Quick Answer
Yes, in most cases. A standalone cyber policy usually pays for breaches caused by honest employee mistakes, such as a phishing click, a lost laptop or an email sent to the wrong person. It can refuse or cut the claim if a required control like MFA was missing, the application was inaccurate, or the loss was money an employee wired to a scammer without a social engineering endorsement.
Ready to check your coverage?
“Trust me the insurance company will be trying to find any reason to deny your claim.” We hear some version of that from business owners every week. Another told us their security questionnaire ended up “in the hands of an office manager who spends hours searching for information and making educated guesses.” So when someone on your team clicks the wrong link, the real question isn’t whether you have cyber insurance. It’s whether that policy will pay for a mistake made by one of your own people.
The Coyle Group is a commercial insurance agency that handles the complex, high-value risks other agencies don’t know how to structure, where the details in the policy are the difference between a paid claim and a denied one.
If you’re worried that one employee’s click could cost you six figures, and you’re not sure your cyber policy would pay, you’re not alone. We manage the market for you: we read your cyber and crime forms first, check every condition that could block a human error claim, then decide which insurers should compete to fix it. Almost all insurance programs we review contain at least one fatal mistake. The next step is a short, confidential call.
What does human error cost a business?
Human error can cost a business millions, because most cyber claims start with a person, not a machine. The average data breach now costs USD 4.99 million, and one insurer says human error contributes to 75% of its cyber claims. The bigger surprise is how few owners know their policy pays for it.
Here is what the current data shows:
Breaches have never cost more.
IBM’s Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million, “a 12% increase over last year and a record high.”
People are in the middle of most claims.
Cyber insurer CFC told Insurance Business that human error contributes to 75% of its cyber claims.
The FBI is busier than ever.
Its Internet Crime Complaint Center now averages “almost 3,000 complaints per day,” per CyberScoop’s report on the 2025 IC3 data. Business email compromise alone cost about $3.05 billion.
The threat of experiencing a cyber event is very real. For every event reported to the FBI, can you imagine how many are not?
Is it true that 95% of data breaches are caused by human error?
The 95% figure comes from IBM. IBM’s 2014 Cyber Security Intelligence Index attributed some 95% of security incidents it investigated to human error, based on over 1,000 clients in 133 countries, as TechRepublic reported at the time.
If that statistic by IBM is true, what are you doing to prevent human error? The exact percentage has moved since then, but newer data points the same way. Your people are your biggest exposure, and also your best defense.
Why most small businesses aren’t doing much about it
If you’re a small or medium-sized business, you’re probably not doing much. I get it.
It’s difficult to train employees on risks you may not even understand yourself, or your IT department is too overwhelmed to take on the task of risk control training and awareness. Ongoing training and education aren’t easy. That’s exactly why you need to know: does cyber insurance cover human error when training falls short?
Would your policy pay if someone on your team clicked the wrong link today? Book a call and we’ll find out together.
Does cyber insurance cover human error?
Yes, a standalone cyber policy generally covers breaches caused by honest employee mistakes. Insurers expect people to slip; it’s part of what they price. However, “covered” depends on which insuring agreement responds and whether you kept the promises on your application, which is where most disputes start.
In plain terms, cyber insurance pays for two things after a cyber event: your own costs to respond and recover, and claims other people bring against you. It doesn’t much care whether a hacker or a tired employee opened the door.
Most owners don’t know this. In CFC’s 2026 study, 74% of small and midsize businesses did not realize cyber insurance covers incidents caused by human error. Some security vendors say human error is “typically excluded,” but that’s not how most standalone forms read. What’s usually excluded is intentional wrongdoing and losses tied to broken policy conditions.
Watch: What is Cyber Insurance?
What counts as human error in a cyber policy
Human error means an unintended act by someone inside your business: a phishing click, a misdirected email, a lost laptop, an open cloud folder, a payment sent on a fake request, or client data pasted into an unapproved AI tool. The next section shows how a policy responds to each one.
Accidental mistakes vs intentional acts
Insurers draw the line at intent. An accident is usually covered; a deliberate act by the company usually isn’t. A rogue employee is a gray zone: cyber may pay response costs, while stolen money belongs on a crime policy.
