Cyber Insurance Coverage Gaps: Which Policy Pays?

Quick look: Cyber insurance is a smart safeguard, but it does not automatically cover every financial impact from a cyber event. A payroll diversion or a deepfake wire request can fall under crime, errors and omissions (E&O), business interruption, or another policy entirely. Here, we cover what to review now and the question every leadership team should ask to guide their strategy.

Imagine it’s a Monday morning, payroll is due, and the human resources information system (HRIS) platform is down. Or a fraudulent email is sent to accounting, asking to update a vendor’s bank details. Both start as cyber events, and they are far from rare. U.S. insurers received nearly 50,000 cyber claims in 2024, up almost 40% from the year before, according to the National Association of Insurance Commissioners (NAIC).

Plenty of business leaders believe that buying cyber insurance automatically protects the company from the financial consequences of a cyber event. However, whether the cyber policy pays depends on where the loss lands, which could be a crime or business interruption policy, or no policy at all.

To ensure your organization is adequately covered, it’s crucial to know where cyber coverage gaps tend to hide.

The state of cyber insurance claims

According to the same NAIC report, in 2024, 74% of the 28,555 closed claims ended without payment. Reasons weren’t provided for why each claim closed, so the figure isn’t a denial rate, and it isn’t proof that cyber insurance doesn’t work. Regardless, it shows that many losses don’t fall within the coverage organizations expect them to.

That can create a significant governance issue for executive teams, as today’s cyber events reach well beyond ransomware and data breaches:

• Payroll diversion schemes: A criminal impersonates an employee or a company’s self-service login page, then changes direct deposit details so a paycheck is sent to the wrong account. Per the FBI, some criminals use fake search ads to imitate employee self-service sites for this purpose.
• Executive deepfakes: Cybercriminals use artificial intelligence (AI) to create convincing personas of senior leadership and get approval to transfer money, etc.
• Fraudulent wire instructions: For example, someone impersonating a vendor emails new bank details before a payment run, and the next payment goes to a criminal’s account.
• Compromised vendor accounts: A supplier’s hacked email account sends convincing invoices or payment change requests that look routine.
• HRIS outages: An attack or system failure takes the HR information system offline, stalling payroll and timekeeping.
• Cloud platform failures: A provider outage interrupts operations.
• Social engineering attacks: Sophisticated calls, texts, and emails can persuade an employee to share credentials or authorize a payment.

These instances are occurring at an increasing rate. Deloitte forecasts that generative AI could enable U.S. fraud losses to reach $40 billion by 2027, up from $12.3 billion in 2023. The FBI also logged more than 22,000 complaints that referenced artificial intelligence in 2025, worth about $893 million in losses.

Each of the above scenarios may originate from a cyber incident. But the financial loss may ultimately fall under a crime, cyber, errors and omissions (E&O), or business interruption policy, and that’s where organizations may become exposed and discover that “insured” doesn’t necessarily mean “covered.”

What’s at stake for employers, and key steps to take

Exposures often span multiple insurance policies. A payroll interruption creates an IT problem, and it also affects wage payment obligations, employee relations, regulatory exposure, potential employment claims, and the business’s reputation.

That’s why this can’t be treated as an annual renewal discussion. It’s an enterprise risk management discussion.

Review policies

A good place to start is conducting a review of your cyber and crime policies side by side.

For small businesses, it can make sense to first evaluate social engineering and fraudulent instruction coverage alongside funds-transfer fraud, since those are the schemes most likely to affect smaller teams.

Next, look at timing and dependency, including business interruption waiting periods and contingent business interruption for losses that start at a vendor.

Then, check system failure coverage and third-party vendor incidents, because an outage you didn’t cause can still stop your own payroll.

Lastly, read the fine print on voluntary-parting exclusions, which can come into play when an employee knowingly sends funds after being deceived, and on AI-generated impersonation and deepfake fraud, where older policy language may not cover these modern attacks.

Create an action plan

Knowing who to call, which policy is involved, and quickly requesting a recall of funds at your financial institution is essential when facing an attack. The FBI reiterates that time is of the essence after a fraudulent transfer, and its Recovery Asset Team froze 58% of attempted theft in 2025.

Center your strategy on one important question

Instead of simply asking, “Do we have cyber insurance?” the better question is, “If this specific financial loss occurred tomorrow, which policy actually pays?”

If the answer isn’t immediately clear, you’ve identified a risk worth addressing.

How a PEO helps close coverage gaps

At the core of a strong risk management strategy is understanding where risk transfers, and where it doesn’t. While important, some small businesses may not have the bandwidth to review paperwork across multiple policies and identify weaknesses.

A professional employer organization (PEO) can bring structure and simplicity to that work.

For example, as part of its comprehensive HR solution, ExtensisHR offers a full range of risk and compliance services, backed by a team of experts:

• Employer Protection Program: Designed to reduce exposure and provide protection against today’s most common employment risks, from discrimination to wrongful termination.
  • Employment practices liability insurance (EPLI)
  • Legal defense benefit
  • Information protection plan
  • Fiduciary liability
  • Global protection executive assistance services
  • Additional services such as cyber liability insurance and payroll diversion protection, plus crisis management expense reimbursement and more*
    
    *Terms, conditions, and some exclusions may apply. Additional coverage options are available upon request.
• Workers’ compensation: Pay-as-you-go simplifies coverage and provides the support your employees need.
  • Timely claims review
  • Fraud prevention support
  • Return-to-work programs to ease employee transitions
  • Multistate compliance navigation
• Unemployment claims management: We manage the process from start to finish.
  • Proper documentation for employee separations
  • Accurate claim coding to maintain compliance
  • Direct communication with state agencies in the event of a claim
  • Insight into eligibility and potentially disputable claims
• Workplace safety: Support for building and maintaining programs that reduce risk and reinforce compliance.
  • Claims history assessment to identify accident patterns and gaps
  • Tailored workplace safety programs and strategy development
  • Employee training on workplace safety and health, including hazard identification
  • OSHA-aligned policies and documentation support

Cyber risk isn’t going away, and the most important thing employers can do is consider which policy pays for various types of losses while the stakes are still hypothetical. A PEO adds another layer of protection and expertise to that effort, so your coverage and your day-to-day HR operations act as one coordinated defense.