What Does Cyber Insurance Cover for a North Carolina Company With $20M to $200M in Revenue?
Cyber insurance can cover qualifying costs your company incurs after a cyber incident and certain claims made against your business by others, including breach response, ransomware, business interruption, privacy liability, and network security liability.
Commercial insurance guidance for Wake Forest, Raleigh, Durham, Cary, and North Carolina businesses.
Review Your Company’s Cyber Exposure
Have your current cyber policy reviewed for coverage grants, limits, exclusions, and potential gaps.
Stephen will review your request and contact you within one business day.
Key Takeaways
- First-party coverage addresses qualifying losses suffered directly by your company.
- Third-party coverage addresses certain claims made against your company.
- Business interruption and dependent business interruption are different coverage questions.
- Ransomware response, data recovery, and extortion expenses may have separate conditions and sublimits.
- Revenue alone does not determine the appropriate cyber insurance limit.
- North Carolina’s breach notification law creates obligations that should be considered in incident response planning.
Quick Answer
Cyber insurance for a North Carolina company with $20 million to $200 million in revenue can address two categories of financial exposure: losses the company experiences itself and certain liability claims brought by others.
First-party coverage may include forensic investigation, breach response, data restoration, business interruption, and qualifying ransomware expenses. Third-party coverage may include privacy liability, network security liability, regulatory defense, and certain customer or vendor claims.
Actual protection depends on policy definitions, limits, sublimits, exclusions, waiting periods, and conditions.
Why Cyber Insurance Matters for North Carolina Mid-Market Companies
A company does not have to be a technology business to have a substantial cyber exposure. Manufacturers, distributors, construction companies, healthcare organizations, and professional service firms increasingly rely on digital systems to operate.
A business may depend on cloud accounting, enterprise resource planning, payroll, customer relationship management, online payments, vendor portals, remote access, and outside IT providers. If one of those systems is compromised or unavailable, the effects can reach far beyond the IT department.
Consider a company operating in Raleigh, Durham, Cary, or Wake Forest. It might have multiple facilities, employees working remotely, customers submitting payments electronically, and vendors with access to its systems. A cyber incident could interrupt production, prevent invoicing, expose personal information, or delay customer orders.
North Carolina Recorded 2,349 Data Breaches in 2025
North Carolina’s own breach reporting data provides a more relevant starting point for local business owners than national statistics alone.
North Carolina Department of Justice — 2025 Data Breach Report
2,349
Reported data breaches statewide in 2025.
9,275,938
North Carolinians affected, including individuals affected in multiple breaches.
77%
Of reported breaches attributed to hacking-related incidents.
53%
Of reported breaches involved general business organizations: 1,246 reports.
Source: North Carolina Department of Justice, 2025 Data Breach Report, published April 2026.
Read the official North Carolina DOJ 2025 Data Breach Report.
These are statewide reported-breach figures, not a count of incidents among companies with $20 million to $200 million in revenue. They also do not represent insurance claims or prove that every reported breach produced an insured loss.
They do show that data exposure is not a distant or exclusively national issue. North Carolina businesses are reporting incidents involving hacking, phishing, ransomware, email compromise, accidental disclosures, and other forms of unauthorized access.
For a business in the Triangle, the practical question is whether its insurance program would address the costs and liabilities that could follow a similar event.
What National Cyber Research Adds to the Picture
$10.22 Million
Average U.S. data breach cost
IBM’s 2025 Cost of a Data Breach Report reported a record average U.S. breach cost of $10.22 million.
44%
Breaches involving ransomware
Verizon’s 2025 Data Breach Investigations Report found ransomware present in 44% of the breaches it reviewed, compared with 32% in the prior report.
These figures have different research populations and should not be combined into a prediction for an individual North Carolina company.
IBM’s average includes organizations across different sizes and industries. Verizon’s ransomware percentage describes the breaches reviewed in its report. Neither number determines the appropriate limit or premium for a particular business.
They do reinforce why a cyber review should consider response costs, business interruption, recovery, and liability exposure rather than focusing exclusively on ransom payments.