Here are the key aspects at a glance:
Question |
Typical answer on a standalone cyber policy |
|---|---|
|
Is an honest employee mistake covered? |
Usually yes, under breach response and liability |
|
Is a deliberate act by the company covered? |
No, intentional acts are excluded |
|
Is money wired to a scammer covered? |
Only with a social engineering endorsement, often sublimited |
|
Can a missing control void the claim? |
Yes, if the policy or application required it |
|
Does a BOP cyber endorsement do the same job? |
Rarely; many are small and third-party only |
Which employee mistakes does cyber insurance pay for?
Cyber insurance pays for most employee mistakes that expose data or disrupt systems, but not automatically for money an employee sends to a criminal. Each mistake triggers a different part of the policy. So the useful question isn’t “am I covered?” but “which section responds, and how much is in it?”
The table below shows how a typical standalone policy responds:
Employee mistake |
What usually pays |
Policy section |
|---|---|---|
|
Lost or stolen laptop with customer data |
Forensics, legal advice, notification, credit monitoring, client claims |
Breach response; privacy liability |
|
Email with personal data sent to the wrong person |
Legal advice, notification, regulatory response, claims |
Breach response; privacy liability |
|
Cloud storage left open |
Investigation, data restoration, notification, defense |
Breach response; network security liability |
|
Phishing click that leads to ransomware |
Forensics, restoration, extortion response, lost income |
Cyber extortion; business interruption; data restoration |
|
Employee wires money after a fake email |
Often nothing, unless the endorsement is on the policy |
Social engineering endorsement, usually sublimited |
|
Client data pasted into an unapproved AI tool |
Depends on the form; ask whether it counts as a privacy event |
Breach response; privacy liability |
Watch: First-Party vs. Third-Party Coverages in a Cyber Insurance Policy
First-party costs: your own bills
First-party coverage pays your business’s own costs after a mistake. The FTC’s cyber insurance guide lists legal counsel, “recovery and replacement of lost or stolen data,” notification, lost income, forensics and cyber extortion. Our first-party vs third-party cyber guide explains each.
Third-party claims: what others say you owe
Third-party coverage responds when clients, patients or regulators come after you: defense costs, settlements and payments to affected people. See what cyber insurance covers for the full list.
When the money itself is gone
When an employee is fooled into sending a payment, many cyber forms treat it as a voluntary transfer, not a hack. That loss needs a social engineering endorsement or a crime policy. Our post on what social engineering is shows how these schemes work.
Watch: Your Cyber Insurance Policy Won’t Cover Social Engineering Fraud (Here’s Why)
Not sure which section of your policy would respond? Contact us and we’ll map it for you.
Why do human error claims get denied?
Human error claims rarely get denied because of the mistake itself; they get denied because of a broken promise or a missing endorsement. The click is expected. What insurers question is whether you had the controls you said you had, and whether the loss fits the policy you bought.
As one owner put it: “Wrong answers can void an insurance claim later.” Here are the five triggers I see most often.
1. MFA you said you had, but didn’t
If your application says MFA is on every login and one account lacks it, the insurer may deny or reduce the claim when the breach comes through that account.
Watch: What is MFA or Multi-Factor Authentication?
2. An inaccurate application
The security questionnaire is part of the contract. A wrong answer, even an accidental one, invites a misrepresentation argument. Never let anyone guess on these forms.
3. Failure to maintain the security you described
Many policies require patches, backups and training to stay in place all year, and some deny losses from known, unpatched vulnerabilities. Letting a control lapse mid-year can be as damaging as never having it. Our page on cyber insurance not paying out covers more denial patterns.
4. Voluntary parting and tiny sublimits
A “voluntary parting” clause can exclude money an employee wires to a fraudster. Even when covered, it’s often capped well below the main limit. Our comparison of cyber vs crime insurance explains where each loss belongs.
5. Reporting too late
Most cyber policies require prompt notice. Many owners hold back because they assume an employee’s mistake voids coverage; it usually doesn’t. Waiting to see if the problem goes away is what can cost you the claim. Call your broker and the insurer’s breach hotline first.
