Personal Risk

Most private business owners believe directors and officers insurance is for public companies, specifically boards with shareholders, SEC filings, and class action exposure. The logic seems reasonable: if you are not publicly traded, who would sue your directors?

The answer, in 2026, is a longer list than most business owners expect: disgruntled employees, minority shareholders, business partners, creditors, vendors, customers, and regulators. None of these claimants require a stock ticker. All of them can pursue the individuals who made the decisions personally when a D&O policy is not in place to defend and indemnify those individuals.

The Exposure Is Not Limited to Public Companies

Directors and officers liability arises from decisions made in the management of a business. Fiduciary duties, disclosure obligations, governance responsibilities, employment decisions, and financial management all fall within the scope of what a director or officer can be held personally accountable for when things go wrong.

Private companies face D&O exposure from several distinct sources. Employees bring wrongful termination, discrimination, and harassment claims that can involve D&O liability where the individual conduct of a decision-maker is at issue. Creditors and bankruptcy trustees pursue D&O claims when a business fails and decisions made by management contributed to the loss. Minority shareholders challenge decisions made by majority owners or controlling managers. Regulatory agencies bring enforcement actions that name individual directors and officers for governance failures or disclosure violations.

According to Allianz Commercial’s 2026 D&O insurance outlook, the frequency of new claims against directors and officers is now approaching or exceeding pre-pandemic rates in most regions, with North America showing the most significant severity pressure. Global corporate bankruptcies are projected to rise 5 percent in 2026, sitting 24 percent above pre-pandemic levels and bankruptcy events are among the most common triggers for D&O claims against private company executives.

What’s Driving the Rise in Private Company D&O Exposure

Several converging trends are expanding D&O exposure for private businesses specifically.

Artificial intelligence and technology governance have introduced new categories of liability. Business owners who have made public claims about AI capabilities in sales materials, investor communications, or regulatory filings face “AI washing” exposure if those claims are challenged as misrepresentations. According to Amwins’ 2026 state of the market analysis, brokers are seeing increased concern around AI washing, where companies overstate their AI capabilities in ways that could trigger misrepresentation claims directly against the individuals responsible for those statements.

Cyber incidents create D&O liability through a separate channel from the cyber insurance claim itself. When a breach occurs and the board is alleged to have failed to implement adequate cybersecurity oversight or business continuity planning, shareholders, customers, and creditors can pursue claims against the directors personally. General liability and cyber insurance do not address this exposure. D&O coverage does.

What a D&O Policy Covers and What It Doesn’t

A D&O policy consists of three coverage parts. Side A covers individual directors and officers directly when the company cannot or will not indemnify them, typically in bankruptcy or regulatory proceedings. Side B reimburses the company for indemnification it provides to directors and officers. Side C covers the company entity itself for certain securities claims. This coverage is more relevant for public companies but is increasingly included in private company D&O policies to cover securities-related claims arising from financing transactions.

The D&O market in 2026 is competitive, with flat to modestly declining premiums for well-governed private companies. Coverage for private companies with strong financial health and clean governance is broadly available and reasonably priced, which makes this a favorable time to put a program in place before a claim forces the issue.

The commercial insurance review that addresses D&O should confirm the policy covers the specific claim types most relevant to your business structure, that Side A coverage is not subject to conditions that could exhaust coverage before individuals are protected, and that coverage limits are adequate for your ownership structure and governance complexity. The specialty programs available for private company D&O are broader than many business owners assume.

Ready to make sure your directors and officers are protected as your business grows? The team at Tooher-Ferraris has been helping business owners structure complete commercial insurance programs since 1932. Contact us today to schedule a no-obligation consultation.

If cybercrime were a country, it would be the third-largest economy in the world. Munich Re projects global cybercrime costs will reach $14 trillion by 2028, exceeding the combined economic output of Germany, Japan, and India. The threat is not abstract, and it is not slowing down.

Here is what is also true: the cyber insurance market in 2026 is the most favorable for buyers it has been since the hard market peak of 2021. Rates are flat to declining across most commercial sectors. Carriers are competing for business. Coverage terms have expanded. The window will not stay open indefinitely.

That combination, an intensifying threat environment and a buyer-friendly market, creates a specific opportunity that most small and mid-size businesses are not actively taking advantage of.

Why the Current Market Window Matters

Cyber insurance pricing surged in 2020 and 2021 as ransomware attacks grew in frequency and severity. Carriers tightened terms, imposed sublimits, and raised rates sharply. Since 2022, competitive dynamics have prevailed, driving year-over-year rate reductions. According to a 2026 cyber market outlook report, that softening continued through 2025 and into 2026, with widespread opportunities for premium reductions and expanded coverage options across the broader market.

The practical implication: businesses that are underinsured, carrying outdated policy terms, or have never had a formal cyber coverage review can address those gaps right now at a cost that would have been significantly higher three or four years ago.

