Short answer
Professional liability usually does not cover a hack, or covers it only in narrow ways. It is built for errors in your design or advice, not for breaches, ransomware or stolen funds. General liability is built for bodily injury and property damage and typically excludes data. Incidents such as phishing, payment fraud, compromised email and fake file-share links often fall into the gap between the two. Some professional liability forms include small cyber extensions, so the actual policy wording controls.
What professional liability and general liability are built for
Professional liability responds to claims that your professional services or advice were deficient. A drawing error that leads to a client’s loss is the classic example.
General liability responds to injury or property damage connected to your operations. A visitor who trips at a project site is a typical case. Our article on why general liability isn’t just for your office explains how the two split a claim.
Neither policy is designed around data, stolen money or a locked network. Cyber liability is the coverage built for those events.
Which policy typically responds to a cyber incident
This table shows how incidents are often grouped. Forms and wording vary by carrier, so treat it as a starting point.
| Incident | Professional liability | General liability | Cyber |
|---|---|---|---|
| Ransomware locks your files | Usually no | Usually no | Typically the policy built for it |
| An employee is tricked into wiring money | Usually no | Usually no | May respond, often with a sublimit |
| Client data is leaked | Usually no | Usually excludes data | Typically the policy built for it |
| Your hacked email sends malware to a client | Usually no, though a narrow extension may exist | Usually no | May respond, depending on the wording |
| Your website or systems go down | Usually no | Usually no | May respond to lost income, depending on the wording |
The “May respond” entries depend on definitions, sublimits and conditions. The comparing cyber quotes page shows where to find each of these lines.
Why the gap matters now
Business email compromise appears in the FBI’s Internet Crime Complaint Center reports as one of the largest loss categories in recent years. Those numbers reflect complaints filed, so they do not capture every loss. Check the IC3 reports for current figures.
Some insurers are also adding generative-AI exclusions to other lines. A Cloud Security Alliance research note describes this trend. Confirm the details against the original note, and review your own policies, because wording differs by carrier.
What cyber insurance typically pays for
Depending on the policy, cyber coverage may respond to:
- Forensic investigation to find out what happened.
- Legal advice and notification letters.
- Ransomware response, subject to the policy terms and applicable law.
- Lost income while systems are down.
- Stolen funds from payment fraud, usually under a sublimit.
Each item has its own limits and conditions. Read the wording before assuming any one of them is included.
What cyber insurance can cost a small firm
Standalone cyber for a small firm can start around $500 a year, depending on size, location and coverage. Larger firms, higher limits and more revenue can raise the price. A quote is the only way to see what applies to your firm.
What the cyber application asks
The application typically asks about multifactor authentication (MFA), backups and how the firm handles payment changes. Many firms can complete it in a short sitting if they know the answers. The cyber application shows the kinds of questions firms are typically asked.
Real-world example
Consider a hypothetical eight-person architecture firm with professional liability and general liability but no cyber policy. The bookkeeper receives an email that appears to come from a consultant and asks her to update bank details. She does, and an invoice is paid to the wrong account.
The firm checks its policies. Professional liability responds to design and advice claims, and nothing here involves a design error. General liability does not apply, since no one was injured and no property was damaged. The firm has nothing built for the loss.
A standalone cyber policy might have responded, depending on the social engineering wording, sublimit and verification conditions.
What to check in your policies
Firms may want to review:
- The professional liability policy has any cyber or media extension, and what its limit is.
- The general liability policy excludes data-related claims.
- The firm carries a standalone cyber policy.
- The firm could answer the cyber application questions about MFA and backups.
- A written callback rule exists for payment changes.
Hardcover insight
Firms often tell us they assume professional liability handles anything that goes wrong in the office. Assumptions like that makes sense since the policy is called “professional.” Reading the insuring agreement usually shows it is tied to professional services. Finding that out before an incident is far easier than finding it out after one.
Related questions
Does professional liability cover ransomware?
Usually not. Professional liability responds to claims about professional services, but there are some forms that include narrow cyber extensions, so check the wording.
Does general liability cover a data breach?
Typically not. General liability is built for bodily injury and property damage, and it usually excludes data-related claims.
What does a standalone cyber policy cover that my other policies do not?
Depending on the policy, it may cover forensics, legal costs, notification, ransomware response, lost income and stolen funds under a sublimit.
How much does cyber insurance cost for a small firm?
It can start around $500 a year, depending on size, location and coverage. A quote shows the actual price for your firm.
Do small firms really get targeted?
Reports suggest smaller organizations are targeted often, partly because attackers use automation. Make sure to check the figures in the original reports before relying on any one number.