What cyber insurance doesn’t cover at all
Some losses sit outside any cyber policy: intentional wrongdoing by the company, incidents you knew about before the policy started, and physical damage that belongs on your property policy. Fines and penalties vary by form and by state.
Want a second set of eyes on your last cyber application? Book a call and we’ll review the answers with you.
Which businesses face the most human error risk?
Any business with email, client data and staff who move money faces human error risk, but some industries carry far more. Exposure grows with the sensitivity of the data and the number of people who can touch it. In practice, the biggest gaps sit in firms that grew fast and never revisited their policy.
These are the businesses I worry about most:
Verizon’s 2026 Data Breach Investigations Report adds new pressure: mobile social engineering now succeeds 40% more often than email phishing, and employee AI tool use jumped from 15% to 45% in a year.
How do you reduce human error and keep your claim payable?
You reduce human error with ongoing training, solid IT protection and the right insurance working together. None of the three works alone. Moreover, the controls that stop mistakes are the same ones underwriters ask about, so prevention also protects your claim.
The bottom line is that cyber risk is a threat that continues to grow, evolve and morph into different forms every day. You need solid protection from your internal IT department or external IT services firm, you need ongoing awareness training to avoid human error, and most of all you need the financial backstop when something does go wrong in the form of cyber insurance.
Train people, and test them
Short, frequent training plus simulated phishing emails changes behavior; an annual slideshow doesn’t. Our guides on cybersecurity awareness training, a training program that works and training for every device show where to start.
Lock down the basics
Use the resources that come with the policy
As a cyber insurance broker in New York, we represent an insurer who offers valuable risk management resources with every cyber policy they issue. These help identify threats and vulnerabilities, provide security awareness to employees, and monitor the dark web for your information. The human error awareness training is engaging and valuable, and could be worth more than the premium you’ll pay for just cyber insurance. Learn more about cyber pre-breach services.
Watch: What are Pre-Breach Services to a Cyber Policy?
Don’t forget ransomware
Ransomware is possibly the greatest threat to businesses of all sizes today, and it often starts with one click. Check that your policy’s ransomware coverage isn’t sublimited. Want to see how ransomware works? Watch my video below.
Watch: Protecting Your Small Business From Ransomware – Updated for 2022
How much does cyber insurance cost, and what moves the price?
Most small and midsize businesses pay about $1,000 to $7,500 a year for cyber insurance, and larger firms pay more. That’s small next to the breach it protects against. However, your quote depends heavily on your controls, so two similar firms can pay very different premiums.
The costs of a breach are all over the ballpark and largely depend on the number of “records” your company has stored. Back when this post first ran, the Ponemon Institute put the average breach at about $4 million; IBM and Ponemon now put it at USD 4.99 million. If you want to find out what a data breach could cost your company, our cyber insurance cost calculator guide breaks down forensics, legal, notification and downtime costs.
Typical annual premium ranges by business size (as of October 2026):
Business size |
Typical annual premium |
Typical limit |
|---|---|---|
|
Very small (1 to 10 employees) |
$1,000 to $2,500 |
$500K to $1M |
|
Small (11 to 50 employees) |
$1,500 to $4,000 |
$1M to $2M |
|
Medium (51 to 200 employees) |
$3,000 to $7,500 |
$2M to $5M |
|
Larger (200+ employees) |
$7,500 to $25,000+ |
$5M to $10M+ |
These ranges reflect our market experience; industry, data, controls and claims history move them. For limits, see how much cyber insurance you should buy.
Watch: Cyber Insurance Cost Calculator: Fast, Easy, and Totally Wrong
What underwriters check before they cover human error
These factors decide your price and whether a human error claim will hold up:
Factor |
Why underwriters care |
What to have ready |
|---|---|---|
|
MFA coverage |
Stolen passwords are a top way in |
A list of every system with MFA and the date it went live |
|
Security awareness training |
Trained staff click less |
Training records and phishing test results |
|
Backups |
Backups cut ransomware losses |
Proof backups are offline and tested |
|
Payment controls |
Fake wire requests start with people |
A written callback and dual-approval procedure |
|
Records held |
More records means bigger notification costs |
An estimate of records by type (clients, patients, employees) |
Want a rough premium first?
