Most small business owners are underinsured in ways they don’t realize. The most common 2026 coverage gaps are cyber liability, employment practices liability (EPLI), business interruption, equipment breakdown, hired and non-owned auto, professional liability, inland marine, commercial flood and earthquake, workers’ compensation, and insufficient umbrella limits. A licensed agent from SandStone can audit your current coverage and identify which of these gaps applies to your business.
Key takeaways:
-
A typical Business Owner’s Policy (BOP) protects against fewer risks than most owners assume
-
Cyber liability is typically the most-overlooked coverage among small businesses in 2026
-
Many “covered” claims come back denied because the underlying coverage was missing or undervalued
-
A 30-minute policy review with a licensed agent from SandStone surfaces most gaps before they turn into uncovered claims
This week is National Small Business Week (May 3-9, 2026), the annual recognition of America’s roughly 33 million small businesses. It is also a useful prompt for one of the most overlooked tasks on every owner’s plate: actually reviewing whether your insurance protects what your business has become.
The pattern is consistent. An owner buys a Business Owner’s Policy (BOP) when they open their doors, adds workers’ compensation when they hire their first employee, and then never goes back. Five or ten years later, the company has grown into new exposures that the original program was never built to handle. A single covered loss can then expose holes the owner did not know existed.
This guide walks through the 10 most common small business insurance gaps in 2026, what each one looks like in a real claim, and how to close it.
1. The Cyber Liability coverage gap
The gap: Most standard Business Owner’s Policies do not include meaningful cyber coverage, or include only a small endorsement that caps out at a fraction of a real ransomware loss. Modern small business cyber claims involving ransomware, business email compromise (BEC), and data breaches commonly produce six and seven-figure costs.
The consequence: Industry incident response data has shown the average small business cyber claim now exceeds the limits of most embedded BOP cyber endorsements. The remainder lands on the business owner.
The fix: A standalone cyber liability policy with first-party coverage (your own incident response, restoration, and business income costs) and third-party coverage (claims by customers and partners), plus appropriate sublimits for ransomware, social engineering, and dependent business interruption. SandStone’s licensed agents help small businesses size cyber limits to actual exposure and confirm modern underwriting requirements like multi-factor authentication, endpoint detection, and verified backups.
2. The Employment Practices Liability (EPLI) gap
The gap: General liability does not cover claims from your own employees for harassment, discrimination, retaliation, or wrongful termination. Employment Practices Liability Insurance (EPLI) does. Many small employers assume these claims only happen at large companies, but employment claims have hit businesses of every size, including family-run operations.
The consequence: A single EPLI claim with defense costs can run six figures even when the business is not at fault. Many policies also include wage-and-hour sublimits that have grown more important with remote and hybrid workforce dynamics.
The fix: A standalone EPLI policy or an EPLI endorsement on a BOP. A licensed agent from SandStone can quote EPLI alongside core property and liability so the cost and the exposure are visible in one place.
3. Underinsured business interruption
The gap: Most BOPs include some business interruption (BI) coverage, but the limit is often too low and the restoration period is too short. Small business owners frequently set BI limits based on prior-year revenue without accounting for growth, supply chain delays, or extended rebuild timelines that have become standard in 2026.
The consequence: A covered fire or storm that takes nine months to rebuild can outlast a 12-month BI limit if the business is closed for any portion of the rebuild after construction completes (the “extended period of indemnity” most policies cap at 30, 60, or 90 days).
The fix: Annual review of BI limits, restoration period, extended period of indemnity, civil authority sublimit, and contingent BI from key suppliers and customers. SandStone’s licensed agents work with owners to model realistic worst-case scenarios for current Southeast supply chain and rebuild conditions.
4. The equipment breakdown gap
The gap: Standard commercial property covers damage from external perils like fire, wind, and theft, but it explicitly excludes mechanical and electrical breakdown. When your HVAC, refrigeration, manufacturing, electronic, or telecommunications equipment fails on its own, the loss is excluded unless equipment breakdown coverage (sometimes called systems breakdown) is added.
The consequence: A restaurant losing thousands of dollars of refrigerated stock to a compressor failure, a hotel losing weeks of guest revenue to a chiller failure, or a manufacturer losing production to an electrical short often finds out about the gap only at claim time.
The fix: Equipment breakdown coverage, available as an endorsement or as part of a full BOP package. SandStone’s licensed agents can confirm whether your current property form includes it and at what limit.
