Incident response on day one, the forensics and legal bill, the business interruption loss, and the liability when a customer says the breach was your fault.
Cyber liability does two jobs. The first-party side pays your costs when something goes wrong inside your environment: the forensics firm, breach counsel, notification, credit monitoring, the ransom decision, restoring corrupted data, and the revenue you lost while systems were down. The third-party side pays when someone sues you — a customer whose records were exposed, a regulator opening an inquiry, a card brand assessing PCI fines.
For technology companies, cyber is rarely bought alone. It is usually packaged with Technology Errors & Omissions on a single form, from a single carrier, with a shared limit. That structure matters: when a customer sues after an outage, the claim can be part professional-services failure and part security failure, and a combined form removes the argument about which policy responds.
The market has also gotten specific about controls. Multi-factor authentication on email and remote access, endpoint detection, tested backups, and privileged access management are effectively underwriting prerequisites for meaningful limits. Getting the application right is most of the pricing outcome.
Buy it when
Grants vary by carrier and form. These are the components we look for when we place it.
A 24/7 breach hotline, pre-approved forensics vendors, and breach counsel — usually outside the retention or with a reduced retention if you use panel firms.
Negotiation, ransom payment where lawful, and the cost of rebuilding what was encrypted or exfiltrated.
Lost income from your own outage and — critically for SaaS — from an outage at a cloud or hosting provider you depend on.
The engineering cost of recreating or restoring data and applications that were corrupted or destroyed.
Defense and damages when a third party claims your failure to secure a network or protect personal information harmed them.
Response to state AG, FTC, HHS, or EU/UK regulator inquiries — and the fines themselves where insurable by law.
Fines, penalties, and card-reissuance costs assessed by card brands or your acquirer after a payment data event.
Usually a sublimit. Covers fraudulently induced wire transfers — a loss a growing finance team is exposed to from its first vendor payment.
Defamation, copyright, and trademark claims arising from your website, product content, and marketing.
We put this in front of you at binding — the only moment you can still do something about it.
Composite scenarios drawn from how these losses typically develop. Illustrative, not case files.
A subprocessor is breached. Attackers pivot into your production environment through a shared integration and exfiltrate records for 140,000 end users across 60 customer accounts. Cyber pays for forensics, notification in 43 states, credit monitoring, breach counsel, and the class action that follows.
Production is encrypted on a Friday night. You restore from backups rather than pay, but it takes nine days. Cyber pays the incident response cost, the engineering hours to rebuild, and the contractual SLA credits and lost revenue during the outage.
An attacker impersonates a supplier over email and changes remittance details. The social engineering sublimit responds — which is precisely why that sublimit's size deserves attention at binding, not at claim time.
Ranges we commonly see for technology companies. Your contracts and exposure decide the answer — this is where the conversation starts, not where it ends.
| Stage | Typical | |
|---|---|---|
| Pre-seed / Seed | $1M | Usually a packaged Tech E&O + Cyber form. Enough to satisfy early enterprise contracts. |
| Series A | $2M – $3M | Contract requirements start to cluster at $2M. Watch the social engineering sublimit. |
| Series B | $3M – $5M | Dependent business interruption and regulatory coverage become the negotiating points. |
| Series C+ | $5M – $15M+ | Towers with excess layers. Panel counsel, retention structure, and BI waiting periods drive value. |
What we need to quote
Most of this is collected once in the Atlas submission and reused across the markets we approach.
Start a submissionYes. Cloud providers cover the security of the cloud; you are responsible for security in the cloud — your configurations, your access controls, your application, your data. Nearly every breach we see at software companies is a customer-side failure, not a hyperscaler failure.
No, but they are usually bought together. Tech E&O responds when your product or service fails to perform. Cyber responds when data or systems are compromised. Many claims are both, which is why we generally place them on one combined form with a shared limit.
Cyber forms often don't add additional insureds the way General Liability does. What the customer usually needs is a certificate evidencing the limit, and sometimes a waiver of subrogation. We handle that language with the customer's procurement team directly.
We put a complete submission in front of cyber markets within six hours, and your portal updates as responses arrive. Missing MFA is the most common reason a submission stalls — have it in place before you apply.
Compare cyber insurance and technology E&O, see where claims overlap, and learn what to check in a combined policy for a software business.
Read the guide: Cyber Insurance vs. Tech E&O: What Is the Difference?Build a SaaS insurance checklist around customer contracts, data, employees and funding. Know what to prepare before requesting quotes.
Read the guide: SaaS Insurance Checklist for Founders and Finance TeamsReview an MSA insurance exhibit: coverage types, limits, additional insured wording, certificates, endorsements and timing before you sign.
Read the guide: Enterprise Contract Insurance Requirements: A Tech Company ChecklistTell us about the business once. A broker reviews it the same business day and comes back with a plan and a timeline.