Early indicators in 2026 suggest the rate of market softening is decelerating. Ransomware losses, AI-enabled attacks, and systemic events could accelerate a return to harder conditions faster than most buyers expect. The businesses that act now lock in competitive terms. Those that wait may face the same renewal conversation at a different price.

What Ransomware and AI Are Doing to the Risk Landscape

The threat landscape has not softened alongside the market. Ransomware remains the dominant driver of cyber losses. According to Allianz Commercial’s 2025 cyber security resilience data, ransomware accounted for approximately 60 percent of the value of large cyber insurance claims. The FBI’s Internet Crime Complaint Center logged more than 193,000 phishing and spoofing complaints in 2024, with wire fraud losses exceeding $109 million.

AI is adding a new dimension. Artificial intelligence allows bad actors to automate processes that were previously manual — identifying vulnerabilities, personalizing phishing campaigns, and deploying attacks at scale with speed and precision that older security controls were not designed to handle. AI-generated deepfakes are now being weaponized in phishing campaigns, creating synthetic attacks that are exponentially more difficult to detect. Supply chain attacks, where a compromise at a vendor or software provider cascades to hundreds of clients, represent a systemic exposure that most individual business cyber policies address imperfectly.

What Good Cyber Coverage Looks Like in 2026

A cyber policy that was adequate in 2022 may have meaningful gaps today. Limits adequacy is the most common gap. Many businesses carry $1 million in cyber coverage and assume that is sufficient. Given average ransomware demands, business interruption costs, regulatory notification expenses, and breach response costs for even a mid-size incident, that limit can be consumed before litigation costs are factored in. Business email compromise coverage should be explicit in the policy. Vendor and supply chain coverage is an emerging requirement for businesses reliant on third-party technology providers. Reviewing your commercial insurance program specifically for cyber gaps, including what your general liability and property policies do and do not cover for cyber events, is the right starting point. Most standard commercial policies contain cyber exclusions that leave businesses with no coverage at all for a significant incident.

Ready to make sure your cyber coverage reflects the threat environment of 2026? The team at Tooher-Ferraris has been helping businesses navigate complex insurance decisions since 1932. Contact us today to schedule a no-obligation consultation.

Ask most small business owners what their risk management program looks like and you will get one of two answers: a description of their insurance policies, or a blank look.

Insurance is a risk management tool. It is not a risk management program. The distinction matters because insurance only addresses risks that have already happened. It pays for losses after the fact. Risk management addresses what leads to those losses: the exposures, the controls, the monitoring, and the financial planning that determine how well a business weathers a serious disruption.

The framework below is not complicated. It is four questions that, answered honestly, tell you where your business stands and what to do about it.

Identify: What Could Actually Hurt Your Business?

Risk identification is the starting point most businesses skip. It requires stepping back from the day-to-day and asking: what scenarios could seriously damage or destroy this business?

The categories are consistent across most small businesses. Property damage, including fire, flood, theft, and equipment failure, can interrupt operations and generate repair or replacement costs that a business cannot absorb without insurance or sufficient reserves. Liability claims, including those arising from a customer injured on your premises, a product defect, or a professional error, can trigger lawsuits that outlast the underlying incident. Workforce disruptions, including a key employee being injured or incapacitated, labor shortages, and workers’ compensation claims, can affect operational continuity. Financial and cyber risks, including fraud, ransomware, business email compromise, and regulatory penalties, are increasingly common even for businesses that would not describe themselves as technology-dependent.

According to the Federal Emergency Management Agency, approximately 40 percent of small businesses do not reopen after a natural disaster. The businesses that do recover consistently share one characteristic: they had thought through the scenario before it happened.

Assess, Control, and Transfer: The Full Framework

A risk assessment forces prioritization: for each identified exposure, how likely is it to occur, and how severe would the impact be if it did? High likelihood and high severity risks deserve the most immediate attention, both in terms of prevention and insurance. Low likelihood risks with catastrophic potential — a major product liability suit, a significant natural disaster — may warrant insurance even when the probability is low, because the financial impact of not being covered is existential.

Loss control is where the insurance bill and the risk management program intersect. Carriers look at your loss control practices when underwriting your coverage and businesses with formal safety protocols, documented procedures, and evidence of risk management investment consistently receive better terms than those without.

The Dynamic Risk Synergy Portal provides practical loss control tools that help small businesses identify and address operational vulnerabilities before they become claims. The final step is ensuring the risks that cannot be retained are properly transferred and that requires a thorough commercial insurance review confirming that coverage limits are adequate, exclusions are understood, and gaps between policies are identified. Risk management and insurance work together. The businesses that treat insurance as a last resort rather than a planning tool consistently discover their gaps when they can least afford to.

Ready to build a risk management program for your business, not just an insurance policy? The team at Tooher-Ferraris has been helping small and mid-size businesses manage risk intelligently since 1932. Contact us today to schedule a no-obligation consultation.