Your healthtech platform just closed a Series B. Three months later, a ransomware attack encrypts your production database. Patient records are inaccessible, your engineering team is working around the clock, and your legal counsel is on the phone asking whether you have Cyber Insurance in place. You do, and that decision is about to matter more than almost any other you made this quarter.
Growth creates trust, and trust is exactly what your customers, investors, and partners expect you to protect. As you sign bigger contracts, raise capital, and store more customer data, that trust becomes a real financial exposure the moment a cyberattack or data breach gets in the way of it.
Cyber Insurance is how growing technology companies transfer that exposure instead of carrying it alone. It's no longer just a banking or financial-services concern. SaaS companies, fintechs, healthtech platforms, and increasingly AI companies all handle sensitive data or make product decisions that create real liability if something goes wrong.
Key Takeaways
- Cyber Insurance protects primarily against ransomware, phishing, and data breach response costs, not just large-scale hacking incidents.
- Typical Cyber and Tech E&O limits for software companies range from $1M to $5M or more, depending on revenue and how much sensitive customer data (PII) you store.
- AI companies face coverage gaps that many standard policies exclude unless a specific endorsement is added, since AI model failures and training-data liability aren't automatically covered.
- First-party coverage protects your own company; third-party coverage protects you against claims brought by your customers.
- The best time to review your limits is before a fundraise or a major contract, not after an incident.
Who Needs Cyber Insurance as a Startup?
Cyber Insurance used to be treated as a concern mainly for banks and other heavily regulated industries. In practice, most software companies handle exactly the kind of data and product risk that makes Cyber coverage relevant well before they hit meaningful scale, including:
- SaaS platforms that store customer account data or usage data
- Fintech products that move money or handle financial account information
- Healthtech companies that handle regulated health data
- eCommerce and marketplace businesses that process payments
- AI companies whose products make automated decisions or process sensitive inputs and outputs
AI companies are a newer and increasingly common reason this conversation comes up. The insurance AI companies typically need usually extends well beyond a standard Cyber policy. Standard Cyber and Technology Errors and Omissions (Tech E&O) policies often don't automatically cover AI model failures, outputs that are factually incorrect or misleading, or liability arising from training data or intellectual property claims unless a specific AI endorsement is added, and carrier availability for that endorsement varies by state.
If your product stores customer information, processes payments, powers critical business operations, or makes decisions customers rely on, Cyber Insurance is worth evaluating well before an enterprise customer or investor asks for it. Many startups purchase coverage because growth naturally increases both their exposure and the expectations of customers, partners, and investors.
What Should Cyber Insurance Cover?
A comprehensive Cyber Insurance policy protects more than the cost of notifying customers after a data breach. Depending on your policy, it can help cover expenses across several stages of a cyber incident.
Incident Response and Recovery
Following a breach or ransomware attack, Cyber Insurance may help pay for:
- Digital forensics to determine what happened
- Legal counsel and breach response
- Customer notification costs
- Credit monitoring where required
- Data restoration and system recovery
Business Interruption
If a cyberattack or cloud service outage prevents your business from operating, coverage may also include:
- Lost business income
- Extra operating expenses during recovery
- Costs related to restoring critical systems
Cybercrime and Financial Fraud
Many policies also include protection for financial losses resulting from:
- Ransomware and cyber extortion
- Business email compromise
- Social engineering
- Funds transfer fraud
Coverage varies by insurer and policy language, so it's important to review exactly what's included before an incident occurs.
Some policies also include protection against cybercrime involving the theft of financial information or securities. Ransomware and extortion remain a major driver of these claims: Allianz's 2025 Cyber Security Resilience report found ransomware behind roughly 60% of large Cyber claim value in the first half of 2025, with details on how that risk is shifting covered below.
What Isn't Covered by My Cyber Insurance Policy?
Exclusions in Cyber Insurance vary from policy to policy. One of the more contested is the war or hostile-act exclusion, since insurers sometimes point to any hint of nation-state involvement in an attack to try to deny a claim.
That's exactly what played out after the 2017 NotPetya attack: Merck's insurers argued a hostile-act exclusion applied because intelligence agencies linked the malware to Russia, but New Jersey's appellate court disagreed, ruling that the exclusion requires actual military action, not just alleged state sponsorship.