First-Party vs. Third-Party Cyber Insurance Coverage
First-party cyber insurance addresses qualifying losses and expenses suffered directly by the insured business. Third-party cyber insurance addresses certain claims and legal liabilities asserted against that business by other parties.
| Coverage grant | Type | What it may cover |
|---|---|---|
| Incident response and forensics | First-party | Approved forensic investigation, incident coordination, breach counsel, and response services. |
| Data restoration | First-party | Qualifying expenses to recover or restore damaged, encrypted, or inaccessible electronic data. |
| Business interruption | First-party | Qualifying lost income and continuing expenses after a covered cyber event interrupts the insured’s operations. |
| Dependent business interruption | First-party | Certain interruption losses caused by a qualifying cyber event affecting a covered technology or service provider. |
| Cyber extortion and ransomware | First-party | Approved investigation, negotiation, response, recovery, and potentially covered extortion-related expenses. |
| Notification and credit monitoring | First-party | Qualifying expenses to notify affected individuals and provide approved monitoring services. |
| Privacy liability | Third-party | Certain claims alleging improper handling, disclosure, or safeguarding of personal or confidential information. |
| Network security liability | Third-party | Certain claims arising from qualifying unauthorized access, security failures, or transmission of malicious code. |
| Regulatory defense | Third-party | Qualifying defense expenses and specified regulatory proceedings, subject to policy wording and applicable law. |
| Media liability | Third-party | Certain claims involving online content, publication-related offenses, or specifically insured media exposures. |
| Payment card assessments | Depends on wording | Certain eligible payment card assessments or related expenses following a covered payment card incident. |
These are common coverage categories, not a promise that every cyber policy contains every grant. Some insurers combine sections, use different terminology, or apply separate sublimits and conditions.
Key Cyber Insurance Terms Every Business Owner Should Understand
These terms appear throughout cyber policy forms and can materially affect how a claim is evaluated.
First-party coverage
Coverage addressing qualifying losses and expenses suffered directly by the insured business.
Third-party coverage
Coverage addressing certain claims and legal liabilities asserted against the insured by other parties.
Retention
The amount of a covered loss the insured must absorb before the insurer begins paying, subject to the policy’s terms.
Waiting period
A specified period that must pass after a covered interruption begins before certain business interruption benefits become payable.
Period of restoration
The policy-defined period during which covered operations are restored following a qualifying interruption.
Sublimit
A smaller coverage limit that applies to a particular coverage grant, expense, event, or category of loss within the overall policy limit.
Dependent system
A specified outside computer system or service provider on which the insured depends for its business operations, as defined by the policy.
Insurer consent
The policy requirement to obtain the insurer’s approval before taking certain actions, hiring particular providers, or incurring specified expenses.
What First-Party Cyber Insurance Can Cover
1. Incident response and forensic investigation
After a suspected compromise, a company may need specialists to establish how the incident occurred, which systems were affected, whether information was accessed, and whether an attacker still has access.
A cyber policy may cover approved forensic investigation, breach counsel, incident coordination, and other response services. Many policies specify approved providers or require the insurer’s consent before certain expenses are incurred.
2. Data recovery and system restoration
Ransomware, malicious code, or unauthorized access can make important business records inaccessible. A company may need to restore servers, recover databases, recreate files, or rebuild compromised systems.
Depending on the wording, cyber coverage may pay qualifying recovery and restoration expenses. The policy should be checked for definitions of covered data, systems, restoration costs, and applicable sublimits.
3. Business interruption
A cyber event can stop a business from processing orders, receiving payments, coordinating employees, manufacturing products, or serving customers.
Business interruption coverage may address qualifying lost income and continuing expenses when a covered cyber event interrupts the insured company’s operations.
For a construction company, this could involve loss of access to project management systems, payroll, scheduling, or essential digital records. For a manufacturer, it could mean production scheduling and inventory systems are unavailable.
4. Dependent business interruption
Businesses are also exposed to technology failures outside their own networks. A cloud platform, outsourced IT provider, payment processor, or other service provider may be essential to normal operations.
Some policies provide dependent business interruption coverage when a qualifying cyber event at a covered provider disrupts the insured’s operations.
An ordinary vendor outage is not automatically covered. Review the definition of a dependent system, covered event requirements, and any separate sublimit.
5. Ransomware and cyber extortion
Ransomware can encrypt business systems, prevent access to records, and threaten the publication of stolen information. An attacker may also demand payment to stop further disruption.
Cyber insurance may address approved investigation, negotiation, incident response, data recovery, and certain extortion-related expenses.
