An agency that runs paid social for a dozen clients usually holds admin access to every one of those clients’ ad accounts or business managers. That access sits in a shared login, a delegated role, or a password manager entry, and it is the kind of thing that shows up in an insurance conversation only after something has already gone wrong with it.
The exposure a login creates that a slip-and-fall policy does not
General liability insurance was built for a different kind of accident. A client visits the agency’s office and trips on a cable, or the agency’s ad creative gets accused of copyright infringement. Those are the claims a commercial general liability policy is written to answer: third-party bodily injury, property damage, and advertising injury.
Holding a client’s ad account or business manager login is a different exposure, and it has nothing to do with whether the agency’s own systems get breached. First-party exposure is the agency’s own systems or data being compromised, its own email, its own client list. The scenario this post is about is different: a client’s ad account or business manager is compromised while the agency held admin access to it, whether through a phished agency employee, a reused password, or a credential never revoked after an employee left. The client did not lose their own systems. They lost control of an account the agency was trusted to operate.
What creates this exposure is not that the agency does marketing work. A freelancer who only ever received a screenshot of ad performance from a client has none of this exposure. It is holding the login itself, the standing ability to act inside someone else’s account, that turns a security lapse into a claim an insurer has to evaluate.
What general liability actually excludes
Insureon’s own general liability coverage page lists the exclusions plainly. Under “What are general liability insurance exclusions?” the page states that the policy will not cover intentional injuries or property damage, or willful negligence, and it lists other common exclusions including pollution, proximity to a railroad, and data breaches specifically (Insureon, “General liability insurance,” fetched 2026-09-09, https://www.insureon.com/small-business-insurance/general-liability).
That exclusion is consistent with what the policy is designed to do. The same page describes general liability as coverage for “common liability claims from third parties,” specifically bodily injury, property damage, and personal and advertising injury such as defamation or copyright infringement. Nothing in that list resembles a client’s ad account being accessed by someone who should not have had access to it. A compromised login is not a customer slipping on a wet floor, and the exclusion language on the insurer’s own page confirms that data breach and cyber incidents sit outside what the policy responds to.
First-party versus third-party cyber coverage, and which one an agency needs
Insureon’s cyber liability page draws the line between the two halves of a cyber policy directly: “There are two types of cyber liability insurance coverage: first-party coverage and third-party coverage” (Insureon, “Cyber liability insurance,” fetched 2026-09-09, https://www.insureon.com/small-business-insurance/cyber-liability).
First-party coverage responds when the agency’s own systems or data are the ones breached. The same page describes it as recommended for businesses that “collect personal information, such as customer email addresses or credit card numbers,” and says it can help cover data breach response costs, business interruption expenses, and cyber extortion payments when the agency itself is the target.
Third-party coverage is the half that matters for an agency holding client ad account logins. Per Insureon, “Companies that are responsible for their clients’ cybersecurity would need third-party cyber liability insurance to provide legal protection from client lawsuits.” That is the scenario at issue here: a client’s business manager gets compromised while the agency held the keys, the client concludes the agency failed to secure that access, and the client sues. First-party coverage does not answer that lawsuit. Third-party coverage does.
The same page confirms the bundling point directly: “Third-party coverage can be bundled with your errors and omissions policy into what is known as technology errors and omissions insurance, or tech E&O.” An agency shopping for this coverage may find it sold as a standalone cyber policy, or folded into a tech E&O product, and the difference is worth asking a broker about explicitly rather than assuming.
Cyber liability versus the professional liability policy already on the queue
This post is about a specific buyer: an agency holding standing credential access across multiple client accounts. That is a different exposure, and a different buyer, than a solo freelance consultant weighing a general professional liability policy, which is covered separately.
Insureon’s own professional liability page describes the policy plainly: it “protects small businesses against the costs of client lawsuits over unsatisfactory work,” covering negligence, missed deadlines, and failure to meet the standard of care a client was owed (Insureon, “Professional liability insurance,” fetched 2026-09-09, https://www.insureon.com/small-business-insurance/professional-liability). The page’s exclusions section also confirms that professional liability does not cover customer bodily injury or property damage, and it says nothing about a third party gaining unauthorized access through a credential the business held. That silence is the point: this policy was never built to answer for a compromised login.
| Question | Professional liability (E&O) | Cyber liability, third-party |
|---|---|---|
| What triggers a claim | Client says the agency’s work was negligent, late, or unsatisfactory | A client’s account or data is compromised while the agency held access to it |
| Typical buyer in this comparison | A freelancer or agency being sued over the quality of deliverables | An agency holding standing login or admin access across multiple client accounts |
| Does it respond to a compromised client login | Not per Insureon’s own coverage description | Yes, this is the scenario third-party cyber coverage is written for |
What a cyber policy actually pays for once a breach happens
Insureon’s cyber liability page describes the cost categories a policy responds to once an incident happens:
- Notification and response costs. State laws typically require notifying affected parties after a data breach, and the page states that cyber insurance “helps cover costs associated with hiring a digital forensic expert to investigate the breach, customer notifications, consumer credit and fraud monitoring services.”
- Forensic investigation. The same sentence covers hiring the digital forensic expert who determines what happened and how the compromise occurred.
- Legal defense costs, and settlements or judgments where a client sues over the compromise. The third-party section of the page states this coverage “would provide legal protection from client lawsuits,” which is the mechanism that applies when a client blames the agency for the account compromise.
- Business interruption costs. Insureon describes this as covering “lost income and the cost of hiring additional staff or renting equipment” when an incident takes systems offline, and it notes the coverage extends to third-party services such as a public relations or crisis management team brought in during the response.
- Cyber extortion payments. The page also notes that if a hacker encrypts data and holds it for ransom, the policy “will help with payments to meet cyber extortion demands,” though this applies more directly to first-party incidents than to the third-party account compromise scenario this post is about.
Before signing either policy
Two questions cut through most of the confusion at quote time. Ask to see the general liability policy’s actual data breach exclusion language, not a summary of it. And ask the cyber insurer directly whether the third-party coverage being quoted responds to a client’s account being compromised while the agency held access to it, as distinct from coverage that only triggers when the agency’s own systems are breached. Those two answers, not the policy’s marketing description, determine whether the coverage matches the exposure described above.
An agency that has not yet formalized how it grants and revokes that access in the first place should look at sharing account access without sharing a password before it looks at insurance. A policy pays for the cleanup after a compromise. It does not reduce the odds of one happening in the first place, and the mechanics of how access is granted are what actually do that.
FAQ
Does general liability insurance cover a client’s ad account being compromised while my agency held the login?
No. Insureon’s general liability page lists data breaches under its exclusions, and the policy is built for third-party bodily injury, property damage, and advertising injury claims, not a compromised login. The third-party half of a cyber policy is the coverage built for this scenario.
Is a compromised client login covered under my professional liability or errors and omissions policy?
Per Insureon, professional liability and errors and omissions insurance cover negligence, missed deadlines, and unsatisfactory work, not a third party gaining access through a compromised credential. Third-party cyber coverage responds to this scenario instead, and Insureon’s cyber liability page confirms it is sometimes sold bundled with technology errors and omissions insurance rather than as part of a standard professional liability policy.