Merck's insurers settled the roughly $700M dispute in January 2024 rather than continue appealing, and the case pushed the industry toward writing more specific cyber war exclusions. The takeaway for most startups: these exclusions exist, but courts have generally read them narrowly, so don't assume a broad one applies without reading your policy's exact language.
In most cases, an exclusion exists because that type of event is meant to be covered under a different policy.
What Happens if I Don't Have Enough Cyber Insurance?
When choosing Cyber Insurance limits, it's important to think beyond the immediate cost of recovering from an attack. A significant cyber incident can trigger expenses across multiple areas at once, including forensic investigations, legal counsel, customer notification, credit monitoring, business interruption, and potential lawsuits.
Imagine your company carries a $1M Cyber policy, but a ransomware incident ultimately results in $2.4M in covered losses. Once your policy limit is exhausted (subject to its terms and deductible), your business could be responsible for the remaining costs. That's why coverage limits should reflect your actual exposure, not simply the minimum amount needed to satisfy a contract.
As your revenue grows, you store more customer data, or you sign larger enterprise agreements, it's worth reviewing whether your existing limits still match the scale of your business.
What Are the Most Common Cyber and Tech E&O Coverage Limits for Software Companies?
Ask Vouch's advisors what founders bring up first, and it's almost always the same question: how much coverage is actually enough. There's no universal answer. The right limit depends on your revenue, how much personally identifiable information (PII) you store, and what your customers and investors require of you.
As a general rule, higher revenue and more PII exposure both push recommended limits up, since both increase the potential cost of a breach and the leverage a ransomware attacker has over your business. Below are current Vouch benchmark limits for software companies, shown separately for Cyber and Tech E&O coverage. If you're not sure why you'd need both, Tech E&O and Cyber Insurance cover different failure modes even though they're often bundled together.
Current Cyber Coverage Benchmarks for Software Companies
There's no single coverage limit that's right for every company. In general, recommended limits increase as both your operational exposure and contractual obligations grow.
Revenue often drives potential business interruption losses, while the amount of personally identifiable information (PII) you store influences notification costs, regulatory exposure, and potential litigation following a breach. The benchmarks below illustrate how those factors commonly affect recommended Cyber and Tech E&O limits for software companies.
Limits are shown as First-Party Liability / Third-Party Liability.
Higher revenue increases business interruption loss and ransom leverage. Breach costs scale with the number of PII records you hold, since notification, credit monitoring, fines, and litigation costs all rise with record count.
Current Tech E&O Coverage Benchmarks for Software Companies
Tech E&O covers claims alleging financial loss due to service errors or failure to perform. Larger contracts increase the potential damages tied to a single claim.
These benchmarks are general guidelines and may not be right for your business. Every company is unique and should work with a licensed insurance professional to get the right level of coverage in place.
To understand how much Cyber coverage you need, evaluate how much customer information your company stores and how sensitive it is. Names and email addresses carry far less risk than Social Security numbers or bank account details.
When considering business interruption coverage, think through the worst-case scenario for downtime and how long recovery would realistically take. That's what should drive your business interruption limit, not a rough guess.
You should also weigh your risk tolerance and your partners' requirements. Many organizations will only work with vendors that meet a certain coverage standard, so if you're selling into companies like that, you'll likely need a higher limit than these benchmarks suggest.
The best time to revisit your limits is before they're tested, not after. If you have a fundraise, a large enterprise contract, or a big push into a new customer segment on the horizon, that's the moment to confirm your coverage still matches where the business is headed, not just where it's been. This is also worth reading alongside how investors actually evaluate your insurance strategy during diligence.
Talk to a licensed Vouch advisor, or use our Coverage Recommendation tool to get a clearer sense of your recommended limits.
Do I Need Cyber Insurance if I Don't Handle Sensitive Customer Data?
If your company doesn't handle, work with, or store sensitive consumer information, Cyber coverage may not seem necessary. But there are other reasons to carry it beyond protecting that data directly.
