Arthur J. Gallagher & Co. announced a definitive agreement to acquire Woodruff Sawyer for $1.2 billion, subject to regulatory approval, expected to close in Q2 2025. Woodruff Sawyer, based in San Francisco, offers commercial property/casualty products and risk management services. The acquisition aims to enhance client offerings and expand capabilities. Woodruff Sawyer's pro forma revenues and EBITDAC for 2024 were approximately $268 million and $88 million, respectively.

Insurance brokerage Arthur J. Gallagher & Co. bought Woodruff Sawyer, a provider of commercial property and casualty insurance products, employee benefits solutions and risk management services, for $1.2 billion, the companies said today.

This article is part of VentureBeat’s special issue, “The cyber resilience playbook: Navigating the new era of threats.” Read more from this special issue here.Today’s cyber attacks can be paralyzing — and extremely costly — for modern enterprises. Armed with AI, hackers are exploiting vulnerabilities faster than ever.However, standard business insurance products such as general or professional liability policies (errors and omissions, or EO) typically don’t cover losses or damages as the result of breaches or other cyber-related incidents. This makes cybersecurity insurance increasingly critical in 2025 and beyond, particularly as AI transforms (and simplifies) hackers’ methodologies. Cybersecurity-specific insurance policies cover a range of remediation cost and recovery efforts to help enterprises limit damage, recover faster and improve their overall cyber hygiene. But as with any other type of coverage, cyber insurance can be complicated to navigate and full of legalese and loopholes. Let’s go over the basics, why it’s important, what to look for and what trends to expect this year as AI takes center stage. So what does cyber insurance cover?Typically, cyber policies offer coverage for first-party (direct losses) and third-party (outside the business) damages. General coverage includes:. Business interruptions: Lost revenue when an attack takes systems offline;Attack remediation: Incident response, forensic investigations or system repairs;Customer notification and reputation management: Automated alerts when customers’ personally identifiable information (PII) may have been accessed; credit monitoring and breach hotlines; PR work to help repair the brand;Legal expenses: Litigation as the result of a breach (such as lawsuits filed by customers or vendors), what’s known as “duty to defend”;Regulatory action: Investigations that require legal services and potential fines. In the case of ransomware, it’s important to note that, while providers have covered payouts in the past, many are backing off of this practice because hackers are demanding more and regulators are scrutinizing