Cyber Insurance vs. Crime, General Liability, and E&O: Where Texas Businesses Have Gaps

The Modern Digital Trap for Texas Businesses

A commercial plumbing supplier in Fort Worth received an email that appeared to come directly from their primary pipe distributor. The email contained an attached invoice with updated routing instructions for an upcoming $120,000 inventory shipment. The accounting clerk confirmed the invoice matched outstanding purchase orders, processed the wire transfer, and marked the account settled. Five days later, the real distributor called asking why payment had not arrived. The money had disappeared into an offshore account, and the business owner immediately filed a claim under their commercial general liability policy.

The insurer denied the claim within forty-eight hours.

Next, the owner turned to their commercial property policy, which also issued a swift denial. In the end, the company absorbed a six-figure loss completely out of pocket.

Scenarios like this play out across Texas every single week. In our decades of working with commercial clients across the state, we have seen an alarming pattern: business owners assume that carrying standard commercial insurance means they are protected against digital threats, fraudulent transfers, and data disasters.

Insurance policies are legal contracts built in distinct silos. Commercial general liability, commercial crime, professional liability (errors and omissions), and cyber insurance were each written to solve fundamentally different problems. When a threat crosses the boundary between digital deception, operational error, and physical property, these policies can collide, leave massive gaps, or point fingers at one another.

To protect your balance sheet, you need to understand how these policies interact, where they leave you exposed, and how to coordinate your coverage so that a single phishing email, wire scam, or software mishap does not threaten everything you have built.

Understanding Policy Silos: Why Traditional Policies Miss Modern Cyber Threats

Commercial insurance evolved long before the internet became the backbone of daily operations. For generations, business risk was largely tangible. A customer slipped in an aisle, a fire gutted a warehouse, an employee stole cash from a safe, or an accountant made an arithmetic error on a tax return. The insurance industry created specific, standardized policies to handle each of those hazards.

Commercial general liability (CGL) policies address bodily injury and physical property damage suffered by third parties. Commercial crime policies protect against the theft of money, securities, or tangible property by rogue employees or outside burglars. Professional liability, also called Errors and Omissions (E&O), protects service providers when an alleged mistake, omission, or failure in their professional work causes a financial loss for a client.

When hackers began locking servers and manipulating payment instructions, policyholders turned to these legacy policies for relief. In response, insurance carriers updated their standard policy forms to explicitly exclude digital losses. Standard Insurance Services Office (ISO) commercial general liability forms now routinely feature mandatory electronic data exclusions. Under these provisions, digital records, customer databases, and software applications are defined as intangible property. If a rogue program erases your client records or corrupts your point-of-sale system, your CGL policy will not treat that loss as property damage.

The debate over cyber insurance vs general liability insurance is often settled the hard way during a claim. A standard general liability policy covers accidents that happen in the physical world. If a contractor drops a ladder onto a homeowner's luxury sedan, CGL pays. If a contractor's laptop is stolen from a truck bed and customer credit card data is leaked onto the dark web, the CGL policy walks away from the loss. It will not pay for digital forensics, state-mandated notifications, crisis communications, or regulatory penalties.

To make matters more challenging for Texas businesses, our state is one of the most targeted regions in the country. Annual reporting from the FBI Internet Crime Complaint Center consistently ranks Texas second in the United States for total cybercrime losses, with reported damages routinely exceeding $1.35 billion per year. Business email compromise alone accounts for hundreds of millions of dollars in losses across Texas enterprises each year.

Treating digital security as a minor risk or relying on basic policies creates an illusion of security. Real protection requires a dedicated Texas cyber liability insurance policy, but even cyber policies cannot exist on an island. They must be coordinated carefully with your crime, liability, and professional coverage.

Four Critical Coverage Intersections Where Texas Businesses Fall Through the Cracks

The biggest financial surprises do not happen because a business has zero insurance. They happen when a business experiences a loss that falls directly into the seam between two uncoordinated policies. Below are four common collision points where Texas business owners discover dangerous coverage gaps.

