Do you already have cyber on your BOP?

What the BOP endorsement usually gives you

Many business owners policies include a small cyber endorsement, often a modest sublimit added for little or no visible premium. It typically provides a limited amount of breach response and some third-party privacy liability. For a very simple business with almost no digital footprint, that can be a reasonable starting point.

The problem is not that the endorsement is worthless. The problem is that owners read the word cyber on the declarations page and assume they are covered for the losses they actually hear about, and usually they are not.

The five losses the endorsement usually misses

Across the accounts we see, the same gaps show up again and again:

• Funds transfer fraud and social engineering, the spoofed email that reroutes a payment, is frequently excluded or held to a sublimit far below the policy limit.
• Ransomware recovery costs, including restoration and the lost income while systems are down, often exceed a small endorsement in a single event.
• Dependent business interruption, when a vendor or platform you rely on goes down, is rarely present on an endorsement at all.
• Regulatory defense and the costs tied to a breach of records can run past a modest sublimit quickly.
• Adequate breach response limits, the forensics, notification, and legal work a real incident requires, are usually undersized.

How to check what you actually have

You do not have to guess. Pull your business owners policy declarations page and look for a cyber or data compromise endorsement, then read the sublimit next to it and whether social engineering or funds transfer fraud is named. If it is sublimited or absent, that is the gap.

If reading the endorsement is not how you want to spend an afternoon, share your current policy through our coverage review and we will read the cyber piece for you and tell you plainly where it responds and where it does not.

When a standalone policy is the right move

A standalone cyber policy is a separate contract built for these exposures. It carries its own limit, broader coverage grants, and the ability to add social engineering and dependent business interruption as real, adequately sized coverages rather than afterthoughts.

The upgrade is not always dramatic in cost, and for a business that emails invoices or moves money by wire, it is usually the difference between a policy that looks like cyber and one that responds like it. We compare both so the decision is informed, not assumed.