If you want a rough idea of the premiums, send me an email and include your firm’s full name and annual revenues. We’ll respond with a premium “indication,” which is a ballpark premium subject to some additional underwriting. If it looks good to you, we’ll ask you to complete a ONE PAGE application (for firms under $50M in revenue). Fast, simple, effective.
Ready for a number based on real underwriting? Book a call and we’ll start with your controls.
What are the benefits of cyber insurance that covers human error?
The main benefit is that one employee’s mistake doesn’t become a six- or seven-figure bill for the business. A well-built policy turns an unknown loss into a known premium and brings in breach specialists during the first 24 hours.
Here’s what the right policy protects you from:
What should you watch out for in a human error claim?
Watch out for small endorsements, hidden sublimits and conditions you can’t prove you met. These gaps turn “covered” into a partial check. In my experience, most are cheap to fix once someone actually reads the policy.
I audit programs for a living, and I find a fatal flaw in roughly 9 out of 10 of them. For cyber, I call the most common one the Cyber Coverage Mirage: a policy that says “cyber” on the declarations page but can’t pay for the loss you’ll actually have.
Real-world example: the “cyber” that wasn’t.
A boutique M&A advisory firm believed it had cyber insurance. What it had was a $50,000, third-party-only endorsement on its business owners policy. A third-party-only endorsement doesn’t pay your own forensics or notification bill after an employee mistake. We replaced the $280 endorsement with a $1,300-a-year standalone cyber policy. See more cyber insurance claims examples.
Red flags your cyber coverage won’t handle human error
Watch: Is a Cyber Endorsement to a BOP Sufficient?
How do you check whether your policy covers human error?
Pull your declarations page, your policy form and your last application, then answer five questions. If you can’t answer one, that’s your gap. It takes about 20 minutes and answers “does cyber insurance cover human error” for your business specifically.
- Is this a standalone cyber policy, with both first-party and third-party coverage?
- Is social engineering listed, and is the limit at least your largest typical payment?
- Does every “yes” on the application match what’s true in your systems today?
- What does the policy require for MFA, backups and training during the policy period?
- Who do you call first, and how quickly must you report an incident?
For a structured view, try our cyber risk scorecard, avoid these cyber insurance myths and see how often to review your business insurance. Our cyber insurance renewal guide shows what underwriters ask.
Why work with The Coyle Group on cyber insurance?
We start by reading your policy and your application, not by sending out quotes. That’s how we answer “does cyber insurance cover human error” for you before a claim, not during one. I hold the CPCU and ARM designations, and 95% of our clients stay with us.
The Coyle Process
Diagnose the risk.
We learn how your people handle data, devices and payments, and read your forms.
Identify the right insurers.
We decide which carriers fit your controls and industry before anything goes to market.
Explain where we’re going and why.
You know which insurers we’ll approach and why.
Bring viable options back for comparison.
You compare coverage side by side, not just price.
The benefit is simple: fewer applications, fewer duplicate requests and one point of contact.
About shopping your coverage
Comparing options is smart; shopping indiscriminately is different. When several brokers send your account out, the same insurers see duplicate applications, and a generalist can misclassify your risk on the security questionnaire, the very document that decides a human error claim. You don’t need five brokers shopping your insurance. You need one capable broker making sure the right insurers compete for your business.
Who this isn’t right for
If you’re looking for someone to rubber-stamp what you already have at a lower price, there are brokers who will do that. We’re not one of them. A very small business with a simple, standard risk may be well served by a basic packaged policy, and I’ll say so; our small business cyber insurance guide is a good start. And if you need home or auto coverage, we only handle business insurance.
Your next step: a 15-minute call, not an application
Want to learn more? Let’s start a conversation.
Ready to know your policy would pay? Book a call and let’s have a 15-minute conversation.
Frequently Asked Questions
Author’s Expertise
This article was written by the CEO of The Coyle Group, Gordon B. Coyle, CPCU, ARM, AMIM, PWCA, who has over 40 years of experience working with business owners of all sizes and industries across the US, solving their insurance challenges.
