Texas Cyber Liability Insurance: 2025 Guide

Introduction

If you do business in Texas, cyber crime is not a distant risk. The FBI’s 2023 Internet Crime Report recorded 880,418 complaints and more than 12.5 billion dollars in reported losses, with business email compromise alone accounting for 2.9 billion dollars. As an insurance agent who has helped many SMBs work through breach response, I can tell you the difference between a business surviving a cyber event or shutting down often comes down to having the right cyber liability insurance and the right controls in place. This 2025 guide explains how a cyber policy works in Texas, what it covers, and how to qualify at a fair price.

Cyber insurance Texas overview: what is it and why it matters now

Cyber liability insurance (often called cyber risk insurance) protects your business when a data breach, ransomware attack, or business email compromise causes losses you cannot absorb. Unlike general liability, cyber is purpose built for digital incidents. In 2025, carriers are still seeing claims frequency and severity driven by three patterns:

• Business email compromise (BEC) that tricks staff into sending funds or changing banking details

• Ransomware that halts operations or exfiltrates data for extortion

• Third-party vendor incidents that cascade into your systems or data A few realities we discuss with Texas clients:

• Policies are not standardized. NAIC notes cyber contract language varies widely. Sub-limits, coinsurance on ransomware, and differing definitions of “security failure” are common across the market.

• Many cyber policies in Texas are placed with surplus lines carriers overseen by the Texas Department of Insurance (TDI). Form flexibility can be an advantage, but it also means terms differ by insurer.

• Regulators and frameworks are raising the bar. CISA’s advisories emphasize MFA, patching, and offline backups. The FTC’s Safeguards Rule (GLBA) expects financial institutions to implement risk assessments, MFA, and vendor oversight. Texas also has strong breach notification rules in Business and Commerce Code 521.053. For small and midsize businesses, this is not just an IT problem. It is a business continuity and regulatory risk. Pairing security controls with small business cyber insurance is often the most cost-effective way to protect revenue, cash flow, and reputation.

What does cyber liability insurance cover?

Coverage varies by carrier. Always read the forms. That said, a strong cyber policy Texas businesses buy in 2025 usually addresses both first-party and third-party costs.

First-party coverages (your own losses):

• Incident response and forensic investigation

• Breach notification, call center, and credit or identity monitoring

• Data restoration and system restoration

• Ransomware and cyber extortion response, including negotiators and crypto payment where legal

• Business interruption and extra expense after a network security failure or system failure

• Contingent business interruption when a critical vendor’s outage hits your operations

• Cyber crime, including funds transfer fraud and social engineering (often sub-limited) Third-party coverages (claims against you):

• Network security and privacy liability if data you hold is compromised or your systems are used to attack others

• Media liability for content, defamation, and IP issues

• Regulatory investigations, defense, and fines or penalties where insurable by law

• PCI DSS assessments and related costs for payment card incidents Two quick examples based on common claim patterns and national data:

• BEC wire fraud. The FBI attributes billions of dollars in annual losses to BEC. If an accounts payable clerk is tricked into changing vendor banking details, social engineering or funds transfer fraud coverage can reimburse the diverted payment and pay for forensic work to prove what happened.

• Ransomware shutdown. If a manufacturer’s ERP is encrypted, business interruption coverage can replace lost net income and pay extra expense after a waiting period. Extortion coverage can fund negotiators, legal counsel, and restoration, with an emphasis on recovery without paying when possible. If you are currently carrying a BOP with a small cyber add-on, know that BOP endorsements are typically narrow. For a side-by-side of endorsements you might already have, see our explainer on Key BOP Endorsements: Crime, Cyber Add-Ons, EPLI.

Claims-made policies, retro dates, and waiting periods explained

Cyber liability insurance is almost always written on a claims-made basis. That changes how timing works compared to occurrence-based policies like general liability.

• Claims-made trigger. The policy that responds is the one in force when the claim is made and reported, not necessarily when the incident began.

• Retroactive date. This is the earliest date an incident can occur and still be covered under your current policy. Earlier incidents may be excluded as “prior acts.” Keep your retro date as far back as possible and avoid gaps between policies.

