Does cyber liability cover a software bug that costs my client money?

Usually not on its own. A defect that causes client financial loss without any security or privacy event is a technology errors and omissions claim, and many cyber policies exclude professional services entirely. If the same defect also exposes data, both policies may be implicated, which is exactly why combined forms are preferable. A software company relying on cyber coverage alone has left its core exposure uninsured.

How much does technology E&O and cyber insurance cost?

A technology firm with $2,000,000 to $10,000,000 in revenue typically pays between $5,000 and $30,000 annually for a combined tech E&O and cyber policy with $1,000,000 to $5,000,000 in limits. Pricing depends heavily on services performed, client industries, revenue, and security controls. Firms lacking multi-factor authentication commonly see premiums 30 to 50 percent higher when they can get coverage at all.

Do I need cyber insurance if my data is all in the cloud?

Yes. Using a cloud provider transfers the infrastructure, not the legal liability to the people whose data you hold. Most cloud provider agreements cap their liability at a small multiple of fees paid, which will not fund a notification event. Cyber policies also cover contingent business interruption from a cloud provider outage, though waiting periods of eight to twelve hours are common and worth checking.

Can I add a client as an additional insured on my tech E&O policy?

Generally no. Professional liability forms, including tech E&O, do not typically offer additional insured status, because the coverage responds to your professional wrongful acts and adding another party creates a conflict. Additional insured status is normally available on general liability. When a contract demands it on professional liability, explain the market standard and offer a waiver of subrogation or a certificate evidencing the coverage instead.

What is a retroactive date on a tech E&O policy?

Tech E&O and cyber are written on claims-made forms with a retroactive date, meaning only wrongful acts occurring after that date are covered. When you change carriers, preserve the original retro date through prior acts coverage, or your entire work history before the switch becomes uninsured. Verify the retro date on your declarations page at every renewal, since it is one of the most commonly overlooked details in a program.

Tech E&O vs Cyber Liability: Which Policy Pays When Your Software Fails a Client

What is the difference between technology E&O and cyber liability?

Technology errors and omissions covers financial loss your client suffers because your product or service failed to perform as promised. The trigger is a wrongful act in the rendering of technology services, and the damages are usually economic: the client's lost revenue, the cost to hire someone else to fix it, contractual penalties, and their legal fees. No data has to be breached for the policy to respond.

Cyber liability covers loss arising from a security failure or privacy event, and it has two sides. First-party cyber pays your own costs after an incident: forensics, notification, credit monitoring, legal counsel, public relations, business interruption, and increasingly extortion payments and recovery. Third-party cyber pays claims brought against you by others whose data was exposed, plus regulatory fines and defense where insurable.

Tech E&O trigger: failure of your product or service, causing the client financial loss
Cyber trigger: a security or privacy event, whether or not your service failed
Tech E&O damages are usually economic and contractual
Cyber damages include your own response costs plus third-party privacy claims
Combined forms exist and are usually the better structure for technology firms

What claims fall in the gap between the two?

The gap opens when a single event has both a service failure and a data component, and the two policies are written by different carriers. A cyber policy may exclude claims arising from your professional services. A tech E&O policy may exclude claims arising from unauthorized access to data. Each carrier points at the other, and the insured spends months and legal fees resolving an allocation fight while the client waits.

Three examples show up repeatedly. A software defect causes a client's system to expose records publicly, which is a professional failure and a privacy event at the same time. A cloud provider outage caused by a misconfiguration creates client business interruption with no breach at all, which is tech E&O and often outside cyber's trigger. An employee at an MSP is socially engineered into transferring a client's funds, which involves neither a defect nor a data breach and may need crime coverage in addition to both.

The practical answer is to buy tech E&O and cyber from the same carrier on a combined form with shared limits and a single retention. It eliminates the allocation dispute, usually costs less than two separate placements, and gives you one claims contact instead of two adjusters with competing incentives.

What do customer contracts require you to carry?

Enterprise customer contracts have converged on a fairly standard insurance schedule, and technology vendors who cannot meet it lose deals. Typical requirements are commercial general liability at $1,000,000 per occurrence and $2,000,000 aggregate, technology errors and omissions at $1,000,000 to $5,000,000, cyber liability at $1,000,000 to $5,000,000, an umbrella of $1,000,000 to $10,000,000, workers compensation at statutory limits with employers liability at $1,000,000, and crime or fidelity coverage at $250,000 to $1,000,000 when the vendor handles funds.

Larger enterprise and financial services clients often go further, requiring $10,000,000 or more in combined tech E&O and cyber, thirty days notice of cancellation, a waiver of subrogation, and additional insured status on general liability. Additional insured status is generally not available on professional liability forms, and asking for it signals that the contract was drafted without a technology vendor in mind. That is a negotiable point, and pushing back with an explanation usually works.

Read the indemnity clause alongside the insurance schedule. An uncapped indemnity, or one that survives a limitation of liability clause, can create obligations far beyond your policy limits. Contractual liability is covered by most tech E&O forms only to the extent you would have been liable without the contract, so a broad indemnity you agreed to may not be insured at all.

How do insurers price a technology program?

Underwriters price on revenue, service type, client concentration, and controls. Revenue is the base rating variable, and a firm at $5,000,000 in revenue with standard controls might see combined tech E&O and cyber premiums in the range of $8,000 to $25,000 for $2,000,000 in limits, varying widely with the specific services performed. Firms serving healthcare, financial services, or critical infrastructure clients pay more because the downstream damages are larger.

Controls now drive pricing more than anything else on the cyber side. Multi-factor authentication on email, remote access, and privileged accounts is effectively mandatory, and a firm without it will struggle to get quoted at all. Endpoint detection and response, offline or immutable backups tested at least quarterly, a documented incident response plan, email filtering, and privileged access management are the standard checklist. For MSPs specifically, carriers examine whether your remote monitoring and management tool has MFA enforced, since compromise of an RMM platform gives an attacker access to every client at once.

Contract hygiene matters too. Underwriters ask whether you use written contracts with every client, whether they include limitation of liability clauses, and whether they disclaim consequential damages. Firms that do this consistently present as materially better risks, and the questions are on the application for a reason.

What exclusions matter most?

The exclusions that generate the most disputes are worth checking by name. The failure to maintain security standards exclusion allows a carrier to deny a cyber claim if the controls you represented on the application were not actually in place at the time of loss, so accuracy on the application is a coverage issue, not paperwork. The unencrypted device exclusion voids coverage for data lost on a laptop or drive without encryption, which is an easy operational fix.

On the tech E&O side, watch the cost of corrections or rework exclusion, which means the policy pays your client's damages but not your own labor to fix the defect. Watch the guarantee or warranty exclusion, which removes claims arising from performance promises you made beyond reasonable professional standards. Watch intellectual property carve-outs, since patent infringement is nearly always excluded while copyright and trademark may be covered. And check the definition of technology services against what you actually sell, because a firm that has added consulting, hardware resale, or staffing to a software business may be performing work its policy does not define as covered.

Get a Coverage Review

If your tech E&O and cyber coverage sit with two different carriers, the time to find the gap is before a claim tests it. Grandbay Financial Services reviews technology programs against your actual client contracts, consolidates coverage where it makes sense, and prepares the control documentation underwriters now require. Schedule a review at calendly.com/grandbayfinancial.

This article is for general information and is not a substitute for policy language or professional advice.

Frequently Asked Questions