Cyber insurance for businesses, also called cyber liability insurance or data breach insurance, covers the financial fallout of a data breach, ransomware attack, or network failure, including breach response costs, business interruption, and third-party liability claims.
The federal government’s new Gold Eagle clearinghouse, launched this month to help detect and patch AI-discovered software vulnerabilities faster, is a sign of how fast the threat landscape is moving. However, it’s important to note that this initiative provides a defensive tool for the software ecosystem, not a substitute for your business having its own cyber insurance policy.
Key takeaways
-
Cyber liability insurance covers first-party costs (breach response, business interruption, ransomware extortion) and third-party costs (liability claims, regulatory defense) that standard business policies exclude.
-
A new federal initiative called “Gold Eagle” now coordinates the detection and patching of AI-discovered vulnerabilities, especially in open-source software, but it doesn’t cover your business’s losses if an attack still gets through.
-
Third-party involvement, meaning a breach traced back to a vendor, supplier, or software dependency rather than the business itself, jumped 60% year over year to 48% of all breaches, according to Verizon’s 2026 Data Breach Investigations Report (DBIR), an annual, widely respected industry study that analyzes tens of thousands of real-world data breaches and security incidents worldwide.
-
Insurers are tightening underwriting standards in 2026, increasingly requiring multi-factor authentication and a documented incident response plan before writing a policy.
-
SandStone Insurance Partners helps businesses assess where their actual exposure sits and builds coverage around it, rather than selling a one-size-fits-all policy.
What Is Cyber Liability Insurance?
Cyber insurance for businesses, more formally called cyber liability insurance and sometimes referred to as data breach insurance, protects a business against the financial consequences of a cyberattack, data breach, or network outage. Rather than covering physical property, it covers digital and financial harm: the cost of investigating what happened, notifying affected customers, restoring systems, defending against lawsuits or regulatory action, and, in many cases, the ransom itself in a ransomware event.
A standard commercial policy, whether general liability or a property policy, is not built to respond to this. That gap is exactly what cyber liability insurance is designed to close.
Why Small Business Cyber Insurance Matters Just as Much as It Does for Large Enterprises
Cyberattacks aren’t a large-enterprise problem anymore, which is exactly why small business cyber insurance has become as essential as any other core business insurance policy. The DBIR puts it directly: small organizations “are disproportionally impacted by Ransomware and face many of the same threats as other industries and organizations but often with less resources available” to respond.
In the report’s small- and midsize-business dataset, System Intrusion, Basic Web Application Attacks, and Social Engineering together accounted for 100% of breaches, and of the ransomware cases where the victim’s organization size was known, about 96% were small businesses rather than large enterprises.
Much of this risk doesn’t originate inside a business’s own walls. Across the full 2026 DBIR dataset, breaches with third-party involvement, meaning the incident traced back to a vendor, supplier, or software dependency rather than the business itself, increased 60% from the previous year’s dataset to reach 48% of all breaches. That share was even higher, at 55%, within the small-business breaches the report analyzed.
A vulnerability in one shared vendor or software dependency doesn’t stay contained to the company that owned it. It becomes every downstream customer’s exposure the moment they depend on that vendor, which is effectively all the time.
What Gold Eagle Changes, and What It Doesn’t
According to a July 17, 2026 report from Insurance Journal, corroborated by the White House’s own announcement, the Trump administration has rolled out a new industry clearinghouse called Gold Eagle to improve how quickly AI-discovered software vulnerabilities, especially in open-source code, get detected and patched. The initiative, launched by the Treasury Department, the Department of Homeland Security, and the Pentagon in consultation with AI companies, was detailed by National Cyber Director Sean Cairncross in a July 14 briefing.
Gold Eagle provides a way for AI companies and the government to share information about software weaknesses so they can be fixed faster, particularly in the free, widely used code that underpins much of the software industry. This comes as attackers increasingly rely on AI to carry out attacks, most often through phishing.
It’s a meaningful step forward, though it arrives amid an inconsistent stretch for AI policy: officials have restricted, then eased, the release of some advanced AI models over security concerns, according to Insurance Journal.
Here’s what matters for your business: Gold Eagle addresses these problems at the industry level. It won’t reimburse you for a breach, cover a lawsuit over exposed client data, or pay a ransom if your systems are locked down; that protection still must come from your own insurance. The federal government built an entire program around this risk because the threat is real, and not one any single business can resolve on its own.
What Does Cyber Insurance Cover?
A cyber liability policy typically covers two categories of loss.