• Continuity and application representations. If you knew about an incident or suspicious activity before binding coverage and did not disclose it, coverage could be denied.

• Extended reporting period (tail). If you cancel or move carriers, a tail lets you report claims after the policy ends for events that occurred before the end date. Real-life scenarios we commonly see:

• You discover in March 2025 that an inbox was compromised in December 2024, but you renew with a new carrier on January 1 and the new policy has a retro date of 1-1-2025. The new carrier may decline, and your prior carrier may only respond if you report within its reporting window. Moral: preserve the retro date or negotiate prior acts coverage when switching.

• Business interruption waiting periods. Most policies require an outage to last 8 to 24 hours before coverage starts, similar to a time deductible. If your outage lasted 10 hours and your waiting period is 12, there may be no BI payment. For a refresher on how time deductibles affect claims, review Business Income & Extra Expense: Texas Essentials. We also remind clients that cyber crime and social engineering are often sub-limited and may require dual authorization controls. Read your sub-limits and conditions closely.

For context on how this differs from general liability, our Commercial General Insurance (CGL) Texas Guide covers the occurrence trigger used on GL.

Texas breach notification rules and sector requirements

Texas has clear breach notification requirements that often shape both coverage and response timelines.

• Texas Business and Commerce Code 521.053 requires notice to affected individuals as quickly as possible and no later than 60 days after determining a breach occurred, unless law enforcement requests a delay.

• If the breach involves at least 250 Texas residents, you must also notify the Texas Attorney General within 60 days and include specified details.

• Service providers must notify the data owner as quickly as possible after discovery.

• Healthcare entities also face HIPAA and HITECH requirements, and financial institutions must meet GLBA and the FTC Safeguards Rule. Why this matters for insurance:

• Most cyber policies provide access to privacy counsel who can manage the 60-day clock, coordinate with regulators, and tailor notice language.

• Coverage for regulatory investigations and fines or penalties typically applies where insurable by law and subject to policy terms.

• Payment card breaches may trigger PCI DSS assessments, which are often included but sub-limited. Texas businesses should also be mindful of the evolving Texas Data Privacy and Security Act, which raises expectations around data practices for many organizations. Even when a statute does not directly mandate cyber insurance, regulators and clients increasingly expect you to demonstrate readiness and resources to respond swiftly.

If you operate in childcare or education and maintain family or child data, see our primer on Cyber & Data Privacy for Childcare Programs for practical safeguards and duty-to-notify tips.

Underwriting in 2025: checklists that get you approved and lower premiums

Underwriters have tightened their minimum control requirements. In 2025, most carriers will decline or heavily restrict coverage if these are missing.

Security controls most carriers require:

• MFA on email, remote access, VPN, and all privileged accounts (multi-factor authentication)

• EDR with 24x7 monitoring or SOC on servers and endpoints (endpoint detection and response, security operations center)

• Offline, immutable, tested backups for critical systems and data

• Email security with advanced filtering, impersonation protection, and SPF, DKIM, DMARC in enforcement

• Patch management with documented timelines for critical updates

• Disabled or secured RDP and geofenced remote access

• Unique, strong passwords stored in a business-grade password manager

• Security awareness training and phishing simulations at least quarterly

• A written incident response plan and vendor risk management workflow Controls that often reduce premiums or improve terms:

• Single sign-on with conditional access and device health checks

• Privileged access management and just-in-time admin elevation

• Network segmentation and application allow-listing

• Data loss prevention and encryption at rest and in transit

• Contractual security requirements for critical vendors, plus SOC 2 or equivalent attestations Quick self-assessment for your cyber application:

• Do we enforce MFA everywhere that matters, including administrators and email?

• Can we recover from ransomware quickly using immutable, offline backups?

• Do we have EDR on all servers and endpoints with 24x7 monitoring?

• Are SPF, DKIM, and DMARC configured and DMARC set to quarantine or reject?

• Can we show patching cadence, incident response steps, and user training logs? Stronger controls can meaningfully lower rates and increase available capacity. If you currently rely on a BOP with a small cyber endorsement, consider a standalone cyber policy for broader coverage, then coordinate with your package. Our Texas Business Owners Policy (BOP) Guide and Texas BOP Costs and Quote Checklist explain how to pull underwriting information together efficiently.

