Cybersecurity Awareness Month 2026: What Businesses Should Know About 831(b) Plans for Cyber Risk

October’s Cybersecurity Awareness Month comes as cybercrime continues to hit businesses where it hurts most, the bottom line. Cyberattacks and cyber fraud can drain cash, disrupt operations, and create losses traditional insurance may not fully cover.

The FBI recorded nearly $21 billion in reported cybercrime losses in 2025, a 26% increase from 2024, with cryptocurrency and artificial intelligence-related fraud among the costliest threats. The scale of these losses highlights the growing financial impact of cybercrime, from fraud and theft to business disruption.

Cyber insurance remains an important part of risk management, but a policy does not guarantee coverage for every attack, fraud, or resulting loss. Exclusions, limits, deductibles and coverage conditions can leave businesses responsible for significant costs, particularly when an incident involves social engineering, fraudulent transfers, or business interruption.

Dustin Carlson, president of SRA 831(b) Admin, said businesses need to look beyond the policy itself. “Having cyber insurance does not mean every financial loss from an attack will be covered. Businesses need to know where those gaps are and have a plan for the risks that remain.”

According to the National Association of Insurance Commissioners, nearly three times as many claims were closed without payment (28,555) as those paid (9,941) in 2024.

One option to fill the gaps left by traditional cyber insurance policies is SRA 831(b) Admin’s Data Breach Liability & Loss of Income Plan, an 831(b)-based solution designed to address defined cyber exposures, including data breach losses, income disruption, social engineering, and fraudulent wire transfers that may be excluded, limited, or not fully covered by traditional insurance.

What Is an 831(b) Plan?

An 831(b) Plan is a risk-management strategy that allows a business to set aside tax-deferred funds to self-insure against risks that are underinsured or not covered at all.

An 831(b) Plan is not a replacement for commercial insurance. It can complement existing policies by addressing specific risks, exclusions, and coverage limitations.

This approach is increasingly relevant to cyber risk, where one incident can trigger multiple types of financial loss.

SRA’s Data Breach Liability & Loss of Income Plan

SRA 831(b) Admin’s Data Breach Liability & Loss of Income Plan is designed to address defined cyber exposures that traditional insurance may exclude, limit, or leave uninsured.

The plan addresses risks tied to data breaches, including ransomware, phishing, malware, social engineering, and fraudulent wire transfers, along with loss of income and other financial impacts that can follow a cyber incident.

The financial damage can extend well beyond the breach itself. A business may lose revenue during an interruption, incur incident-related costs, or suffer losses from a fraudulent transfer.

The SRA plan adds another layer of protection through an 831(b) strategy that works alongside a company’s broader insurance policy.

“The biggest financial risk isn’t always the breach itself,” Carlson said. “It’s the revenue you lose, the money that gets transferred, or the costs your traditional policy doesn’t cover. Businesses need a strategy for those exposures before they hit the balance sheet.”

Cyber Risk Goes Beyond the Data Breach

A cyber incident does not always look like a traditional data breach.

A compromised email account can lead to fraudulent wire transfers. Ransomware can shut down operations and revenue. Social engineering can convince an employee to release sensitive information or transfer funds. AI can make impersonation attacks more convincing.

The issue is not simply whether a business has insurance. It is whether coverage addresses how a loss actually occurs.

Where Traditional Cyber Insurance Can Leave Gaps

Cyber insurance is an important part of risk management, but policies vary in their definitions, exclusions, deductibles, limits, and conditions. Social engineering, fraudulent transfers, business interruption, and other losses may fall outside coverage or be subject to significant limits. Businesses are also facing emerging cyber threats that can create additional coverage challenges.

“Businesses need to look beyond preventing the attack and make sure they have a financial strategy for the losses that can follow,” Carlson said. “That means identifying coverage gaps and addressing those risks before a loss occurs. These losses can really add up and ultimately determine if a business remains in business after a cyber-attack.”

An 831(b) Plan can address defined risks alongside conventional coverage, giving businesses another option when a commercial policy excludes or limits certain losses.

Cybersecurity Awareness Month Is Also About Managing Risk

Cybersecurity Awareness Month focuses heavily on prevention, from multifactor authentication and employee training to verifying payment requests to keep software updated.

Those steps matter, but they cannot eliminate cyber risk. Businesses also need to prepare financially for what happens when an attack or fraud gets through.

That means reviewing cyber insurance policies, identifying exclusions and sublimits, and assessing exposure to social engineering, fraudulent transfers, and business interruption. An 831(b) Plan can provide businesses with another way to address defined risks that traditional insurance may not fully cover.

Businesses and their advisors can explore SRA 831(b) Admin’s resources to learn more about how an 831(b) Plan works and where it may fit within a broader risk-management strategy.

831(b) Plans and Cyber Risk: Frequently Asked Questions

What is an 831(b) Plan?

An 831(b) Plan is a risk-management strategy that allows a qualifying business to establish a captive insurance company to insure defined business risks. The structure receives specific tax treatment under Section 831(b) of the Internal Revenue Code when applicable requirements are met.

Can an 831(b) Plan cover cyber risks?

An appropriately structured 831(b) Plan can be designed to address defined cyber-related risks, including exposures that may be excluded or limited under traditional commercial insurance. The specific risks covered depend on the plan and its terms.

What is the SRA Data Breach Liability & Loss of Income Plan?

The SRA Data Breach Liability & Loss of Income Plan is an 831(b)-based risk-management solution designed to address defined cyber-related exposures. These can include data breach, ransomware, phishing, malware, social engineering, fraudulent wire transfers, and loss of income, depending on the coverage structure.

Does an 831(b) Plan replace cyber insurance?

An 831(b) Plan can complement commercial insurance. Businesses should review their cyber, crime, liability, and other policies to identify risks that may warrant additional coverage.

Why can traditional cyber insurance leave coverage gaps?

Cyber policies vary in their definitions, exclusions, limits, and conditions. Certain social engineering, fraudulent transfer, business interruption, and other losses may be excluded or limited depending on the policy.

Why consider an 831(b) Plan for Cyber Risk?

Cyberattacks can create financial exposures that extend beyond the losses addressed by a traditional cyber insurance policy. An 831(b) Plan can give qualifying businesses another risk-management tool for addressing defined risks alongside their existing insurance program.