6. Breach notification and customer support
A company may need to determine which individuals were affected, identify the information involved, prepare notices, and arrange customer support.
Depending on the policy, qualifying expenses may include notification, call center services, credit monitoring, and other approved breach response services.
If you rely on cloud systems, outside IT providers, electronic payments, or digital customer records, it is worth checking the actual policy grants and sublimits before renewal.
Request a cyber policy review with Carolina Risk Partners.What Third-Party Cyber Insurance Can Cover
1. Privacy liability
A company may face claims alleging that it failed to protect personal or confidential information or disclosed that information improperly.
Depending on the policy, privacy liability coverage may address qualifying defense expenses, settlements, and covered damages arising from specified privacy claims.
2. Network security liability
A third party may allege that the insured’s network security failure allowed unauthorized access, malware transmission, or another covered security incident.
For example, a compromised business system might expose another party’s information or be used to transmit malicious files. Whether the resulting claim is covered depends on the policy’s definitions and allegations.
3. Regulatory defense
A serious incident involving personal information may attract regulatory attention. Certain cyber policies address qualifying regulatory defense expenses and specified proceedings.
Coverage for fines, penalties, and assessments is more restricted and may be limited by policy language and applicable law.
4. Media and content liability
Some cyber policies include protection for certain online content and publication-related claims. This can matter to companies operating websites, publishing substantial digital content, or distributing material through online platforms.
5. Payment card-related liabilities
Businesses accepting payment cards may face contractual assessments and related expenses following a qualifying payment card security incident.
The policy should be checked for payment card definitions, covered assessments, exclusions, and separate sublimits.
A Triangle-Area Cyber Incident: How the Coverage Could Work
Consider this illustrative scenario, not an actual Carolina Risk Partners client claim.
A hypothetical mid-market distributor operating between Raleigh and Durham relies on a cloud-based inventory platform, an outside IT provider, electronic customer records, and online payment processing.
An employee’s compromised credentials allow an attacker to access the company’s network. The attacker encrypts important systems and obtains customer information. The company cannot process normal orders while its systems are investigated and restored.
| Incident consequence | Potential coverage response |
|---|---|
| Investigation to determine what happened | First-party incident response and forensic investigation. |
| Systems and data need restoration | First-party data recovery and restoration, if covered. |
| Orders cannot be processed | First-party business interruption, subject to its waiting period and terms. |
| Customer information was exposed | First-party notification expenses and potentially third-party privacy liability. |
| A customer alleges financial harm | Potential third-party liability coverage, depending on the claim and policy. |
| A service provider is also affected | Potential dependent business interruption if the provider and event meet policy requirements. |
One cyber incident can trigger several separate coverage questions. A policy should be evaluated across the entire event rather than only the initial ransomware demand.
North Carolina Data Breach Notification Requirements
Cyber insurance does not replace a company’s legal responsibilities after a security breach.
North Carolina General Statute §75-65 addresses security breaches involving qualifying personal information of North Carolina residents.
For a business that owns or licenses qualifying personal information, the statute generally requires notification to affected individuals without unreasonable delay after discovery or notification of a breach, subject to the statutory conditions and exceptions.
Who must be notified?
- Affected individuals: North Carolina residents whose qualifying personal information was affected, subject to the statute’s requirements and exceptions.
- The Attorney General: The business must notify the North Carolina Attorney General’s Consumer Protection Division without unreasonable delay when it provides notice to affected individuals.
- Consumer reporting agencies: When more than 1,000 individuals are notified at one time, the business must also notify nationwide consumer reporting agencies about the timing, distribution, and content of the notice.
- Information owners: A business that maintains qualifying information it does not own or license must notify the owner or licensee of a breach.
The statute also contains provisions concerning law enforcement requests, investigation, the scope of the incident, and restoration of system integrity.
The exact application depends on the information involved, the company’s role, and the circumstances. Businesses should consult qualified legal counsel when determining their notification obligations.
How Much Cyber Insurance Should a $20M to $200M Company Consider?
There is no reliable formula that assigns a cyber insurance limit solely from annual revenue. A company generating $25 million may have substantial exposure because of its sensitive data and technology dependence, while another company with higher revenue may have a very different risk profile.
Revenue is useful context for underwriting, but it does not tell you how much business income could be interrupted, how many records could be exposed, or how dependent operations are on outside systems.
