The Most Overlooked Small Business Coverages and How They Protect You During a Cyber Event

Cyber criminals come in all shapes and sizes — and from any number of demographic backgrounds — so it's imperative that small businesses protect themselves from malicious intent.

By: Maura Keller | March 9, 2020

Cyber criminals come in all shapes and sizes — and from any number of demographic backgrounds.

But what they’re looking for is simple: Access to personal information and data they can use for malicious purposes — to extort payment, infect computers with malware, and other fraudulent purposes such as identity theft and for financial gain.

According to Jeff Kroeger, executive vice president of strategy and development, Insureon, all businesses, no matter the size, have cyber liability risks.

“When people think of cyber risk, they tend to think of the extravagant data breaches and hacks. I know of no business that does not have some type of personally identifiable information (PII) on its customers, which could be as small as a name and phone number,” he said.

“For a small business owner, the risk is real and frankly, all businesses have the responsibility to protect customers’ information.”

Finding the Right Level of Insurance

Insurance coverage for a cyber event is one area that Kroeger said small business owners might not be giving enough attention to.

“From the data privacy and protection aspect, personally identifiable information, like cyber risk, you would want to educate the consumer on what is at risk relative to first and third party,” Kroeger said.

“It’s one thing to have first-party exposure with your own employees and your own business. But if you are exposing your customer’s information, that’s third party,” he added.

“There are lots of products today in the market where an insurance carrier will throw on $10,000 or even $50,000 or more of coverage on first party, which is great, but your exposure is really in third.”

Small Businesses at Risk

Mario Paez, director, cyber & technology E&O, Marsh & McLennan Agency referred to the 2019 NetDiligence Cyber Claims Study, which assesses actual paid claims by the cyber insurance marketplace. According to that study, 96% of claims are attributed to the SME (under $2B in revenue), so the risk is real and impacting smaller organizations.

“Small businesses, as opposed to large organizations, often do not have the operating budgets to build a robust cyber security framework to prepare, plan and respond to security infiltrations, privacy incidents or network outages for example,” Paez said.

“These organizations are often reliant on third-party managed IT service providers and may not fully know the connectedness with these organizations, the extent of data shared with those vendors nor the responsibility of those vendors to notify and cooperate or to be audited by the client.”

And while vendor risk management and contract due diligence is key, it is important to note that third-party vendors can introduce vulnerabilities that may impact small businesses’ network reliability as well as impact their responsibility after a vendor-caused security/privacy incident.

“Small businesses may not have the comprehensive incident response plans and availability of resources to respond and that is a key area where cyber liability insurance can assist in providing 24/7 incident response,” Paez said.

“Not to mention, the defense and indemnification expense coverage is important to protect the organizations balance sheet if third-party plaintiffs and regulators may further assert financial injury stemming from a cyber incident.”

What Are the Severe Risks?

Timothy Zeilman, Hartford Steam Boiler vice president, global cyber products, said cyber insurance can be added as an endorsement to a businessowner’s policy to provide coverage that responds to what he sees as the most frequent and severe risks small businesses face: cyber attack, ransomware, business interruption, and data breach.

“We have seen increasing demands for ransom, in some cases as much as a 200% quarter-over-quarter increase, and business interruption from ransomware attacks ranging from a few days to over two weeks,” Zeilman said. “For small businesses, that can be a business-ending event.”

Indeed, as Paez explained, it is not uncommon for small businesses to go out of business due to a network security/privacy incident.

An outage of a network caused by malware could create a significant business interruption — cutting off revenue streams and misdirect revenue-producing resources to mitigate the cyber threat.

“In addition, the cost to hire a forensic and remediation firm and legal response team can add to the costs further crippling a small business’ balance sheet,” Paez said. “Reputational harm and lost customers stemming from the operational downtime can also be detrimental to a small businesses continuation.”

Protecting Your Business

Small businesses can purchase a stand-alone cyber policy or a cyber endorsement, usually in the form of a businessowner’s policy endorsement.

To further protect themselves, Zeilman recommends small businesses:

Develop a written cyber security plan (that includes a password policy) and an incident response plan. Identify resources in advance that you’ll call upon in the event of a cyber incident.
Assess their cyber risks regularly. That means not only doing a mental checklist of assets and information, but calling on expert resources to conduct risk assessments and test the security on a regular basis.
Regularly update software and install patches.
Purchase cyber insurance that addresses risks that a particular company faces and has sufficient limits to cover estimated potential losses.

The second policy that Kroeger thinks small business owners ignore at their peril are umbrella policies.

“The second piece going to umbrella is not going to data privacy necessarily but the basis of insurance, and that’s bodily injury and property damage and the extensions over the insurance on your base policy,” Kroeger said.

“Base policy limits are really high, they seem high when you talk to somebody about a million or two million on a single occurrence or two to four million on an aggregate limit basis. That sounds like a lot until you have one special event that’s ten million, six million dollars of which could be uncovered,” Kroeger said.

“If you are a small business owner, you are out of business, when you could have spent an 30 extra dollars and been covered.” &

Based in Minneapolis, Minnesota, Maura Keller is a writer, editor and published book author with more than 20 years of experience. She has written about business, design, marketing, health care, and a wealth of other topics for dozens of regional and national publications. She can be reached at [email protected].

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.