The letter from the carrier runs two pages, and most of it is boilerplate. The sentence that matters sits halfway down the second page, and it points back to a question somebody in your office answered eleven months ago in about four seconds. Is multi-factor authentication required for administrative access to your servers? Yes or no. Somebody checked yes, because the IT guy set something up a couple of years back and yes felt true.
The forensics report says otherwise. And the cyber insurance policy you have been paying premiums on all year turns out not to be a policy at all.
That is how these things actually fail. Not on the limit. Not on the premium. On the application, in a room where nobody thought they were making a decision.
Shops are getting hit harder than anyone else, too. Manufacturing has now been the most-attacked industry in the world for five years running, accounting for 27.7% of all the incidents IBM's X-Force team responded to in 2025, according to their 2026 threat index. Not because job shops are sitting on piles of cash. Because a shop that cannot run cannot ship, and a shop that cannot ship has a very strong reason to pay fast.
Here is the plain-English version we walk through with shops around Parkesburg and across Chester and Lancaster County: what these policies actually cover, what quietly voids them, and the handful of questions worth asking before you sign anything.
Why Cyber Insurance for Manufacturers Is a Production Problem
Most articles on this subject talk about "data." That word does you no favors, because it makes the whole thing sound like a filing-cabinet problem. It is not. In your shop, the thing an attacker locks up is the thing that makes parts move:
- The ERP database (JobBOSS, E2, Global Shop, Epicor) holding every open job, router, and due date
- The SolidWorks and Mastercam files on the server, plus the posted programs the machines pull from
- Travelers, prints, and revisions that first shift needs at 6:00 a.m.
- Quality records and certs you would need to prove out a shipment
- Purchase orders, AP, and payroll
Lock those and you do not have an IT incident. You have a stopped floor, a phone call to a customer about a ship date, and a purchasing agent at your biggest account quietly wondering who else makes this part.
There is a second reason this matters more every year, and it has nothing to do with hackers. Two outside forces now grade your shop's security whether you like it or not: your carrier at renewal, and your customers' vendor security questionnaire. They ask nearly identical questions. Fail one and you are usually about to fail the other.
What Cyber Insurance Actually Covers
A real policy splits into two halves: money spent on your problems, and money spent on other people's problems that you caused.
First-Party Coverage: Your Shop's Own Costs
This is the half that matters most to a 20-person shop.
Breach response. The immediate scramble. A forensics team to figure out how they got in and what they touched, legal guidance on what you are required to report, notification for anyone whose personal information was exposed, and credit monitoring if it was. That is employee W-2 and direct-deposit data as often as customer data.
Business interruption coverage. Reimbursement for income lost while you are down, and the line item that actually matches your pain. Two catches worth knowing. Most policies have a waiting period, commonly 8 to 12 hours, before the clock even starts. And you have to prove the loss. Shops with clean job and shipment records collect. Shops reconstructing a week from memory do not.
Cyber extortion and ransomware coverage. This pays the ransom itself (usually with the carrier's approval required first), a professional negotiator, and the work of getting encrypted files back. Read the sublimit here, because ransomware coverage is frequently capped well below the headline number on the policy.
Data restoration. Pays to rebuild what was lost: the ERP database, the file server, the CAM library, from backup or through a recovery service. This coverage assumes there is something to restore from, which is a separate conversation about a backup and recovery plan you have actually tested.
Reputation management. PR help and guidance on what to tell customers. On a small-shop scale that is less press conference and more knowing exactly what to say when your three biggest accounts call asking whether their prints were taken.
Third-Party Liability: When Someone Else Gets Hurt
Privacy liability covers legal costs if you are sued over exposed personal information, employee or customer.
Regulatory defense covers investigations and penalties. Pennsylvania's breach notification law requires notice without unreasonable delay, and responding properly costs money before anyone is fined.
Media liability covers content claims like defamation or IP issues arising out of an incident.
Defense and settlement costs cover attorney fees and any judgment if a customer or vendor sues you over a breach that started on your network.
Two Riders Worth Asking About By Name
Social engineering fraud. This is the wire-transfer scam, and it hits manufacturers constantly. Someone impersonates a raw-material supplier, emails updated remittance instructions, and your bookkeeper wires $40,000 to the wrong account. It often starts with someone spoofing your shop's own email domain, which is what makes the request look routine. Here is the trap: many base policies do not cover it, because technically nobody hacked anything. Somebody just lied convincingly. Ask specifically.
Hardware bricking. Some attacks leave machines permanently unusable. This rider pays to replace them, which matters when the "machine" is an aging PC running a controller nobody makes parts for anymore.
What Cyber Insurance Often Does Not Cover
This is the half that decides whether your policy is worth the paper it is printed on.
The Control Gap That Actually Voids Policies
Carriers no longer take your word for it. They ask whether you have multi-factor authentication, working endpoint protection, and tested backups, and they hold you to the answers.
In 2022, International Control Services, an electronics manufacturer in Decatur, Illinois, took out a $1 million Travelers policy in April, got hit with ransomware in May, and filed a claim. The carrier's investigation found MFA was protecting the firewall and nothing else, including the server the attackers got into, even though the application, signed by the company president and the person responsible for network security, said otherwise. Travelers went to federal court in July to rescind the policy. By the end of August, the two sides had jointly agreed to have the policy declared null and void from inception. No coverage. No payout. Not reduced. Erased, as if it had never been purchased.
Nobody there was committing fraud. Somebody checked a box they did not fully understand. That is the whole story of Travelers v. International Control Services, and it is the single most important thing on this page.
What to do about it: before you sign a renewal, have someone verify each answer against the actual systems. Not "we should have that." Verified, with a screenshot or a report attached. That includes knowing the difference between antivirus and EDR, because carriers increasingly ask for the second one by name and will not accept the first.
