Most BOPs include a token cyber sublimit — often $10K to $25K. Real breach response costs run 10–100x that, before you factor in ransom, regulatory fines, or business interruption.
A modern cyber policy covers first-party losses (your ransomware payment, your data restoration, your lost income during downtime) and third-party losses (customer lawsuits, regulatory investigations, credit monitoring you owe affected parties).
The most common cyber claim isn't ransomware — it's social engineering wire fraud. An employee gets a spoofed email that looks like the CEO or a vendor, wires money, gone. Cyber policies with 'social engineering' endorsement pay; regular crime policies often don't.
Underwriters now require MFA on email, endpoint protection, and offline backups. Without those controls, you either can't get coverage or you pay 2–3x premium.
If you take credit cards, store customer data, use cloud tools, or would be crippled by 3 days of downtime, you need cyber. Which is essentially every modern small business.