1. Wire Fraud, Phishing, and Social Engineering

The boundary between commercial crime insurance and cyber insurance is arguably the most misunderstood intersection in commercial lines.

Suppose a cybercriminal compromises a vendor's email system, monitors communications, and sends your controller a fraudulent invoice with modified wire details. The controller voluntarily authorizes the bank wire transfer.

When you file a claim under your commercial crime policy, the carrier often points to the voluntary parting exclusion. Traditional crime policies were designed to cover situations where someone breaks in and steals cash, or an employee secretly embezzles funds. When your own staff willingly transmits funds under false pretenses, standard crime forms deny coverage unless you have a specific social engineering or fraudulent instruction endorsement.

If you turn to your standalone cyber insurance policy, you may encounter another roadblock. Some cyber policies exclude funds transfer fraud, arguing that money theft belongs on a crime policy. Other cyber forms include funds transfer fraud coverage, but limit the payout to a modest $25,000 or $50,000 sublimit. If you run a construction company, real estate firm, or manufacturing plant where routine wires exceed $200,000, that sublimit covers only pennies on the dollar.

Without aligning your crime policy and cyber policy endorsements, you end up in a finger-pointing contest between two adjusters while your working capital is gone. For smaller firms, reviewing BOP endorsements for crime and cyber is an essential first step to verify whether social engineering is included or excluded.

2. Service Failure vs. System Intrusion

For technology service providers, consultants, bookkeepers, medical billing services, and logistics managers, the boundary between errors and omissions and cyber liability is razor-thin. When a client suffers financial harm because of a technical problem, sorting out whether the incident was a professional mistake or a security failure is contentious.

Consider a cloud consulting agency based in Austin that manages enterprise email and storage configurations. An engineer misconfigures an access control bucket during a scheduled migration, leaving customer records publicly accessible for seventy-two hours. A third party accesses the files, leading to a major breach and subsequent client lawsuits.

Does this claim fall under professional liability, or does it belong under cyber liability?

• If the business owner files under an E&O policy, the carrier may argue that the core loss stemmed from an unauthorized digital intrusion and data compromise, which is barred by an absolute cyber exclusion on the professional liability form.
• If the owner files under a standalone cyber policy, that insurer might claim the root cause was improper execution of contracted professional services, pointing back to professional liability. These cyber insurance and professional liability coverage gaps trap service businesses that purchase uncoordinated policies from different carriers. If your E&O policy excludes cyber incidents, and your cyber policy excludes professional service delivery disputes, you are left with zero defense coverage against an expensive third-party lawsuit.

3. Customer Privacy, Lawsuits, and State Regulatory Fines

Many business owners believe that Coverage B of their commercial general liability policy protects them against privacy-related lawsuits. Coverage B covers personal and advertising injury, which includes claims arising from false arrest, malicious prosecution, wrongful eviction, libel, slander, and oral or written publication of material that violates a person's right of privacy.

Policyholders have argued in court that an accidental data spill is an unauthorized publication that violates a person's right of privacy. However, insurance carriers have closed this avenue through explicit exclusionary language. In almost every modern commercial policy issued in Texas, CGL coverage explicitly excludes liability arising out of any access to or disclosure of confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information, or any other type of nonpublic information.

When customer data is compromised, your financial exposures quickly escalate:

• Forensic IT investigation to discover how intruders got in and what was viewed.
• Legal counsel to determine multi-jurisdictional notification triggers.
• Direct notification mailings and credit monitoring services for affected individuals.
• Public relations management to mitigate brand erosion.
• Defense costs and regulatory fines levied by governmental authorities. In Texas, state law imposes clear, aggressive timelines. Under Chapter 521 of the Texas Business and Commerce Code, enforced by the Office of the Texas Attorney General, businesses that experience a breach affecting 250 or more Texas residents must report the incident to the state Attorney General as soon as practicable, and no later than thirty days after discovery. Furthermore, affected consumers must be notified without unreasonable delay.

