By
Is a cyber endorsement enough for your firm? Know what it covers before you rely on it.
Your policy lists cyber coverage. You want to know whether it fits the client information you hold and the payments you send. Let's look at what it actually covers, so you can make the next decision with confidence.
The answer
A cyber add-on is not automatically enough, and a standalone label is not a guarantee. An endorsement may address some risks while leaving others outside its coverage. Start with the events it covers, whose money is protected, the limits that apply, and the conditions you must meet. Then compare those terms with how your firm works. [2][3][6]
The $16,000 loss behind this conversation
Before a settlement-fraud loss, I had recommended standalone cyber coverage to a client. The client was relying on a small cyber add-on.
A law office later transferred a $16,000 settlement to the wrong account. Only after the money moved did the client learn that the lost funds would not be covered by the add-on.
The people behind the fraud knew detailed information about the client. They even knew the bank where the settlement was originally supposed to be sent. Whether they used AI was not established. The information they already had was what made the incident stand out.
That is the kind of moment when you wish you could turn back time, revisit the coverage conversation, and make the decision with a fuller understanding. I share it because you deserve that understanding before a loss, while there is still time to act.
The lesson is more specific than buying anything called standalone cyber. A separate policy does not guarantee that a particular loss will be paid. I want to review the terms with you, including how they address a payment sent under fraudulent instructions.
The decision belongs to you. My job is to help you understand it. Let's have the conversation you would want to have again after a loss, while it can still shape what you choose.
Dallas Downey, CLCS
Start with what your cyber add-on actually covers
An endorsement changes the policy it is attached to. Your schedule shows important limits, but the endorsement and policy wording explain when they apply. We need both to compare your current protection with a standalone option.
Start with the lost money, not just the limit. Ask whether the wording addresses an employee being deceived into sending a payment, and whether it includes client funds. A smaller limit matters only after we establish that the event is covered at all. [3][4]
Then look at a disruption to your work. What would happen if your team could not access email or case files? Ask which interruption and recovery expenses are included, what waiting periods apply, and which costs your firm would retain. [2]
Know who would help you respond. Confirm the reporting contact, available legal and technical support, and any approval requirements. Some add-on programs provide response services too. That is why I want to compare the actual coverage rather than assume what either label includes. [6]
You do not need to arrive knowing every insurance term. We can work through these questions together.
Compare the terms, not just the policy names
Use these questions to compare your current add-on with a standalone proposal. This is a review guide, not a statement that every policy has the same benefits.
A real payment. A specific coverage gap.
The important question is not whether a loss is large enough to make the news. It is whether you understand how your coverage addresses the payments you send.
Put client funds at the center of the review
When you are responsible for someone else's money, ask a direct question: does this coverage address funds held for clients, including any trust or escrow account involved? A policy addressing theft of the firm's own money may not answer that question. [3]
Your malpractice coverage also deserves review. A client allegation and reimbursement of a missing payment are not interchangeable. Policy wording can restrict losses involving client funds, so we should read the relevant exclusions rather than assume malpractice or cyber automatically takes over. [1][4]
Pair the insurance conversation with a payment-verification procedure. The FBI recommends independently verifying payment requests and changes to account information. Use a contact method you already trust, not a phone number supplied in the new request. [5]
We can review social engineering and payment-fraud coverage alongside that procedure. The goal is a clearer plan for both preventing a transfer and understanding the financial risk that remains.
Bring your policy and the way your firm works
Here is what will help us compare your current coverage with a standalone option.
- Your current documents. Bring the policy, declarations, and cyber endorsements, plus any separate crime coverage. We will start with what you already have.
- Your payment activity. Have a general picture of your usual payments, largest transfers, upcoming disbursements, and verification process. We can discuss amounts without sharing client names or account numbers.
- Your client information and systems. Explain what information you keep and which systems you need to serve clients. That gives the response and interruption questions a practical starting point.
- Your financial comfort level. Consider what your firm could absorb in an uncovered loss, deductible, or period of disruption. We can compare that with the options available.
You should be able to understand the recommendation, not simply receive a price. We will identify what the current wording addresses, what needs insurer clarification, and which choices deserve your attention.
Make your next coverage decision with confidence.
Compare your cyber add-on with the payments and information your firm handles. Work through your current protection and available options with Dallas.
Book My Cyber Protection ReviewChoose a meeting time with Dallas Downey, CLCS.
Choose the next answer you need
Sources and coverage notes
The settlement example is an anonymized account of my client experience. It describes one incident and the small cyber add-on involved, not a coverage result for every policy. The public sources below support the general insurance and risk explanations, not the private case facts.
[1] Wisconsin Lawyers Mutual: How Cyber Liability Insurance and Legal Malpractice Insurance Work Together. Explains potential overlap between client negligence claims and cyber coverage. Its Wisconsin legal discussion is not used as Texas law.
[2] ALPS: Cyber Insurance for Lawyers. Describes law-firm cyber options and factors to consider when evaluating limits. Product examples do not establish coverage under your policy.
[3] ALPS: Commercial Crime Insurance for Attorneys. Explains why fraudulent transfers and protection for client funds require a review of the actual wording.
[4] ALPS: 3 Safety Measures Your Firm Should Implement to Avoid Wire Transfer Scams. Provides a policy-specific example of restrictions on losses involving client funds. Those restrictions are not a finding about the incident described here.
[5] FBI: Business Email Compromise. Explains impersonation and payment-diversion schemes, independent verification, and prompt reporting after a suspected loss.
[6] HSB: Cyber Suite. Shows why services and available limits should be checked rather than inferred from a cyber product's label.
Insurance coverage depends on the policy wording, limits, exclusions, conditions, and facts of the claim. This article provides general education, not a coverage determination or legal advice. Your legal counsel should evaluate duties arising from an incident.
Frequently asked questions
Does a general liability policy cover a data breach?
Do not treat general liability alone as a complete cyber response plan. Read any cyber endorsement or separate cyber policy included in your insurance package. Identify the covered events, limits, exclusions, response services, and any separate protection for payment fraud.
Is a cyber endorsement enough for a small law firm?
It depends on the actual coverage and the work your firm does. Compare the endorsement with your client information, payment activity, and ability to absorb a loss. In the incident described here, the small add-on did not cover a $16,000 settlement transferred to the wrong account. That outcome does not establish how every endorsement responds.
What does a standalone cyber policy add that an endorsement does not?
A standalone policy may offer broader coverage, different limit options, and incident-response services. Some add-on programs also provide response services. Compare the actual forms rather than their names, especially payment-fraud terms, client-funds provisions, sublimits, deductibles, and conditions.
How much cyber coverage should a litigation firm carry?
Review your largest and expected payments, client information, disruption costs, and the loss your firm could retain. Confirm that the relevant event and funds are covered before comparing limits. Your largest transfer is an important starting point for payment-fraud coverage, not a formula for the whole cyber program.
You cannot go back to the moment before a loss. You can choose to understand your coverage before the next important decision. Bring your current policy and your questions. I will help you work through the terms so you can decide what is right for your firm with clearer information.
Protect your clients' trust with a clearer plan.
Compare your cyber coverage with the money and information your firm handles. Work through the limits and conditions with Dallas before deciding what needs to change.
Book My Cyber Protection ReviewChoose a meeting time with Dallas Downey, CLCS.
The review is free. The decision is yours.
