If your company sells software, runs a platform, or manages technology for clients, you face two different kinds of risk: an attack on your own systems, and a client losing money because your technology didn’t work. Cyber insurance and Technology E&O insurance are built for those two risks, and most technology companies need both.
Cyber insurance covers a data breach, ransomware attack, or network security failure, including your own response costs and claims from people whose data was exposed. Technology E&O insurance covers claims that your software or services failed to perform, contained an error, or caused a client a financial loss. A SaaS company with only cyber insurance usually has no coverage when a client sues over an outage or a bug.
What cyber insurance covers
Cyber insurance responds when there’s a security or privacy event. It typically includes two parts:
- Your own losses (first-party): breach response, forensics, legal counsel, notification, ransomware and extortion, data restoration, and income lost while your systems are down.
- Claims against you (third-party): privacy and network security liability, regulatory investigations, payment card assessments, and media liability.
What it generally doesn’t cover is a client’s financial loss when your product simply fails, without any breach or attack. That’s where Technology E&O comes in.
What Technology E&O insurance covers
Technology errors and omissions (Tech E&O) is professional liability for companies that provide technology products and services. It responds to claims that your work caused a client financial harm, such as:
- A platform outage that stops a client from operating
- A software bug that produces incorrect calculations or data
- A failed implementation or integration project
- Missing a service level the client relied on
- Claims that your product infringes intellectual property (often with limits or exclusions)
Tech E&O policies define the “technology products” and “technology services” they cover. If your business includes activities outside that definition, such as consulting, payments, or insurance services, those may need to be added.
Cyber vs. Tech E&O at a glance
| Cyber insurance | Technology E&O | |
|---|---|---|
| Main trigger | Breach, attack, or privacy event | Error, failure, or negligence in your product or service |
| Who is harmed | You, and people whose data is exposed | Your clients, financially |
| Typical claim | Ransomware shuts down your systems | A client sues after your platform goes down for two days |
| Your own costs | Usually included (response, extortion, lost income) | Usually not included |
| Often required by | Clients that share data with you | Enterprise clients, MSAs, and statements of work |
Three scenarios: which policy responds?
1. Your platform goes down for 36 hours
Tech E&O
A bad deployment takes your SaaS platform offline. Clients can’t process orders and claim lost revenue. There was no attack, so cyber insurance likely doesn’t respond to their claims. Tech E&O is designed for exactly this.
2. Ransomware encrypts your systems
Cyber
An attacker encrypts your servers and demands payment. Cyber insurance covers forensics, negotiation, restoration, and your lost income. If clients also claim losses from the resulting downtime, how that’s handled depends on your wording, which is why the two policies need to fit together.
3. An attacker reaches client data through your product
Both
A vulnerability in your application exposes client customer data. Your clients’ response costs and lost business may fall under Tech E&O, while privacy liability and regulatory issues may fall under cyber. This is where gaps and disputes between carriers happen most often.
Where technology companies end up with gaps
- Cyber only. The most common gap. The company buys cyber insurance and assumes client claims are covered.
- Two policies from two insurers. Separate cyber and Tech E&O policies can work, but if their definitions and exclusions don’t line up, a claim involving both can fall between them.
- Shared limits. Combined cyber and Tech E&O policies are common and efficient, but one large claim can use up the limit for both.
- Services that grew after the policy was placed. New products, consulting work, AI features, or payment functions may not fit the policy’s definitions.
- Contract requirements. Client agreements often require specific Tech E&O and cyber limits. Falling short can delay a deal or put you in breach.
Should cyber and Tech E&O be on one policy?
For many SaaS and IT companies, a combined policy from one insurer is the simplest way to avoid gaps between the two coverages. The trade-off is that both usually share one aggregate limit. Larger companies, and those with demanding client contracts, sometimes need separate or higher limits, or an excess tower above the primary policy. The right structure depends on your revenue, contracts, and how clients rely on your product.
How much coverage do you need?
Start with your client contracts, since they often set a minimum. Then consider your largest clients’ potential losses if your product failed, how much sensitive data you hold, and whether you’re growing into larger accounts. Our guide to contractual insurance requirements explains how to compare contract clauses with your policies.
Check your own coverage in minutes
Coverage Mapper
Pick your services and see which exposures need cyber, Tech E&O, or both. About 5 minutes, private.
Map your coverage →Coverage Gap Assessment
Already have a policy? Six questions on the weak spots we find most often. About 2 minutes.
Take the assessment →Frequently asked questions
Does a SaaS company need Tech E&O if it has cyber insurance?
Usually, yes. Cyber insurance generally doesn’t cover a client’s financial loss caused by your software failing or containing an error when no breach or attack is involved. Tech E&O is designed for those claims.
Is Tech E&O the same as professional liability?
Tech E&O is a type of professional liability written specifically for technology products and services. A general professional liability policy may not define your software or IT services as covered work.
Do MSPs and IT service providers need both?
Yes, typically. MSPs have privileged access to client systems, so a mistake or an attack that spreads into client environments can lead to both cyber and errors and omissions claims. Learn more on our Technology E&O page.
Will my clients’ contracts specify coverage?
Often. Enterprise clients commonly require Tech E&O and cyber liability at specific limits, sometimes with additional insured or notice requirements. Review those clauses before renewal, not after a certificate request.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Not sure your cyber and Tech E&O fit together?
We’ll review your policies and contracts and show you where the gaps are.
Request a Coverage Review Get QuotesThis article is general information, not a coverage determination or legal advice. Coverage depends on your policy’s wording, endorsements, exclusions, and limits, and is subject to insurer underwriting.