Cyber Insurance for San Antonio Businesses: What It Covers, What It Doesn\'t, and How to Get It

Cyber insurance has gone from a niche product to a business necessity in less than a decade. The surge in ransomware attacks, data breaches, and business email compromise fraud has made cyber risk one of the most significant financial risks facing small and mid-sized businesses.

But the cyber insurance market has changed dramatically. Insurers have paid out billions in claims, and they've responded by tightening underwriting requirements, raising premiums, and reducing coverage limits. Getting good cyber coverage in 2026 requires meeting specific security requirements — and understanding what you're actually buying.

What Cyber Insurance Covers

Cyber insurance policies vary significantly, but most comprehensive policies cover some combination of:

First-party coverage (your own losses):

• Business interruption — lost revenue during a cyber incident

• Data recovery — costs to restore or recreate lost or corrupted data

• Ransomware payments — the ransom itself (though this is increasingly controversial)

• Cyber extortion response — costs of negotiating with ransomware operators

• Notification costs — required breach notifications to affected individuals

• Credit monitoring — for affected individuals after a data breach

• Crisis management and PR — managing reputational damage after a breach

• Forensic investigation — determining what happened and how

Third-party coverage (claims against you):

• Privacy liability — claims from individuals whose data was compromised

• Network security liability — claims from third parties affected by a breach originating from your network

• Regulatory defense and penalties — defense costs and fines from regulatory investigations

• Media liability — claims related to content you publish online

What Cyber Insurance Doesn't Cover

Understanding exclusions is as important as understanding coverage:

Prior acts. Most policies don't cover incidents that began before the policy's retroactive date. If an attacker has been in your network for months before you discover the breach, coverage may be limited.

Unencrypted data. Many policies exclude or limit coverage for breaches involving unencrypted data. If you're storing sensitive data without encryption, you may find your claim denied.

Failure to maintain security controls. If you represented in your application that you had certain security controls in place and you didn't — or if you let them lapse — the insurer may deny your claim.

War and nation-state attacks. Most policies exclude losses from acts of war. The line between criminal ransomware and nation-state attacks is increasingly blurry, and some insurers have tried to invoke war exclusions for major ransomware incidents.

Social engineering fraud. Business email compromise and other social engineering fraud may be covered under a separate crime or fraud rider, not the main cyber policy. Check your policy carefully.

What Insurers Require in 2026

The underwriting requirements for cyber insurance have tightened significantly. Insurers now routinely require:

Multi-factor authentication. MFA on email, remote access (VPN/RDP), and privileged accounts is now a baseline requirement for most insurers. Some require MFA on all systems.

Endpoint detection and response. Basic antivirus is no longer sufficient. Most insurers require EDR on all endpoints.

Privileged access management. Limiting and monitoring privileged account usage is increasingly required.

Backup and recovery. Tested, immutable, offsite backups are required by most insurers. Some require specific recovery time objectives.

Patch management. A documented, enforced patch management program is required.

Security awareness training. Regular phishing simulation and security awareness training is required by most insurers.

Incident response plan. A documented incident response plan is required by most insurers.

If you can't demonstrate these controls, you may be unable to get coverage — or you'll pay significantly higher premiums.

How to Get the Best Rate

Implement the required controls before applying. Insurers assess your security posture during underwriting. Better controls mean lower premiums. Implementing controls after getting coverage doesn't reduce your premium.

Work with a broker who specializes in cyber. Cyber insurance is complex and the market changes rapidly. A broker who specializes in cyber will know which insurers are offering the best terms for your industry and risk profile.

Be accurate on your application. Misrepresenting your security controls on a cyber insurance application can result in claim denial. Answer questions accurately, even if it means higher premiums.

Consider your limits carefully. The average ransomware claim for an SMB is now $1.4 million. Make sure your coverage limits are adequate for your actual risk exposure.

Review your policy annually. The cyber insurance market changes rapidly. Your coverage that was adequate last year may have gaps today.

The Relationship Between Security and Insurance

Cyber insurance is not a substitute for security. It's a financial backstop for when security fails. The best approach is to invest in security controls that reduce the likelihood and severity of incidents — and then use insurance to cover the residual risk.

Our free Zone Intelligence Scanner can identify security gaps that might affect your insurability. For a comprehensive security assessment that prepares you for cyber insurance underwriting, book a free IT assessment with our team.