A standard general liability policy will not cover a single dollar of those forensic fees, notification expenses, or statutory penalties. Only a dedicated cyber policy with third-party network security and privacy liability coverage defends you against these statutory investigations and class action demands.

4. Ransomware, Operational Downtime, and Extortion

When malicious code encrypts your servers, production grinds to a halt. Invoicing stops, shipping docks fall silent, and customer service teams cannot access client accounts.

Business owners often look at their commercial property insurance, noting that they purchased business interruption coverage to replace lost operating income. But property policies require direct physical loss or damage to covered property by a covered peril, such as a windstorm, fire, or pipe burst. Courts and insurance contracts overwhelmingly treat encrypted or destroyed digital files as intangible property, not physical damage.

Unless you carry robust ransomware insurance for Texas businesses, your business interruption losses during a digital shutdown are entirely uninsured. A mature first-party cyber policy covers the forensic investigation to clean the system, the negotiations and ransom settlement where legally permissible, and the verifiable net income loss and ongoing payroll expenses sustained while your systems are offline.

How to Coordinate Policies and Eliminate Claims Surprises

Closing these exposures requires looking at your risk portfolio holistically rather than purchasing individual policies in isolation. As independent agents, we approach risk management by evaluating how different insurance forms work together in an actual loss. Here is how Texas business owners can eliminate dangerous gaps.

          +-------------------------------------------------------+
          |         THE FOUR CORNERS OF BUSINESS PROTECTION       |
          +-------------------------------------------------------+
                                      |
       +------------------------------+------------------------------+
       |                              |                              |
       v                              v                              v
+------------------+          +------------------+          +------------------+
| COMMERCIAL GL    |          | COMMERCIAL CRIME |          |  CYBER / TECH    |
| - Bodily injury  |          | - Employee theft |          | - Ransomware     |
| - Property damage|          | - Forgery        |          | - Data breach    |
| - Slip and falls |          | - Safe burglary  |          | - Wire fraud     |
| - Premises risks |          | - Robbery        |          | - Network outage |
+------------------+          +------------------+          +------------------+
                                      ^
                                      |
                              +------------------+
                              | PROFESSIONAL E&O |
                              | - Work mistakes  |
                              | - Advice errors  |
                              | - Contract fail  |
                              | - Omissions      |
                              +------------------+

Audit Exclusions Across Every Active Policy

The first step is reviewing the exclusions in your existing policies. Look specifically at your general liability policy for the Electronic Data Exclusion and the Access or Disclosure of Confidential Information Exclusion.

Next, examine your commercial crime policy. Does it include coverage for Computer and Funds Transfer Fraud, or does it restrict theft to physical property and traditional forgery? Check whether voluntary parting is strictly excluded.

Finally, read the other insurance provisions on all policies. If two policies provide a slice of overlapping coverage, which one acts as primary and which one acts as excess? If the contracts state that each policy is excess over all other valid and collectible insurance, adjusters can stall claim payments while debating priority of coverage.

Align Social Engineering Limits Between Crime and Cyber

Because social engineering and fraudulent instruction claims occur at the intersection of crime and cyber, you need clear alignment. Some businesses carry cyber insurance that includes a modest $50,000 funds transfer fraud limit, while their crime policy carries no social engineering endorsement whatsoever. If an accounting department wires $250,000 based on a spoofed email, the business absorbs an immediate $200,000 net loss.

We advise clients to either:

• Secure a dedicated Social Engineering Fraud endorsement on their commercial crime policy with limits reflecting their highest routine wire transfers, or
• Negotiate full policy limits for fraudulent instruction, funds transfer fraud, and invoice manipulation on their standalone cyber liability policy. Whichever path you choose, make sure the policy language covers both situations: when an employee is deceived into sending money, and when a hacker compromises your system and orders the bank to transmit funds directly.

