Gallagher vs Marsh Cyber Insurance

Gallagher Small Business arranges cyber liability coverage with outside carriers for small businesses; Gallagher's group-level practice separately places cyber coverage with its own risk-consulting services for larger accounts. Gallagher does not underwrite either policy. ^6,7Company-reported. Small-business cyber product page and the group-level cyber liability page.

Marsh's cyber risk practice places and advises on cyber insurance brokerage; it does not underwrite the policies it places. ¹²Company-reported. Marsh corporate cyber insurance product page.

Marsh McLennan Agency (MMA), Marsh's middle-market subsidiary, places cyber coverage and acts as a carrier liaison, combining placement with claims advocacy. ¹⁵Company-reported. MMA cyber solutions page.

Neither the small-business cyber page nor the group-level cyber liability page names the insurer that would issue a given client's policy. ^6,7Not publicly disclosed. Checked both pages on 2026-09-23.

The reviewed pages do not name a specific cyber insurer for a standard placement. Marsh's Cyber ECHO excess facility lets clients choose underwriting from Lloyd's of London syndicates, company markets or Bermuda-based insurers, so the carrier varies by placement. ¹³Not publicly disclosed. Cyber ECHO facility page, which covers excess layers rather than every primary policy Marsh places.

Gallagher recommends this coverage for small businesses that handle customer data or accept credit card or electronic-funds-transfer payments, and specifically names retail, healthcare, financial services and home-repair businesses as frequent attack targets. ⁶Company-reported. Small-business cyber product page "Who needs Cyber Liability Insurance" section; actual acceptance depends on underwriting.

MMA says any company can benefit from cyber coverage, but prioritizes organizations that store significant customer data, run large customer databases or hold valuable digital assets. ¹⁵Company-reported. MMA cyber solutions FAQ; MMA describes its own client base as middle-market organizations generally.

Gallagher describes two components of cyber coverage: first-party coverage for when a business's own technology or data is breached, and third-party coverage for when a customer sues the business for failing to prevent a breach. It says the policy can cover customer notification, credit monitoring, legal fees and regulatory fines. ⁶Company-reported. Small-business cyber product page; a coverage description, not a specific policy's insuring agreement or exclusions.

Gallagher's small-business team says cyber insurance rates are flat to down due to competitive market forces despite high-profile losses, and flags generative-AI-driven risks such as more convincing phishing, social-engineering and deepfake attacks as an emerging concern. ⁶Company-reported. Small-business cyber product page market-commentary section; a general market view, not a quote for any specific business.

MMA lists incident investigation and response costs, network interruption/extra expense, extortion and ransomware payments, data restoration, and security and privacy liability as core cyber coverages, with media liability, privacy regulatory defense and reputation-based income loss available as additional coverages. ¹⁵Company-reported. MMA cyber solutions page; actual policy wording and insurer vary by placement.

Neither page publishes specific cyber coverage limits, retentions or premium ranges; the small-business page's $60 million claim example is an illustrative scenario, not a stated policy limit. ^6,7Not publicly disclosed. Checked both pages on 2026-09-23.

Marsh says its Cyber ECHO excess facility can provide over $200 million of cyber capacity per client, with a free first reinstatement and a paid second reinstatement for separate cyber events within a policy year. ¹³Company-reported. Cyber ECHO facility page; describes excess capacity Marsh can arrange, not a standard primary limit.

For larger accounts, Gallagher's group-level cyber practice gives clients access to the Gallagher eRiskHub risk-management portal and a dedicated claims team that includes cyber forensic accountants; the small-business product page does not describe an equivalent service for that segment. ⁷Company-reported. Group-level cyber liability page; not confirmed as included with the small-business product.

Not described in the reviewed sources.

Not described in the reviewed sources.

You engage a named Marsh or MMA cyber specialist to design a placement; the reviewed pages describe advisor-led placement and risk analytics rather than an online self-serve quote. ^12,15Company-reported. Marsh and MMA cyber pages, which list dedicated cyber brokerage and placement leaders.

Not described in the reviewed sources.

Marsh's global claims and incident-management specialists review cyber claims, support litigation management and work with forensic accountants to prepare proof of loss, advocating with insurers on the client's behalf. ¹⁴Company-reported. Claims Advocacy expertise page; recovery outcomes described as company-reported and not independently verified.