In October 2012, a 14 year old girl was visiting a friend at an apartment complex in Clayton County, Georgia. A guard working the property for Crime Prevention Agency Inc. raped her. He was convicted and is serving 20 years. The lawsuit said the company was negligent in how it trained him and in keeping a child safe on a property it was hired to guard. In May 2018 a jury agreed and put the number at $1 billion.
That is the headline case. The one that should worry you more is quieter.
A company whose guards did nothing wrong
In Las Vegas, a woman was sexually assaulted while walking to her apartment. The attacker was not a guard. She sued the apartment complex and its security contractor, American Protection Group, for negligence and for negligent hiring, training, supervision, and management. A standard negligent security claim, the kind every guard company is one bad night away from.
APG had a specialty policy written for security companies, through Lloyd's and Hiscox. It asked the carrier to defend the suit. The carrier refused, pointing to a sexual misconduct exclusion for any claim "based upon or arising out of any actual, alleged, or threatened abuse, molestation, harassment, mistreatment, or maltreatment of a sexual nature." The denial letter told APG it could complain to the California Department of Insurance if it disagreed. APG did. The carrier denied it again.
APG ran out of money to pay its lawyers. The court entered a default judgment against it for more than $20 million, and almost $1.5 million more to the apartment owner. APG's rights against its own carrier were assigned to the woman who had sued it.
In August 2024 a federal judge ruled that the exclusion was ambiguous and the carrier had breached its duty to defend. How much the carrier owes was left for trial. Good news for the plaintiff. Too late for the company. Two things decided that case: the wording of one exclusion, and the fact that Nevada reads ambiguous wording against the carrier. Count on neither.
The exclusion, in plain terms
Most general liability policies carry an abuse or molestation exclusion. The standard ISO version, CG 21 46, removes coverage for injury arising out of "the actual or threatened abuse or molestation by anyone of any person while in the care, custody or control of any insured." It also removes coverage for the negligent employment, investigation, supervision, reporting, or retention of the person who did it.
Read that second part twice. The claims actually filed against a security company (you hired him, you did not train him, you did not supervise him) are the claims the exclusion was built to catch.
Three things make it worse for security companies in particular.
"Care, custody or control" is read broadly. In December 2024 a California appeals court held that a spa customer was in the "care" and "control" of the owner simply because he was the one giving the massage, and that complete or exclusive control was not required. A guard escorting a resident, detaining a shoplifter, or working the floor of a shelter is in a position a court could call care or control just as easily.
The newer forms drop that requirement. In 2022 ISO replaced CG 21 46 with a broad abuse or molestation exclusion, CG 40 28, that applies to abuse of any person committed by anyone, with no care, custody or control language at all. Many carriers that write guard companies use their own wording, which tends to be broader still. After a ruling like the Nevada one, expect carriers to tighten the words, not loosen them.
Your professional liability policy is not a safe harbor. APG's exclusion sat in the professional liability section of its policy, not the general liability section. If you carry both, the exclusion can be on both.
Here is what I see on the security policies that cross my desk. Most carry a sublimit for abuse and molestation. Some exclude it outright. None of my clients has been hit with one of these claims yet, and the way we keep it that way is simple: we make sure it is covered at full limits, every time, not a sublimit.
How to get protection in place
Pull the policies. Find the exclusion by name: abuse, molestation, or sexual misconduct. Then answer four questions.
- Is it bought back? Abuse and molestation coverage comes as an endorsement on the general liability policy (ISO's version is CG 04 14, or its claims made twin, CG 04 16) or as a separate policy. If you cannot find the endorsement, assume you do not have it.
- What is the limit? Most policies I see carry a sublimit well below the general liability limit, and defense costs may come out of it. Ask for full limits.
- Occurrence or claims made? Claims made coverage has a retroactive date. Change carriers without carrying that date forward and the incident from two years ago is uninsured.
- Does the umbrella follow? Many umbrellas exclude abuse and molestation even when the primary policy covers it. Get the answer in writing.
Then look at the contracts. Shelters, hospitals, schools, HOAs, and property managers increasingly name abuse and molestation coverage with a specific limit. A certificate showing $1 million in general liability does not prove you meet that requirement, and the client's lawyer will find out after the claim, not before.
Underwriting matters too. Every guard in California needs a BSIS registration, which means a DOJ and FBI criminal history check, 40 hours of training up front, and 8 more hours every year. Carriers ask about it on the application, along with post orders for sensitive sites and how you handle complaints about a guard. An answer that is not true is the easiest way to lose a coverage fight you would otherwise win.
One more thing
Email your broker this week with one question: "If one of my guards is accused of sexual assault, or a client says we failed to stop someone else from committing one, which policy responds, and can you send me the endorsement?" If the answer that comes back is a certificate instead of an endorsement, keep asking.