5. The Hired and Non-Owned Auto (HNOA) gap
The gap: If your employees ever drive their personal vehicles for work, run errands, deliver products, or use a rented vehicle on a business trip, your business has hired and non-owned auto exposure. Personal auto policies usually exclude or limit coverage when the vehicle is used for business, and your commercial general liability does not extend to auto liability.
The consequence: When a delivery driver causes a serious accident in their own car, the injured party’s attorney looks past the personal policy and goes after the business directly. Without HNOA, the employer’s defense and any judgment come out of pocket.
The fix: A hired and non-owned auto endorsement on your business auto or BOP policy. A licensed agent from SandStone reviews whether your team’s actual driving activity matches the coverage you carry today.
6. The professional liability and Errors and Omissions (E&O) gap
The gap: Many small businesses outside traditional professional services (consulting, advisory, design, technology, training, even some retail and trade businesses) carry professional liability exposure they do not recognize. General liability covers bodily injury and property damage, not the financial loss a customer suffers because of advice, consulting, or service work that went wrong.
The consequence: A landscape design that floods a homeowner’s foundation, a consulting recommendation that costs a client revenue, or a tech vendor’s downtime that interrupts a customer’s operations can all turn into E&O claims that general liability will not pay.
The fix: A professional liability or Errors & Omissions (E&O) policy designed for your industry. Tech-enabled businesses often need a combined Tech E&O / cyber policy. SandStone’s licensed agents help identify whether your service offerings carry E&O exposure and match you with carriers that specialize in your industry.
7. The inland marine and mobile property gap
The gap: Standard commercial property covers buildings and contents at a stated location. It does not follow tools, equipment, materials, or inventory that move from job site to job site or that sit at a customer’s location overnight. Contractors, photographers, jewelers, installers, food trucks, and any business with mobile assets need inland marine coverage.
The consequence: A theft from a contractor’s locked truck, damage to an installation in transit, or loss of leased equipment at a job site is excluded under base property coverage. A licensed agent from SandStone has seen each of these claims more than once.
The fix: An inland marine policy or floater (contractors’ equipment, installation, transit, fine arts, jewelers’ block, motor truck cargo, depending on your operation). SandStone’s licensed agents identify the right inland marine form for the assets your business actually moves.
8. The commercial flood and earthquake gap
The gap: Standard commercial property excludes flood and earthquake. Florida and South Carolina coastal businesses face hurricane storm surge, which is classified as flood, not wind. Inland businesses face earthquake exposure from the New Madrid seismic zone, which extends into parts of the Southeast more than most owners realize.
The consequence: A covered hurricane that pushes water into your storefront is not actually covered if the water comes from outside the building (storm surge or rising flood) rather than from wind damage to the roof. The same hurricane can produce both losses, only one of which is paid under the property policy alone.
The fix: A separate commercial flood policy through the National Flood Insurance Program (NFIP) or a private flood market, plus an earthquake endorsement or standalone policy where exposure exists. SandStone’s licensed agents quote flood and earthquake alongside primary property coverage so the gap is visible from day one rather than discovered at claim time.
9. The workers’ compensation and 1099 gap
The gap: Workers’ compensation rules vary by state, and most owners under-understand them. In Florida, Georgia, and South Carolina, the rules around sole proprietors, corporate officers, family members, and 1099 contractors differ from one another and from the federal default. A “ghost policy” purchased only to satisfy a certificate-of-insurance request often will not respond if the business hires the wrong subcontractor.
The consequence: A 1099 worker injured on the job often files a claim against the hiring business, and the absence of proper workers’ compensation coverage exposes the business to medical bills, lost wages, and any litigation that follows.
The fix: A workers’ compensation policy structured for your actual workforce, including proper handling of officers, sole proprietors, and 1099 relationships. SandStone’s licensed agents review every classification code, every state-specific election, and every certificate-of-insurance request before issuing coverage.
10. Insufficient umbrella and excess liability
The gap: Most small business primary liability limits run ~$1 million per occurrence and ~$2 million aggregate. Modern jury awards in auto, premises, and product liability cases frequently exceed those limits. Without commercial umbrella coverage, the gap between your primary limit and the actual judgment falls back on the business and its owner.
The consequence: Industry tracking of “nuclear verdicts” (above $10 million) has shown sharp growth over the past five years, particularly in trucking, premises, and product liability. A small business with $1 million in primary general liability and no umbrella is one bad accident away from insolvency.
The fix: A commercial umbrella that sits on top of general liability, business auto, and employer’s liability, sized to your actual exposure rather than a default $1 million limit. SandStone’s licensed agents stress-test underlying limits and umbrella programs against realistic loss scenarios, layering excess coverage when appropriate.
