Cyber / Technology E&O Insurance

Who needs cyber and Tech E&O, and when?

Short answer: any company that holds customer data, runs software customers depend on or signs enterprise contracts. Cyber and Tech E&O usually become non-negotiable the first time a customer’s security questionnaire or contract asks for proof of both.

Exposure grows with every customer, integration and record you hold. This table maps common milestones to what we would typically recommend. It is general guidance, and your lawyers can tell you where specific contractual or legal duties apply.

What cyber covers, and what it doesn't

First-party vs. third-party cyber coverage: what pays for what?

Short answer: first-party cyber coverage pays your own costs after an incident, such as investigators, restoration and lost income. Third-party cyber coverage pays when someone else claims you caused them harm, such as customers, individuals or regulators. Most policies bundle both, but the limits, retentions and triggers are often separate.

The difference matters because the two halves are triggered differently. Your own losses begin with an event in your systems and a notice to the carrier. Liability losses begin with a demand, a lawsuit or a regulatory request. Read first-party coverage and third-party coverage side by side in your policy, because a strong liability section does not help if the response costs are sublimited, and the reverse is also true.

Tech E&O sits on the third-party side but covers a different trigger: your product or service failed to do what you promised. E&O responds to the customer who lost money, while cyber responds to the incident that caused it, when there is one. That is why we prefer the two written on one form or at least on forms that were read against each other.

Does cyber insurance cover ransomware and extortion?

Short answer: usually yes, including negotiation, specialist support, restoration and lost income, but often with a sublimit, coinsurance or specific application conditions. A ransom payment itself is paid only where the law allows it and the carrier agrees.

Ransomware is the claim most buyers think about, which is why it is also the area where wording differences matter most. Ransomware coverage is rarely one line. It is a chain of costs, and each link can carry its own limit.

How does business interruption work, and what is dependent BI?

Short answer: business interruption pays the income you lose, plus continuing expenses, while a covered event keeps your systems down, usually after a waiting period. Dependent business interruption extends that to outages at providers you rely on, such as cloud hosting or payment processors.

For a software company, revenue stops when the service stops, so this is often the largest part of a cyber loss and the part least understood at purchase. Four parts of the wording decide the payout.

See contingent business interruption for the property equivalent. The cyber version has one wrinkle: many forms cover dependent outages caused by a security event at the vendor but not a plain technical failure. Since provider outages are often operational rather than malicious, that distinction matters more than the headline.

Does cyber insurance cover regulatory fines and defense?

Short answer: often it covers the cost of defending a regulatory investigation after a privacy or security event, and sometimes fines and penalties where the law allows them to be insured. Coverage varies by policy wording, jurisdiction and the type of penalty, so treat it as something to confirm rather than assume.

After a breach, regulators and contract counterparties may ask what you did, when you did it and whether your safeguards were reasonable. The cost of answering those questions is real even if nothing is ever fined.

Cyber vs. Tech E&O vs. the policies around them

A single technology incident can touch four different policies. Here is how common situations usually map.

What is a retroactive date, and why does it matter?

Short answer: a retroactive date is the earliest date a wrongful act or error can occur and still be covered by a claims-made policy. Cyber and Tech E&O policies are usually claims-made, so the date you choose, and whether you keep it when changing carriers, decides which past events are covered.

Many cyber policies treat the incident as the trigger and offer broad prior acts, while Tech E&O more often works from a stated date. Because the details differ by form, the practical advice is the same: ask what the retro date is, and what happens to it at renewal and at replacement. See also claims-made policies and prior acts coverage.

If a policy ends without a replacement, an extended reporting period can keep claims reportable afterward, but only if the option exists and is priced before you need it. See also tail coverage.

Which security controls do underwriters expect?

Short answer: multi-factor authentication, protected and tested backups, endpoint detection, controlled privileged access and a patching routine. Each is often required to get a quote at all, and strong evidence for each earns better terms.

Cyber underwriting is closer to a security review than most lines. The point is not to achieve perfect security. It is to show a carrier that you know where the risks are and that your answers on the application match what you really run.

How do sublimits and coinsurance shrink your cyber cover?

Short answer: a sublimit caps one type of loss below your main limit, and coinsurance makes you share a percentage of every covered loss. Both are common in cyber policies, so the number on the front page is rarely the number that pays a specific claim.

Pricing pressure usually shows up here rather than in the headline limit. Two quotes with the same limit and similar premiums can pay very different amounts on the same incident.

See also limit of liability and deductible for the basic terms.

Is social engineering covered by cyber or by crime?

Short answer: it can be either, and sometimes both, with a sublimit on each. Where it sits depends on how the policies are written, so the useful question is not “do we have it” but “which policy pays first and how much.”

Social engineering fraud and business email compromise involve a person being tricked into sending money, not a system being hacked. That is why they often fall between a cyber policy, which focuses on systems, and a crime policy, which focuses on theft of money. See our crime and fidelity guide for the other side.

Who do you call first, and what does a cyber claim timeline look like?

Short answer: call the carrier’s incident line or your broker before hiring outside vendors, because most policies require notice and approved or consented vendors to protect coverage. Then contain the incident, preserve evidence and let breach counsel direct the investigation.

Panel vendors and your own advisers. Many carriers keep a panel of breach counsel, forensic firms and notification vendors whose rates are pre-agreed. Using them is usually the smoothest path. If you already have a counsel or incident response firm, ask the carrier in advance whether they can be approved, rather than asking during an emergency. Policies differ on whether outside vendors are paid in full, partly or not at all, which is why the consent language is worth reading before you need it.

When you report, a carrier may acknowledge the claim while reserving its rights on parts it is unsure about. That is normal, and it is a signal to keep records and ask what is and is not accepted. See also first notice of loss and defense costs.

What about war, infrastructure and AI exclusions?

Short answer: some cyber policies exclude losses from war, state-backed attacks and failures of widespread infrastructure, and a growing number carve out losses tied to AI. The impact depends entirely on wording, so these are the clauses to read closely and, where possible, narrow.

Because exclusions are written by the carrier and can change at renewal, compare the wording year to year rather than relying on a summary.

Key policy terms that decide whether you get paid

Policy enhancements worth asking about

Two cyber policies with the same limit can respond very differently. These are the features we raise most often, in plain terms. Availability depends on the market and your controls.

What happens to cyber and Tech E&O when your company changes?

Short answer: growth, new products and new vendors usually change your risk faster than your policy changes, so the common events below are the ones to tell your broker about.

Six cyber claims we see founders underestimate

Scenarios are illustrative composites based on common claim patterns, not specific Alton Risk clients.

How much does cyber cost, and what moves the price?

Cyber pricing is driven by your security controls more than any other line of insurance, which means it is the policy where preparation pays off most. A company with MFA everywhere, immutable backups and endpoint detection can see a very different quote than a peer of the same size without them.

How to get cyber and Tech E&O quoted and bound without delay

Short answer: have your security evidence and customer contract requirements ready before you ask for quotes. Carriers move faster and offer better terms when the application is complete and the controls are described accurately.

What to have ready

1. Legal entity name, subsidiaries and a description of what your product does.
2. Revenue, customer count and the types and volumes of personal or regulated data you hold.
3. Evidence of multi-factor authentication, backups, endpoint detection and patching.
4. Your incident response plan and the date it was last tested.
5. Your critical vendors and how you would operate if one failed.
6. The insurance clauses of your largest customer contracts.
7. Prior policies and any incidents, claims or near misses, with loss runs where available.

Eight questions to ask about your current cyber policy

If you can’t answer all eight with confidence, send us your policy and we will review it line by line.