Evaluate the business in relation to its revenue and operations
| Business revenue | Questions to investigate | Coverage considerations |
|---|---|---|
| $20M–$50M | How dependent is the business on email, accounting, payments, customer records, and outsourced technology? | Incident response, data restoration, business interruption, ransomware response, and social engineering wording. |
| $50M–$100M | What would happen if multiple locations, distribution operations, or customer-facing systems were unavailable? | Interruption exposure, dependent business interruption, privacy liability, vendor dependencies, and separate sublimits. |
| $100M–$200M | How extensive are the company’s data, contracts, third-party relationships, payment flows, and operational dependencies? | Aggregate loss scenarios, contractual obligations, regulatory exposure, vendor concentration, and the adequacy of the full limit structure. |
These are review categories, not insurer-mandated revenue tiers or recommended policy limits. They do not establish a particular premium, retention, or coverage amount.
Questions to answer before selecting limits
- How much revenue could be lost during a multi-day or multi-week system interruption?
- How many customer, employee, and vendor records does the company maintain?
- What would forensic investigation, legal response, and notification cost?
- How dependent is the business on cloud providers and outsourced IT services?
- Could a cyber incident interrupt production, payroll, payments, distribution, or project administration?
- What contractual security and privacy obligations does the company accept?
- Are business interruption, ransomware, and dependent business interruption subject to separate sublimits?
- How much financial loss can the company absorb before cash flow or operations are seriously affected?
What Cyber Underwriters May Review
Cyber underwriting commonly involves an assessment of the company’s security practices, technology dependencies, and incident response preparation.
Controls that commonly receive underwriting attention include:
- Multi-factor authentication, especially for remote access and privileged accounts.
- Endpoint detection, monitoring, and response capabilities.
- Backup frequency, separation, and restoration testing.
- Patch management and vulnerability remediation.
- Employee security awareness and phishing training.
- Network segmentation and privileged access management.
- Documented incident response procedures.
- Third-party vendor access and security oversight.
- Previous incidents, claims, and material security changes.
These controls do not guarantee coverage, a particular price, or acceptance by an insurer. Requirements vary by carrier, industry, policy size, and underwriting appetite.
Companies should provide accurate application information. Incomplete or inaccurate representations can create problems when coverage is needed.
Cyber Insurance vs. General Liability, Crime, and Umbrella Insurance
Existing business insurance should not be assumed to provide the same protection as a dedicated cyber policy. These policies address different exposures.
| Policy | Primary purpose | Cyber-related consideration |
|---|---|---|
| Cyber insurance | Specified cyber events, response costs, interruption, and certain cyber liability claims. | Designed specifically for covered cyber exposures. |
| General liability | Specified bodily injury, property damage, and personal and advertising injury exposures. | Do not assume it covers breach response, ransomware, or cyber interruption. Review general liability insurance. |
| Commercial crime | Specified theft, forgery, employee dishonesty, and certain financial crime exposures. | Review funds transfer fraud and social engineering definitions carefully. See how wire fraud affects custom homebuilding. |
| Commercial umbrella | Additional limits over specified underlying liability policies. | Do not assume it extends cyber coverage or increases a cyber policy limit. Review commercial umbrella considerations. |
| Professional liability | Certain claims alleging errors or failures in professional services. | Relevant when professional services, design, or technology advice create separate liability exposure. Read about professional liability for design-build contractors. |
Companies with employees should also consider employment-related liability separately. Explore commercial business insurance.
A company may need more than one of these policies. The right combination depends on its operations, contractual obligations, and the specific risks it assumes.
Cyber Exposure in North Carolina Construction and Contracting
Cyber exposure is not limited to technology firms. General contractors, custom homebuilders, and specialty contractors increasingly depend on digital records and electronic transactions.
A contractor may use project management platforms, digital plans, accounting systems, payroll software, subcontractor portals, electronic purchase orders, and online banking.
A compromised email account could expose sensitive project information or be used to redirect a supplier invoice, subcontractor payment, homeowner deposit, or construction draw.
For a practical example of the financial crime side of this exposure, read Wire Fraud and Cybercrime in Custom Homebuilding.
Contractors should also review their broader insurance program. The general contractor insurance checklist explains how cyber liability fits alongside general liability, workers compensation, commercial auto, umbrella, and project-specific insurance.
