Quick answer: Cyber liability responds when your own systems or data are compromised — breach, ransomware, extortion, wire fraud. Technology E&O responds when your platform fails to perform and a customer loses money. SaaS companies need both, written so neither policy can point at the other.
A mid-size SaaS platform pushes a release on a Thursday. A permissions bug in that release exposes one tenant's records to another tenant. By Monday the company is facing two distinct problems: a security incident with notification obligations, and an angry enterprise customer claiming lost revenue and demanding indemnification under the MSA.
That is one event and two entirely different insurance questions. Which policy pays depends on how your program was assembled — and for a lot of software companies, the honest answer is "we're about to find out."
Cyber liability is built around an incident at your business. A complete SaaS cyber policy typically includes:
Federal agencies publish the baseline guidance underwriters increasingly expect you to follow: the NIST Cybersecurity Framework for control structure, CISA's StopRansomware resources for ransomware readiness, and the FTC's data breach response guide for post-incident obligations. If your platform touches regulated data, sector rules stack on top of those baselines — we covered one version of that in cyber insurance for healthcare practices using AI scribes.
Tech E&O — technology professional liability — responds when what you sold did not work as promised. Typical triggers for a SaaS business include a platform defect that corrupts or loses customer data, an outage that breaches an SLA and causes a customer financial loss, a failed or late implementation, an integration that silently stops syncing, or an inaccurate output a customer relied on.
The distinction that matters: cyber asks was there a security failure? Tech E&O asks did your work product fail? A customer can lose real money without any attacker being involved at all, and a standalone cyber policy will decline that claim correctly.
Return to the release that exposed one tenant's data to another. There was a security event, which looks like cyber. There was also a coding defect that caused a customer's loss, which looks like E&O. If those policies sit with two carriers on two forms, each has a plausible argument that the other should respond first, and you fund the defense while they sort it out.
Two structural fixes work. The first is a combined cyber and tech E&O form from a single carrier, with one limit, one retention, and one claims process — the cleanest answer for most SaaS companies. The second, where a combined form is not available, is careful manuscripting so that each policy expressly contemplates the other and neither excludes the overlap zone. We walked through the same coordination problem in a different context in our post on cyber and tech E&O for AI development companies.
Enterprise MSAs routinely specify required limits, additional insured status, and waivers of subrogation. Those numbers are negotiated minimums, not risk assessments. Your limits should be sized to your worst realistic scenario — a defect or breach affecting every tenant at once — and to your largest contractual exposure, not your average deal. Watch for liability caps that carve out data security events entirely, which is increasingly common and moves your real exposure well above the contract value.
A practical test when comparing quotes: ask the broker to explain, on one page, which policy responds if a breach originates in your own code, and what the other one excludes. If the answer is vague, the coordination has not been done. The same question applies to any vendor holding privileged access to your environment — see cyber liability for consultants handling client access.
Both. Cyber covers incidents affecting your systems and data; tech E&O covers claims that your product failed and cost a customer money. Neither one pays the other's claims, and most enterprise customers now require evidence of both.
It depends on how the two policies are written. On a combined cyber and tech E&O form the question is largely moot — one limit responds. On separate policies from separate carriers, expect a coverage argument unless the forms were coordinated deliberately at placement.
Requirements vary widely by customer size and data sensitivity, and the number in the MSA is a floor rather than a recommendation. Size your limits to your aggregate tenant exposure and your largest contract's indemnity terms, then confirm the specific figure each customer requires before signing.
Substantially. Multi-factor authentication on all remote and administrative access, endpoint detection and response, tested offline backups, privileged access management, and a documented incident response plan are the controls underwriters ask about first. Weakness in any of them narrows both your market and your terms.
If your SaaS company holds customer data and signs enterprise agreements, the coverage question is not whether you have a cyber policy — it is whether your cyber and tech E&O forms coordinate, and whether your limits match what you have actually promised in writing. PrimeRisk Insurance Solutions reviews technology programs against the contracts they are meant to support. Call 480-613-8387 or visit primeriskinsurance.com.