How SandStone supports small businesses across the Southeast
National Small Business Week is a useful prompt, but the work of building right-sized coverage is year-round. SandStone’s licensed agents specialize in identifying gaps before they become uncovered claims. As an independent agency, we explore quotes from multiple A-rated carriers to match coverage to your exposure rather than promoting any single product line.
If you have never had your business coverage independently reviewed, or if you have outgrown the policy you bought when you opened, this is the week to fix it.
Small Business Insurance FAQs
What is a Business Owner’s Policy (BOP)?
A Business Owner’s Policy (BOP) bundles commercial property, general liability, and limited business interruption coverage into a single policy designed for small to mid-sized businesses. BOPs typically include certain endorsements and exclude others, which is where the most common gaps appear. SandStone’s licensed agents review whether a BOP is the right structure for your business or whether a separate commercial package policy fits better.
Does my BOP cover cyber attacks?
Most standard BOPs include only a small cyber endorsement, often capped at a fraction of a typical ransomware claim, which is insufficient for modern incidents. A standalone cyber liability policy generally provides broader and higher-limit protection across first-party and third-party exposures. A licensed agent from SandStone can compare your current cyber sublimits against realistic 2026 incident costs.
Do I need EPLI if I only have a few employees?
Yes. Employment Practices Liability claims (discrimination, harassment, retaliation, wrongful termination, wage and hour) can be filed by a single employee, and defense costs alone often run six figures. Many carriers offer EPLI for businesses with as few as two employees. SandStone’s licensed agents quote EPLI on most small commercial accounts where it is not already in force.
What is the difference between general liability and professional liability?
General liability covers bodily injury and property damage your business causes to others, while professional liability (errors and omissions or E&O) covers financial losses your customers suffer because of advice, services, or work you provided. Many small businesses need both. SandStone’s licensed agents review whether your specific service offerings carry E&O exposure.
Does business insurance cover floods?
No. Standard commercial property and BOP forms exclude flood damage from external water sources, including hurricane storm surge. Flood coverage requires a separate policy through the National Flood Insurance Program (NFIP) or a private flood carrier. SandStone’s licensed agents quote flood alongside primary property coverage for businesses in coastal and flood-prone areas of Florida, Georgia, and South Carolina.
Do I need workers’ compensation for 1099 contractors?
Workers’ compensation rules for 1099 contractors vary by state and depend on the actual nature of the working relationship. In Florida, Georgia, and South Carolina, businesses that hire subcontractors are often responsible for workers’ compensation if the subcontractor does not carry their own coverage, and a “ghost policy” may not satisfy that obligation. SandStone’s licensed agents review your specific subcontractor relationships and recommend the right structure.
How often should I review my small business insurance?
You should review your small business insurance at least annually, plus any time the business changes meaningfully. Triggers include hiring new employees, opening new locations, buying or leasing new equipment, adding new services, growing revenue significantly, hiring remote workers, or receiving new vendor or landlord requirements. SandStone’s licensed agents conduct complimentary annual policy reviews for small business clients.
What is the fastest way to find gaps in my small business insurance?
The fastest way is to schedule a structured policy review with a licensed agent from SandStone who looks at every declarations page, maps your operations against common coverage gaps, and pressure-tests limits against realistic loss scenarios.
Is a BOP enough for my small business?
A BOP is rarely enough on its own. Most small businesses also need workers’ compensation, business auto (with hired and non-owned coverage where relevant), cyber liability, EPLI for employee-related claims, and either a commercial umbrella or an excess policy on top of primary limits. Many businesses also need professional liability, inland marine, flood, or industry-specific endorsements. A licensed agent from SandStone identifies which of these your specific operation requires.
What is a certificate of insurance and why does it matter?
A certificate of insurance (COI) is a document that proves your business carries the coverage and limits a customer, landlord, or vendor requires. COIs are commonly requested before a contract is signed, before a subcontractor starts work, or before a tenant moves in. Mismatched COI requirements are one of the most common ways gaps appear in small business insurance. SandStone’s licensed agents handle COI requests and audit your contracts to confirm your coverage actually matches what you have promised.
This National Small Business Week, take 30 minutes to review your coverage. Visit the SandStone business insurance page or find your nearest SandStone office to schedule a complimentary policy review with a licensed agent from SandStone.
Disclaimer: This blog provides general educational information about small business insurance and is not legal, financial, or insurance advice. Coverage availability, eligibility, sublimits, exclusions, and policy features vary by state, carrier, industry, and individual underwriting. For coverage recommendations specific to your business, contact a licensed agent from SandStone.
