at the business email compromise and funds transfer claims counted earlier.
4. Find your current declarations page and read four lines. Aggregate limit, funds transfer sublimit, retention, and whether defense is inside the limit. It takes five minutes, and it is what this whole guide is really about.
5. Test one backup restore. Not that backups run. That a restore works. The application asks about backup and recovery procedures, and a procedure nobody has tested is a hope.

If the incident has already happened and you are reading this in a hurry, stop here and go to the first hour instead. Insurance questions come after the ones with a deadline, and both of them come before the conversation with the client.

Two things you will read elsewhere that are wrong today

1. “Cyber insurance renewals cluster in the fourth quarter, so shop in the fall.” There is no published renewal calendar for the US cyber market. What is documented is that rates moved: the NAIC report records that US cyber rates fell an average of 5 percent in the fourth quarter of 2024, the first quarterly decrease after seven years of increases. Direction, not a season.

2. “Cyber insurance is a growth market, so capacity is easy.” It contracted. US cyber direct written premium fell 7.11 percent in 2024, to about $9.14 billion, the first reduction the NAIC has recorded, and policies in force were flat at 4,368,614. Claims went the other way, rising almost 40 percent to nearly 50,000. Softer pricing with more claims is not a stable combination, and it is a reason to read the wording rather than the price.

For the wider picture of where the rules around AI are moving, the AI Act coverage tracks the European half and the guides on ChatGPT, Claude, Gemini and Copilot cover the tools themselves.

---

Nonimo is the software that does this on your own computer: it masks client names and IDs before your text reaches ChatGPT. No account, and your client’s details never leave your machine.

Sources

National Association of Insurance Commissioners, Report on the Cybersecurity Insurance Market (2024 data). US direct written premium of about $9.14 billion in 2024, down 7.11 percent; 4,368,614 policies in force; nearly 50,000 claims, up almost 40 percent; endorsements at 55.1 percent of policies and 4 percent of premium; market split of 25 percent admitted, 57 percent domestic surplus lines and 18 percent alien surplus lines; the rate decrease in the fourth quarter of 2024. content.naic.org

NAIC, Surplus Lines. That guaranty fund protection is available in the admitted market and not in the surplus lines market; that the surplus lines market consists of nonadmitted specialized insurers covering risks not available within the admitted market; and that the insolvency rate of surplus lines insurers is historically low. content.naic.org

NAIC, Producer Licensing. The definition of an insurance producer as someone who sells, solicits or negotiates insurance, and that licensing is done by state insurance regulators. content.naic.org

NAIC, Artificial Intelligence. The Model Bulletin on the Use of Artificial Intelligence by Insurance Companies, adopted in December 2023, and that it governs insurers’ own use of AI. content.naic.org

Federal Trade Commission, Cyber Insurance. The two coverage lists, for your own losses and for claims brought against you, and the three checks including the duty to defend wording and a breach hotline open all year. ftc.gov

Travelers, CyberRisk Renewal Application, CYB-14202 Ed. 01-19. The Claims-Made and Defense Within Limits legends, the three multifactor authentication questions, backups, security training, and the question on installing critical patches within 30 days. travelers.com

Travelers, CyberRisk Social Engineering Fraud Supplement, CYB-14302 Ed. 01-19. That social engineering fraud is underwritten on its own supplemental application. travelers.com

Gore, Kilpatrick & Dambrino, PLLC v. Spinnaker Insurance Company, No. 4:25-cv-00107-DMB-DAS, United States District Court for the Northern District of Mississippi, opinion and order of March 31, 2026. The $158,425 wire, the definition of a Social Engineering Incident, and the holding that an impostor posing as a new client falls outside it. storage.courtlistener.com, docket at courtlistener.com

Coalition, Coalition Launches New Active Cyber Policy, April 9, 2025. Limits up to $15 million, surplus lines, eleven coverages moved from endorsement into the base form, affirmative AI coverage, and the April 15, 2025, start date. coalitioninc.com

Coalition, Affirmative AI Endorsement, March 26, 2024. The AI security event wording and the deepfake trigger for funds transfer fraud. coalitioninc.com

Coalition, 2026 Cyber Claims Report (calendar year 2025). Business email compromise and funds transfer fraud at 58 percent of claims, the $112,000 average loss, and 71 percent of funds transfer fraud claims arising from social engineering. coalitioninc.com

Hiscox, Cyber Security Insurance. The published exclusion list including stolen or misdirected funds and the biometric data exclusion, the illustrative Texas and Massachusetts quotes at a $250,000 limit with a $10,000 deductible, and the starting figure of $30 a month. hiscox.com

The Hartford, Cyber Insurance for Small Businesses. The about $320 annually figure with no date attached, and the What Is Not Covered section that lists other products rather than exclusions. thehartford.com

Chubb, Cyber Insurance Coverage & Products. That computer fraud, funds transfer fraud and social engineering fraud are written by endorsement, and online quoting for risks under $100,000,000 in revenue. chubb.com

Insureon, Cyber insurance cost, updated April 24, 2026. The $129 per month and $1,552 a year figures, the median methodology note, the $1 million to $5 million typical limits, and that most of its customers have fewer than five employees. insureon.com

At-Bay, What is not covered by cyber insurance? The unapproved or unlicensed software item, known vulnerabilities, and war and terrorism. at-bay.com

Lloyd’s, Market Bulletin Y5381, State backed cyber-attack exclusions, August 16, 2022. The requirement from March 31, 2023, for standalone cyber policies in risk codes CY and CZ, and the five minimum requirements including the attribution basis. assets.lloyds.com

Gallagher, ISO Introduces Generative AI Exclusion in Commercial General Liability Policies. The form number CG 40 47 01 26, that it removes Coverage A and Coverage B, that it may apply when AI is only one contributing factor, and that it can reach AI used indirectly through vendors. ajg.com

Fenwick, The End of ‘Silent AI’?, June 15, 2026. That ISO introduced the generative AI exclusion in commercial general liability in January 2026, and that cyber policies remain the most stable source of coverage for risks related to AI. fenwick.com