First-party costs, meaning costs your business incurs directly:
-
Forensic investigation to determine how a breach happened and what was accessed
-
Customer and regulatory notification costs
-
Credit monitoring for affected individuals
-
Business interruption and lost income while systems are down
-
Data restoration after an attack
-
Cyber extortion costs, including ransomware negotiation and payment in many policies
Third-party costs, meaning claims brought against your business by others:
-
Liability claims from customers or partners whose data was exposed
-
Regulatory defense costs and fines where insurable
-
Media liability, such as claims tied to content your business published online
What Cyber Insurance Doesn’t Cover
Cyber policies have real boundaries. Common exclusions include acts of war or state-sponsored attacks (a live coverage debate as nation-state cyber activity increases), losses from vulnerabilities a business already knew about and failed to patch, physical bodily injury or property damage, and, increasingly, claims tied to certain uses of AI that carriers are carving out as they revise policy language.
Professional negligence claims, such as a client alleging your advice or work product cost them money, fall under commercial E&O insurance instead, not cyber. Speak with a licensed advisor from SandStone for guidance specific to your business.
2026 Market Trends: Underwriting Standards Are Rising
The DBIR gives a clear picture of why underwriting is getting stricter even where pricing stays competitive. Ransomware grew again this year, present in 48% of all breaches in the report’s dataset, up from 44% the year before, and third-party involvement climbed 60% to reach 48% of breaches overall. At the same time, the report found only 23% of third-party cloud environments had fully remediated missing or improperly secured multi-factor authentication, exactly the kind of gap that shows up in a claim.
Insurers are responding by asking more of applicants at renewal: proof of multi-factor authentication across critical systems and a documented incident response plan are increasingly required before a carrier will write or renew a policy. Businesses that can show they’ve closed these kinds of MFA and vendor-access gaps are increasingly the ones getting the most favorable terms, and Gold Eagle’s focus on faster vulnerability detection and patching is a direct federal response to the same trend line.
Frequently Asked Questions
What does cyber liability insurance cover for a business?
Cyber liability insurance covers the direct costs of responding to a cyberattack or data breach, such as forensics, customer notification, and business interruption, along with third-party liability claims and regulatory defense costs that result from the incident.
Does cyber insurance cover ransomware payments?
Many cyber liability policies include cyber extortion coverage, which can pay for ransom negotiation and, in many cases, the ransom payment itself, subject to policy terms and limits. Confirm this specifically with your advisor from SandStone and your insurance carrier, since not all forms treat it the same way.
Will the Gold Eagle clearinghouse replace the need for cyber insurance?
No. Gold Eagle is a federal coordination effort to help detect and patch AI-discovered software vulnerabilities faster, particularly in open-source code. It doesn’t reimburse a business for its own losses if an attack occurs, which is the role cyber insurance still plays.
Is my business too small to need cyber insurance?
No. The DBIR found that small organizations face many of the same threats as large enterprises but with fewer resources to respond, and that among the ransomware cases in the report where organization size was known, about 96% of the victims were small businesses rather than large enterprises.
What do insurers require before writing a cyber policy in 2026?
Most carriers now expect multi-factor authentication across critical systems and a documented incident response plan, and they increasingly favor applicants that can show well-maintained software dependencies, given how much of today’s claims activity traces back to the software supply chain.
How much does cyber insurance cost for a business?
There’s no flat rate. Pricing typically depends on factors such as your industry, revenue, the volume and sensitivity of data you handle, your existing security controls, and your claims history, so the only reliable way to know what your business would pay is to request a cyber insurance quote based on your actual operations.
Is cyber insurance the same thing as data breach insurance or ransomware insurance?
Yes, for the most part. “Cyber insurance,” “cyber liability insurance,” and “data breach insurance” are generally used to describe the same type of policy. “Ransomware insurance” usually refers to the cyber extortion piece of that same policy rather than a separate, standalone product.
Why Partner With SandStone
Our Commercial Lines Team stays ahead of how the threat landscape, and the underwriting standards tied to it, are shifting, so your policy is built around your business’s actual exposure rather than a generic template. Contact your SandStone advisor today for a cyber insurance quote and coverage review.
Related Coverage
Cyber liability insurance rarely stands alone. If your business gives clients professional advice or a work product, see our guide to commercial E&O insurance for how that coverage differs from cyber.
A standard general liability insurance policy excludes nearly every cyber-related loss, so it’s worth confirming with your SandStone advisor exactly where your general liability coverage ends and your cyber policy needs to begin.
Disclaimer: This blog provides general educational information about business insurance and is not legal, financial, or insurance advice. Coverage availability, eligibility, sublimits, exclusions, and policy features vary by state, carrier, industry, and individual underwriting. For coverage recommendations specific to your business, contact a licensed agent from SandStone.
