Cyber Insurance and Technology E&O for Data Centers and Their Vendors

Why data center risk outgrew standard policies

A data center sells availability. When power, cooling, network, or systems fail, the facility may be physically fine while dozens or hundreds of customers lose access to the applications they run there. That loss of availability, not fire or flood, is where most of the financial exposure now sits.

Source: Uptime Institute, Annual Outage Analysis 2026.

Uptime Institute’s 2026 analysis found that outage rates per site keep falling, but the cost of each serious outage keeps rising. Power remains the leading cause of impactful outages, procedural errors are the most common human factor, and network and fiber failures are increasing. Uptime also notes that the shift of workloads to third-party providers, including colocation firms, may require changes to contracts and financial arrangements. In practice, that means more outage costs are being pushed to whoever signed the service agreement.

Cyber attacks add a second layer. In October 2026, IDC Frontier, a SoftBank subsidiary, disclosed that a ransomware attack had taken down one region of its cloud service, which BleepingComputer reported was used by about 495 companies and local governments. Earlier in 2026, Claroty researchers disclosed vulnerabilities in UPS network cards and an HVAC controller used in data centers that could have let attackers run code remotely. Both vendors released fixes, but the research shows how a cyber event can become a power or cooling event.

Insurers are adjusting. S&P Global Ratings wrote in mid-2026 that cyber coverage for hyperscale facilities remains limited because the risk is hard to model, that demand for insurance against service-level agreement (SLA) penalties is growing faster than supply, and that many policies exclude non-physical losses such as power outages or apply waiting periods before business interruption coverage starts. Lockton’s 2026 data center update makes the same point: property policies generally don’t respond when operations fail without physical damage.

Risks for data center operators

Colocation and wholesale operators, edge facilities, managed hosting providers, and companies running their own enterprise data centers share a common problem: their customers depend on them, and their contracts say so. These are the exposures we see most often.

Customer claims after an outage

When an outage disrupts tenants, the first response is usually SLA credits. Larger customers often negotiate more: termination rights, damages beyond credits, or carve-outs from the operator’s liability cap. Claims that a service failed are typically a Technology E&O exposure. The catch is that many Tech E&O forms exclude failures of power, utility, or telecom infrastructure, which are exactly the failures behind most outages. An exclusion written for the public grid can be read against an operator’s own generators or UPS if the wording isn’t precise.

Cyber attacks on IT and building systems

Operators run two networks: the IT environment that supports customers and billing, and the operational technology that runs the building, including building management systems, UPS and power distribution, cooling, access control, and DCIM software. An attack on either can cause an outage. Cyber policies cover breach response, extortion, data restoration, and the operator’s own lost income. Check how the policy treats a cyber event that causes physical damage, such as overheated equipment, because many cyber forms exclude property damage while some property forms exclude cyber.

Downtime without physical damage

Property and business interruption coverage usually requires direct physical loss. A software fault, a cyber attack, or a utility failure that damages nothing can still stop revenue. Cyber business interruption can fill part of the gap for system failures, but waiting periods, sublimits, and the definition of “computer system” decide whether it responds to building systems.

Customer equipment and AI hardware

AI deployments have pushed the value of customer equipment in a single hall into the tens of millions of dollars. Colocation agreements commonly cap the operator’s liability and require tenants to insure their own equipment, often with a waiver of subrogation. Operators should confirm their contracts and policies agree on who carries that loss, and tenants should confirm they actually have the coverage the contract assumes.

Privacy and customer data

Most colocation operators never touch customer data, but managed hosting, cloud, and backup services do. A breach in a shared environment can create notification costs and liability to many customers at once, which affects how much cyber limit is enough.

Which policy responds to which loss

No single policy covers a data center’s full exposure. The goal is to design cyber, Technology E&O, property, and liability coverage together so a loss doesn’t fall between them.

This is a general guide. How a policy responds depends on its exact wording, endorsements, and exclusions.

Risks for technology vendors that serve data centers

A data center depends on a long list of specialists. When one of them makes a mistake, the outage and the claims can trace back to the vendor rather than the operator. This applies to:

• Managed IT, remote hands, and network operations providers
• DCIM, building management, and monitoring software vendors
• Electrical, power, and mechanical controls integrators
• Fiber, connectivity, and network service providers
• Physical security and access control integrators
• Commissioning agents and engineering consultants
• Cybersecurity firms that monitor or test data center environments

One error can affect every tenant

A misconfigured switch, a bad firmware push to power distribution units, or a monitoring gap during maintenance can take down a hall full of customers. The operator may pay credits to its tenants and then seek recovery from the vendor under the service contract. That claim is a Technology E&O exposure, and its size depends on what the vendor agreed to in the contract.

Your access is the attacker’s access

Vendors with remote access to a facility’s systems are a common path for attackers. If a compromised vendor account is used to reach the operator’s network, the vendor can face breach costs, network security liability claims, and contract claims. Underwriters will ask how that access is controlled, starting with multi-factor authentication on every remote tool.

Contracts set the limits

Data center operators increasingly require vendors to carry cyber and Technology E&O, often with specific limits, additional insured status, and waivers of subrogation. Morgan Lewis noted in 2025 that small and midsize technology vendors commonly carry $2 million to $5 million in cyber limits, while larger or higher-risk vendors may be asked for $10 million or more. A vendor whose policy doesn’t match the contract can lose the work or end up personally carrying the gap. See what a $5M cyber insurance contract requirement really means.

Physical work needs physical coverage

Technology E&O usually excludes bodily injury and property damage. Vendors who install or modify electrical, mechanical, or physical security systems also need general liability, and possibly products or contractor’s professional coverage, coordinated with their Tech E&O so a single incident is covered from end to end.

Contract terms to check before you sign or renew

Whether you’re the operator or the vendor, these terms decide who pays after an outage or attack.

• Liability caps and carve-outs. Does the cap apply to data breaches, gross negligence, and confidentiality breaches, or are they uncapped?
• SLA credits as sole remedy. Are credits the customer’s only remedy for downtime, or can it also claim damages?
• Consequential damages waivers. Lost profits and lost data are often the largest losses. Confirm whether they’re waived both ways.
• Insurance requirements. Limits, policy types, additional insured status, waiver of subrogation, primary and non-contributory wording, and how long coverage must stay in place after the contract ends.
• Limits versus liability. If your contractual liability exceeds your policy limit, you’re carrying the difference.
• Customer equipment. Who insures tenant hardware, and does the contract waive recovery against the operator?
• Notice obligations. Contract notice deadlines for incidents should match what your policy and incident response plan can meet.

What underwriters look for

Strong submissions answer these questions before an underwriter asks them.

How Complex Cyber places data center risks

Data center operators and their vendors rarely fit a standard application or a single carrier’s appetite. We’ve focused on cyber and Technology E&O since 2011.

1. Understand the operationWhat you run or service, who depends on it, and what your contracts promise.
2. Map exposures to coverageWhere cyber, Tech E&O, property, and liability meet, and where a loss could fall between them.
3. Build the submissionA submission that explains your redundancy, controls, and contracts the way underwriters evaluate them.
4. Approach the right marketsInsurers with appetite for data center and infrastructure risk, including primary and excess structures for high limits.
5. Compare and recommendWording, exclusions, waiting periods, and limits side by side, not just price.

Frequently asked questions