Combine Cyber and E&O Into a Single Policy When Delivering Services

If your business provides technology consulting, software development, engineering, property management, accounting, or professional advice, separate cyber and professional liability policies from different carriers create built-in friction. In the event of a complicated system breach or client loss, each carrier has a financial incentive to classify the incident as falling under the other insurer's domain.

The cleanest solution is purchasing a combined Technology Errors & Omissions and Cyber Liability policy from a single carrier. Under a unified policy, the same insurer handles both professional mistakes and network security failures. When an incident occurs, you work with a unified claims team, eliminating carrier finger-pointing and ensuring continuous defense coverage.

Integrate Technical Safeguards with Policy Warranties

Insurance carriers no longer issue comprehensive cyber coverage without verifying your internal security controls. If your policy application states that you use Multi-Factor Authentication (MFA) across all administrative accounts, remote access endpoints, and corporate email, you must maintain those safeguards continuously. If an attack occurs and the forensic investigation reveals that MFA was disabled on an administrative portal, the carrier may deny the claim based on a breach of policy conditions or misrepresentation.

Pair your insurance strategy with proactive measures by adopting a thorough Texas cyber risk management playbook. Require dual authorization for any financial transaction exceeding a specified threshold, conduct routine phishing simulations for employees, and mandate verbal callbacks to established telephone numbers whenever a vendor requests an alteration to their payment details.

Practical Checklist: Evaluating Your Business Coverage Synergy

Use this operational checklist during your annual insurance review to verify that your business does not fall victim to split-policy gaps:

• Commercial General Liability Review: Confirm whether your CGL policy contains an absolute data breach exclusion, and verify that your team understands that CGL provides no coverage for digital restoration, ransom demands, or consumer notification.
• Social Engineering and Wire Transfer Review: Determine the maximum dollar value of a single outbound wire transaction in your operations. Confirm that your crime or cyber policy matches or exceeds that limit specifically for social engineering and fraudulent instruction.
• Invoice Manipulation Coverage: Verify whether your cyber policy protects you if an attacker hacks your email and sends fraudulent invoices to your customers, directing them to pay the criminal rather than your business.
• Professional Liability Cyber Exclusions: Check your E&O policy for sweeping cyber exclusions. If you provide professional or technology services, ensure your E&O and cyber policies are linked or written with the same insurance carrier.
• Texas Regulatory Defense and Penalties: Confirm that your cyber policy explicitly covers state and federal regulatory defense costs, investigations, and civil penalties resulting from privacy violations under Chapter 521 of the Texas Business and Commerce Code.
• Vendor and Supply Chain Exposures: Review contracts with third-party IT service providers, managed service providers (MSPs), and software vendors to determine who assumes financial liability if a breach in their environment exposes your records.
• Verification Procedures for Fund Transfers: Implement a written policy requiring telephone confirmation via a known, pre-established phone number before any routing numbers, wiring instructions, or vendor addresses are updated in your accounting software.

Moving Beyond Piecemeal Protection

Cyber risks do not stay neatly inside the lines drawn by traditional insurance products. A single incident can easily involve an employee clicking an unauthorized link, a financial wire transfer sent to an imposter, an operational shutdown caused by locked servers, and a cascade of legal notices required by Texas regulatory authorities.

When you purchase insurance policies piece by piece from different direct websites or disconnected providers, you almost always end up with gaps right where those policies meet. Fixing those vulnerabilities requires an intentional, coordinated approach from professionals who understand the Texas business climate and the mechanics of commercial risk.

By structuring your commercial general liability, crime, professional liability, and cyber coverage so they complement rather than contradict each other, you ensure that when an incident occurs, your business is fully protected, funded, and positioned to recover without delay.

BIG - Brock Insurance Group

Ready to protect what matters to you without overpaying? Call BIG - Brock Insurance Group today or request a quote online, and let our Texas-based independent team shop multiple top carriers to build a tailored plan for your home, auto, life, business, or farm and ranch coverage: Go BIG, Save BIG!

Need coverage advice? Let’s talk.

Get a fast, no-pressure quote and guidance tailored to your needs.