Incidents That Were Already Underway
A policy will not cover an attack that started before coverage did. If credentials were stolen in March and used in July, and you bought the policy in May, expect a fight. Same story if you knew about a vulnerability and left it alone.
Acts of War and State-Sponsored Attacks
Since NotPetya, nearly every policy carries a war exclusion. If an attack gets attributed to a nation-state, coverage may evaporate. The language varies a lot between carriers, so have your broker read you the exact clause.
Insider Threats
Damage done deliberately by your own employee or contractor generally is not covered unless you have specifically added it. For a shop where a handful of people have admin access to everything, that is a gap worth pricing out.
The Long Tail of Lost Business
Policies pay for the crisis. They do not pay for the OEM that stops sending you RFQs eighteen months later because word got around that you were down for two weeks. That damage is real and it is entirely on you.
How to Choose a Policy That Actually Pays
1. Price Out a Real Shutdown First
Before you shop coverage, put a number on a bad week. What does two weeks of stopped production cost in shipments, late fees, and overtime to catch up? Add rebuilding servers and workstations, forensics, and legal help. That total is your starting point for a limit, not a round number somebody suggested.
2. Answer the Cyber Insurance Application With Evidence, Not Memory
Every yes on that form is a promise. Go down the list with whoever manages your systems and confirm each one is true today: MFA on email, MFA on remote access and VPN, MFA on admin accounts, endpoint protection actually reporting in, backups you can restore from and have tested. Save the proof in one folder. Filling out a cyber insurance application this way takes an afternoon, and it is the difference between a claim paid and a policy rescinded.
3. Ask These Five Questions Before Signing
- Does this cover ransomware and social engineering fraud, or just ransomware?
- What is the waiting period before business interruption starts paying?
- Are legal fees and regulatory penalties inside the limit or on top of it?
- What are the exclusions, in plain English?
- What controls do we have to maintain to keep this policy valid?
That last one is the one almost nobody asks.
4. Check the Deductible Against Your Cash Position
A lower premium with a $50,000 deductible is not a bargain if writing that check would hurt. Pick a number you could actually cover during a week when you are also not shipping.
5. Re-Verify at Every Cyber Insurance Renewal
Requirements ratchet up yearly. What passed in 2024 may not pass now, and your shop changed too. New remote user, new machine on the network, new cloud app the office started using. Treat the cyber insurance renewal as a real review, not a signature.
Same Answers, Two Audiences: Your Carrier and Your Biggest Customer
Here is what shop owners tend to notice about six months in. The work you do to pass a renewal is nearly identical to the work you would do to answer a Tier-1 customer's vendor security questionnaire. MFA, endpoint protection, tested backups, documented procedures, someone accountable. Do it once and you are covered on both fronts: the renewal, and the purchasing agent who wants proof before releasing next year's blanket order.
That is the piece we handle for shops. We put the controls in place, then hand you a documented package your broker can work from, every answer backed by evidence instead of a best guess. We monitor around the clock, which matters when second shift is running at 11 p.m. and nobody is in the office. And we document everything about your setup through our managed IT plans for shops, so the answers do not live in one person's head and walk out the door when they do.
Cyber Insurance FAQs for Small Manufacturers
Does a 20-person machine shop really need cyber insurance?
Yes, and increasingly you will not get a choice. Manufacturing absorbed 27.7% of the incidents IBM X-Force responded to in 2025, the fifth year running it topped the list. Beyond the risk itself, more OEM customers now require proof of coverage before they release a blanket order, so the policy has become a condition of doing business.
How much does cyber insurance for manufacturers cost?
Industry pricing guides put a $1 million policy for a small manufacturer at roughly $1,000 to $3,000 a year, with shops in the 15 to 40 employee range landing near the middle. Revenue, claims history, and your controls move the number most. Carriers commonly credit 10% to 25% for documented multi-factor authentication, endpoint protection, and tested backups.
Can an insurer really void a policy over one wrong answer on the application?
Yes. In Travelers v. International Control Services, a $1 million policy was rescinded and declared void from inception after the carrier found MFA was protecting only the firewall, not the server that got hit. The parties agreed to the rescission within weeks. Intent to deceive is not required in most states, only that the statement was false and material.
How long before business interruption coverage starts paying?
Most policies carry a waiting period of 8 to 12 hours before the clock starts, so a short outage may produce no payment at all. After that you have to prove the loss, which means shipment records, job costing, and payroll a claims adjuster can follow. Shops that reconstruct a week from memory collect far less than the paperwork would have supported.
Does cyber insurance cover a wire transfer sent to a fake supplier?
Often not under the base policy. Nobody broke into anything, so many forms treat it as fraud rather than a cyber event, and it needs a social engineering fraud endorsement. Ask for the endorsement by name, then ask what the sublimit is, because it is frequently a fraction of the main limit.
How often should we re-verify the answers on our cyber insurance application?
Once every 12 months at renewal is the minimum, and again any time the shop changes: a new remote user, a new machine on the network, a new cloud app the office started using, or an employee with admin rights leaving. Requirements ratchet up yearly, so what passed two renewals ago often will not pass now.
Could Your Shop Prove Every Answer on Its Own Application?
Starlux IT works with small commercial manufacturers, job shops, machine shops, and fabricators in Parkesburg, Coatesville, Downingtown, Gap, and across Chester and Lancaster County. We know what an ERP outage costs on a Tuesday morning, and we know what carriers are asking for at renewal this year, because we fill out the evidence side of those applications every month.
Give us 30 minutes, free, no pressure. We will go through your current policy's requirements against what is actually running on your network, show you the gaps in plain English, and you will know exactly where you stand, whether you hire us or not. Better to find out now than the week after.