Business & Commercial

Cyber insurance for Puerto Rico businesses.

If your business runs on email, takes payments, or keeps customer data, it already carries cyber risk. The question most owners have never been walked through is what a cyber policy actually does when something goes wrong, and where the coverage quietly stops.

Request a coverage review → Schedule a call →

What cyber insurance actually covers

A cyber policy generally works on two sides, and it helps to keep them straight.

  • First-party is your own business's losses: restoring data and systems, income lost while you are down, an extortion or ransomware demand, and the cost of the response team that handles the incident.
  • Third-party is claims made against you by others, such as customers or regulators, when their information was exposed in a breach.

Many businesses need both, because one does not cover the other. The single most useful part for most owners is the response team: when you are hit, a cyber policy usually gives you access to the forensics, legal, and notification help you would otherwise have to scramble to hire at the worst possible moment.

The threats it responds to

Three come up most:

  • Ransomware. Your files are locked and a payment is demanded. The policy can respond to the extortion, the recovery, and the downtime.
  • Business email compromise. A criminal spoofs or breaks into an email account and tricks an employee into sending money or changing wire instructions. This is one of the costliest cyber crimes, and it does not require any "hacking" of your systems, just a convincing email.
  • Data breach. Customer or employee information gets exposed, which triggers notification duties and potential claims.

Artificial intelligence is making these harder to spot. The phishing email that used to be full of typos now reads clean and personal, which is a big part of why this risk is getting so much attention right now.

Who needs it

If you hold customer or employee data, take payments, or run on email and online systems, you are exposed, and that describes almost every business. Attackers often go after smaller companies precisely because the defenses are lighter and the payoff is still real. Professional offices, retailers, medical and dental practices, contractors who move money by wire, and any business with employees who can be tricked are all in scope. You do not have to be a tech company to have a cyber exposure.

You do not get breached because you are important. You get breached because you are reachable. Nearly every business is.

Why this is in the news

Puerto Rico's Office of the Insurance Commissioner recently urged carriers to expand what cyber coverage is available here, noting that several private cyber products are now approved on the island, alongside excess-lines and Lloyd's of London options. That call reflects a real trend. For context, from third-party sources: the FBI's Internet Crime Complaint Center reported about $16.6 billion in internet-crime losses in the United States for 2024, with business email compromise alone near $2.77 billion; IBM's 2025 Cost of a Data Breach report put the global average breach at about $4.44 million and the US average at a record $10.22 million; and Munich Re estimates the global cyber insurance market at roughly $15 billion, projected toward about $28 billion by 2030. These are industry figures and they move year to year, so treat them as scale, not a quote.

What to check before you buy

Cyber policies vary more than almost any other line, so the details matter:

  • Social engineering and fraudulent transfers. Coverage for being tricked into sending money (business email compromise) is often a sublimit or an add-on, and is sometimes excluded. Confirm it is there and at what limit.
  • Ransomware and extortion sublimits. The headline limit is not always the limit that applies to ransomware.
  • Business interruption. Check the waiting period before lost-income coverage kicks in.
  • Incident response. Does the policy give you a response team, and are they good?
  • Exclusions and conditions. Some policies require specific security controls (like multi-factor authentication) to be in place, or claims can be denied.

Puerto Rico regulators have also signaled that carriers should keep a human in the loop when AI is used to evaluate claims and applications, rather than handing those decisions entirely to software. That is a good thing for policyholders, and worth knowing as more of this gets automated.

How I work

I place and review commercial coverage carrier-neutral, so the goal of a conversation is to match the coverage to your actual exposure, not to sell you a generic policy. With cyber, that means looking at how your business handles data and money, checking the sublimits and exclusions that decide whether a claim actually pays, and telling you plainly where you stand. If cyber is not the right spend for your situation, I will tell you that too.

Start with a coverage review below, or book a call if you would rather talk it through first. This page is general information, not coverage, tax, or legal advice; your own policy and contracts control.

Request a coverage review → Back to business coverage →

Frequently asked questions

What is cyber insurance?

Cyber insurance helps a business recover from a cyber incident such as ransomware, a data breach, or email fraud. It typically covers two sides: first-party costs (your own losses, like restoring data, business interruption, extortion payments, and the incident-response team) and third-party costs (claims from others, like customers or regulators, when a breach exposed their information). What a given policy covers varies, so the policy wording controls.

Does a small business in Puerto Rico need cyber insurance?

If your business relies on email, takes payments, or holds customer or employee data, it carries cyber risk, and most small businesses do all three. Attackers often target smaller companies precisely because defenses are lighter. Whether you need a policy, and at what limit, depends on your exposure, which is what a review looks at.

What is business email compromise, and does cyber insurance cover wire fraud?

Business email compromise (BEC) is when a criminal spoofs or hacks an email account to trick an employee into sending a payment or changing wire instructions. It is one of the costliest cyber crimes. Many cyber policies address it, but coverage for social engineering and fraudulent transfers is frequently a sublimit or an add-on and is sometimes excluded, so it is one of the first things to check.

What is the difference between first-party and third-party cyber coverage?

First-party covers your own business's losses from an incident: data restoration, lost income during downtime, extortion, and the cost of the response team. Third-party covers claims made against you by others, such as customers or regulators, when their data was exposed. Many businesses need both, because one does not cover the other.

Is cyber insurance required in Puerto Rico?

It is not generally mandated for most businesses, but it is increasingly expected: clients, lenders, and larger partners often require proof of cyber coverage in their contracts. Regulators in Puerto Rico have also encouraged carriers to expand what is available. Requirements depend on your industry and your agreements, so confirm against your own contracts.