Costs, limits, deductibles, and choosing a cyber policy Texas SMBs can rely on

Pricing depends on revenue, data sensitivity, sector, claims history, and your security posture. While the market has steadied since the sharp corrections of 2021 to 2023, the best terms still go to businesses with proven controls and clean loss runs.

How to right-size limits:

• Estimate breach response costs by record count and notification obligations. Consider counsel, forensics, mailings, call center, and credit monitoring.

• Model downtime. If you were down for 5 to 10 business days, how much revenue and margin would you lose? Add extra expense needed to work around the outage.

• Review contractual requirements. Customers may require specific limits or evidence of PCI coverage.

• Consider regulatory exposure if you handle health, financial, or children’s data.

• Add contingent business interruption if a single vendor is critical to your operations. Deductibles and sub-limits to watch:

• Business interruption waiting period (often 8 to 24 hours)

• Social engineering and funds transfer fraud sub-limits and call-back requirements

• Ransomware coinsurance or scan-based coverage tiers

• System failure coverage for non-malicious outages vs security failure

• Regulatory fines and PCI sub-limits Many SMBs carry 1 million to 3 million in aggregate cyber limits, but your needs may differ. If you are packaging cyber with property and liability, coordinate terms so business interruption and extra expense do not create unintended overlaps or gaps. For an overview of how BI works on property policies, revisit Business Income & Extra Expense: Texas Essentials, then align that knowledge with your cyber forms.

Finally, remember that cyber is claims-made. Protect your retro date at renewal and avoid lapses. If you shift carriers, ask for prior acts coverage or an extended reporting period to preserve continuity.

Practical buying steps and common pitfalls we help clients avoid

What to gather before quoting:

• Annual revenue, employee count, and description of operations

• Number of endpoints and servers, plus a list of critical applications

• Third-party vendors that host or process your data

• Data types held, approximate record counts, and retention posture

• Security controls in place and any planned improvements

• Loss history and any open incidents Coverage options worth negotiating:

• Bricking coverage for irreparably corrupted hardware

• Reputational harm or brand recovery costs

• Invoice manipulation and telecom toll fraud

• Dependent system failure for key vendors even without a security event

• Contingent bodily injury or property damage carve-backs where technology controls physical operations Common pitfalls:

• Assuming a BOP endorsement is enough. It usually is not for ransomware or regulatory events. See Key BOP Endorsements: Crime, Cyber Add-Ons, EPLI for examples of what endorsements do and do not include.

• Confusing cyber with GL. CGL addresses bodily injury and property damage on an occurrence trigger. Cyber addresses digital harms on a claims-made trigger. If this distinction is new to you, our Commercial General Insurance (CGL) Texas Guide is a helpful refresher.

• Letting the retro date reset when changing carriers. Insist on continuity or negotiate prior acts. When in doubt, lean on credible, practical guidance. CISA’s Stop Ransomware resources offer clear, free checklists. The FTC’s materials help small firms comply with the Safeguards Rule. NAIC and TDI explain how to read policy language and why forms differ. We build those expectations into your application so underwriters trust your posture and sharpen their pencils.

Conclusion

Cyber threats are not going away, and Texas breach laws keep the clock ticking once you discover a problem. The right cyber liability insurance can fund the experts, keep your business running, and satisfy regulators and customers when something goes wrong. Equally important, the controls you implement to qualify for coverage also reduce your risk of a claim. That is a win on both sides of the ledger. If you have been putting off cyber coverage because it feels complex, start with the essentials: MFA, EDR, backups, and a policy built for how you actually operate.

Calahan Insurance Agency

If you are ready to make sense of cyber insurance for SMBs and get a cyber policy Texas underwriters will approve, we can help. We translate security controls into coverage terms that fit your budget and risk tolerance, and we coordinate your cyber with your BOP and GL so the pieces work together. Ready to take the next step? Contact us to discuss how we can help you achieve your goals and receive personalized support tailored just for you. Let’s protect your data, your customers, and your revenue with a plan that is practical, defensible, and built for the way you do business.

Need coverage advice? Let’s talk.

Get a fast, no-pressure quote and guidance tailored to your needs.