Coverage · 6 min read

Cyber is your first floor, not your whole house

Think of cyber risk like the door to your office. Closing that door is not the same as locking it, and a closed but unlocked door is exactly what an attacker is hoping to find.

That last part is the gap most Canadian business owners worry about, and it is the one I get called about most. But cyber is rarely the only door left open. It is the first one. It is also the ground floor of a much bigger building, what I call the coverage tower. This post walks through how the locks work, what sits on the floors above cyber, and why we almost always start at the front door.

Start with the floor most businesses forget

Your regular business policies (commercial general liability, property, a business package) were built for the physical world. Someone slips in your shop. A pipe bursts. A truck backs into your sign. They were never built for a ransomware attack, a wire fraud, or a stolen database, and most of them exclude those events outright. (I wrote more about that in Closing the Cyber Protection Gap.)

So that is where we start clients. Cyber. It is the coverage most businesses are missing, it has grown the fastest, and it is the one your other policies will not answer. Lock that door first with a dedicated cyber policy sized to your real risk, and you have closed the gap that does the most damage to Canadian businesses. That is your Cyber Coverage Blueprint.

Controls are the deadbolt

A closed door stops nobody. A deadbolt stops most. Your controls are that deadbolt. Multi-factor authentication, backups that are tested and kept separate, and staff who can spot a phishing email before they click. Most attacks are not masterminds picking your business out of a crowd. They are attackers rattling thousands of door handles, looking for one that turns. Make your door hard enough to force, and they give up and go find an easier one down the street.

Two things come out of that. First, good controls are the cheapest protection you will ever buy, and they bring your premium down, because underwriters price the strength of your locks. Second, no lock is perfect. Someone determined gets in. An employee props the door open with one click. A brand new flaw shows up before anyone has patched it. Cyber insurance is what pays for the damage when that happens. Controls make a claim less likely. Insurance makes a claim survivable. You want both.

Then, as your business grows, we build up.

The coverage tower, floor by floor

Picture a building where each floor handles a different kind of loss. The gaps between the floors are where the uninsured surprises hide.

The base, your traditional lines. Commercial general liability and property (usually bundled as a package) cover the physical basics. Bodily injury, property damage, your premises and contents. Necessary, but blind to anything digital.

The cyber floor. A dedicated cyber policy covers both sides of an incident. Your own losses (business interruption, data restoration, extortion payments, notifying the people affected) and your liability to others (customers or partners whose data was exposed). This is where we start.

The professional floor: Tech E&O and E&O. If you build or sell technology, host client data, or run systems other people rely on, Technology Errors and Omissions answers a claim that your product or service failed and cost a client money. If you give advice or deliver a professional service, Errors and Omissions (also called Professional Liability) does the same for your work. These sit right next to cyber, and one event often hits both.

The leadership floor: D&O. Directors and Officers protects the people running the business when a decision gets challenged. Privacy law and breach reporting keep tightening in Canada, so cyber is now a boardroom issue, not just an IT one. That can turn it into a leadership liability question.

Raising the whole tower: excess and specialty. As your contracts get bigger and clients ask for higher limits, an umbrella or excess layer lifts your limits across several floors at once. Specialty covers like crime and social engineering, or employment practices, fill specific seams.

One incident, three floors

Here is why seeing the whole building matters. Picture a small Canadian software company that gets breached.

• The cyber floor responds to the breach itself. Forensics, restoring systems, notifying the people affected, the ransom demand.
• A client sues because the outage broke a service commitment. That is a Tech E&O claim, not a cyber one.
• A regulator or an investor starts asking what the leadership knew and when. Now you are on the D&O floor.

One event, three different policies. Or three different gaps. A business that only bought the cyber floor is still far better off than one that bought nothing, but it has exposure sitting two floors up. I am not saying buy everything at once. I am saying know which floor an incident is going to land on before it does.

Cyber first, then the full Blueprint

This is the path I walk most clients through. We start with cyber, your Cyber Coverage Blueprint, because it is the most urgent and most-missed floor. Then, as you grow, we build up into the full structure. That is the Commercial Coverage Blueprint, a complete portfolio that covers every line and closes the seams between them.

The wider work runs through St. Andrews Insurance Brokers Ltd., where I am a Registered Insurance Broker. Same person, same plain-English advice, just a taller building. You do not have to decide all of it today. You just have to start with a door that is actually locked.

The takeaway

• A closed door is not a locked one. Controls (MFA, backups, training) are the deadbolt that sends most attackers looking for an easier target.
• Controls make a claim less likely. Insurance makes a claim survivable. You want both.
• Your regular liability and property policies usually exclude cyber. A dedicated cyber policy fills that floor.
• As you grow, Tech E&O, E&O, and D&O cover losses that cyber does not, and one incident can trigger more than one.
• Cyber first, then the full portfolio, all through one broker.

By J.R. Genua, CCIS, Certified Cyber Insurance Specialist and Registered Insurance Broker. Adapted from the free guide Cyber Risk & Canadian SMEs: What Every Business Owner Needs to Know.