Custom homebuilders managing several active projects may also want to review builder’s risk insurance for multiple custom homes.
How to Review Your Existing Cyber Insurance Policy
- Confirm the coverage grants. Identify the actual first-party and third-party protections included.
- Review the limits and sublimits. Look beyond the overall policy limit.
- Check retention and waiting periods. Understand what the company must absorb before coverage responds.
- Read exclusions and definitions. Pay particular attention to ransomware, dependent systems, prior incidents, and war-related wording.
- Check vendor requirements. Confirm whether approved response firms or prior insurer consent are required.
- Compare coverage to current operations. Include new systems, vendors, locations, records, and contractual requirements.
- Review renewal changes. Compare endorsements, exclusions, sublimits, and pricing with the expiring policy.
Have Your Cyber Insurance Reviewed Before Your Next Renewal
If your company has grown, added locations, increased transaction volume, changed technology providers, or taken on new contractual obligations, your current cyber policy deserves another look.
Stephen reviews your request and contacts you within one business day. After reviewing your current policy information, the goal is to identify three specific coverage questions or potential gaps worth discussing. No coverage change is made without your approval.
Direct assistance from Carolina Risk Partners in Wake Forest, North Carolina.
Frequently Asked Questions About Cyber Insurance
What does cyber insurance cover for a North Carolina company?
Cyber insurance may cover qualifying first-party expenses such as forensic investigation, incident response, data restoration, business interruption, and ransomware-related response costs. Third-party coverage may address privacy liability, network security liability, regulatory defense expenses, and certain claims made by affected customers or other parties. Actual coverage depends on the policy wording, limits, exclusions, and conditions.
What is the difference between first-party and third-party cyber insurance?
First-party cyber coverage addresses qualifying losses and expenses suffered directly by the insured business. Third-party cyber coverage addresses certain claims and legal liabilities asserted against the business by customers, vendors, employees, regulators, or other affected parties.
Does cyber insurance cover ransomware?
A cyber policy may cover qualifying investigation, incident response, data recovery, business interruption, and certain extortion-related expenses. Ransom payments are not guaranteed to be covered and may require insurer consent and compliance with applicable law and policy conditions.
Does cyber insurance cover business interruption?
Many cyber policies offer business interruption coverage for qualifying interruptions caused by covered cyber events. The policy may impose a waiting period, a period of restoration, and specific requirements for calculating covered income loss and continuing expenses.
Does North Carolina require businesses to report data breaches?
North Carolina General Statute 75-65 generally requires businesses that own or license qualifying personal information of North Carolina residents to notify affected individuals without unreasonable delay following discovery or notification of a security breach, subject to statutory conditions. Businesses that notify affected individuals must also notify the Attorney General’s Consumer Protection Division without unreasonable delay. Additional notice to nationwide consumer reporting agencies is required when more than 1,000 individuals are notified at one time.
How much cyber insurance does a company with $20 million to $200 million in revenue need?
There is no universal cyber insurance limit determined by revenue alone. A company should evaluate potential business interruption losses, sensitive information, vendor dependencies, contractual requirements, response expenses, retention, and coverage sublimits before selecting limits.
Who can help a Triangle or North Carolina company review its cyber insurance?
Stephen Ellias, CLCS, North Carolina Insurance License 20374030, is the founder of Carolina Risk Partners in Wake Forest, North Carolina. He helps businesses in Wake Forest, Raleigh, Durham, Cary, the Research Triangle region, and throughout North Carolina review commercial insurance coverage, compare available insurance options, and identify potential gaps in their insurance programs. Carolina Risk Partners can be contacted at (919) 910-4554.
Know What Your Cyber Policy Actually Covers
A cyber insurance policy should reflect the way your business operates, the information it handles, the systems it depends on, and the financial impact of a disruption.
If your North Carolina company generates $20 million to $200 million in annual revenue, Carolina Risk Partners can help you review the coverage structure, limits, sublimits, exclusions, and available insurance options.
Insurance disclaimer: This article is for general educational purposes and does not constitute legal, cybersecurity, or insurance coverage advice. Coverage availability, terms, conditions, exclusions, limits, sublimits, and claim decisions vary by insurer and policy. The actual policy wording controls. Consult qualified legal and cybersecurity professionals regarding specific obligations and security practices.