If there's a breach and your company gets pulled into a lawsuit as a result, Cyber Insurance can help cover the legal fees and other costs of mounting your defense. A common scenario: a startup stores sensitive consumer information through an outside vendor, like a cloud or payment processor. If that vendor gets hacked, the startup can still end up named in a lawsuit alongside the vendor and financially responsible for the damages its own customers incurred.
Any startup that depends on its online systems to run the business can also benefit from business interruption and Cyber coverage if a breach causes downtime. Cloud-related breaches are among the more expensive categories of cyber incident to resolve, which is part of why business interruption coverage matters even if you never store sensitive data directly.
What's the Difference Between First-Party and Third-Party Cyber Coverage?
Cyber coverage really only makes sense once you see it as protecting three separate parties: you, your insurance carrier, and your customers or clients.
A first-party claim is filed when your own company's systems are breached. The limit on that side of the policy helps cover the costs of notifying customers, monitoring and restoring credit, and running the forensic investigation to figure out what happened.
Third-party coverage applies when your customers are the ones affected by the breach. If sensitive information belonging to your customers gets exposed and they come after you for the resulting financial loss, third-party coverage helps with defense costs, settlements, and judgments.
When a business partner requires that you carry Cyber Insurance, they're usually referring specifically to your third-party limit, since that's the coverage that protects them if your breach affects their business too.
Learn more about first- and third-party coverage.
What Are Some Real-World Cyber Insurance Claim Scenarios?
Coverage components can feel abstract until you see how they play out in practice. These examples are illustrative, not a guarantee of coverage. Whether a specific incident is covered always depends on your policy's exact terms, conditions, and exclusions.
- A phishing email tricks an employee into wiring company funds to a fraudulent account.
- Ransomware locks your production environment and halts your product for your customers for days.
- A misconfigured cloud storage bucket exposes customer records before anyone catches it.
- A vendor you depend on for authentication or payments is breached, and your customers' data is exposed as a result, even though your own systems were never touched.
- An AI feature produces an inaccurate output that a customer relies on, causing them financial harm and triggering a claim against your company.
If your product involves AI-driven decisions, that last scenario is worth sitting with. It's exactly the kind of exposure that's often excluded from standard Cyber and Tech E&O forms unless specifically endorsed. A Vouch advisor can help make sure a policy's AI endorsements, exclusions, and limits actually match how your product works, not just the generic form a carrier defaults to. Or you can start with our Coverage Recommendation tool to see what's typical for a company at your stage.
Learn more about GenAI liability management best practices.
Cyber Insurance Should Grow with Your Business
The right Cyber Insurance policy is the one that reflects how your company actually operates today and where it's headed next. The customer data you store, the systems your product depends on, the contracts you sign, and the technologies you build all shape your cyber exposure.
Reviewing your coverage before a fundraise, enterprise partnership, or major product launch can help ensure your policy keeps pace with your business. Waiting until after a cyber incident is often the most expensive time to discover your coverage no longer matches your risk.
Frequently Asked Questions
Will my Cyber Insurance policy cover ransomware and social engineering?
Most Cyber policies cover both. Ransomware remains one of the leading drivers of large cyber claims, accounting for roughly 60% of large claim value in the first half of 2025 according to Allianz's 2025 Cyber Security Resilience report, and most policies respond to extortion costs, system restoration, and business interruption from an attack. Social engineering coverage, including business email compromise and funds-transfer fraud, is typically available as well, though it may require a specific endorsement depending on your policy. Check your terms carefully, since sublimits on social engineering coverage vary significantly across carriers.
Are Cyber Insurance costs still rising?
It's more mixed than the headlines suggest. IBM's 2025 Cost of a Data Breach Report found the global average breach cost fell to $4.44M, down from $4.88M in 2024, the first year-over-year decline in five years. At the same time, the US-specific average hit a record $10.22M. What drives your actual premium is your revenue, industry, security posture, and coverage limits, more than the broader market trend. If your premium has increased at renewal without a corresponding change in your exposure, that's worth a conversation with your broker about shopping the policy to alternative carriers.
What are the risks of not having a Cyber Insurance policy?
While Cyber Insurance is optional, the risks of skipping it are real and they compound: a cyberattack can be costly enough to threaten a small company's survival outright through the direct incident costs, the lost customer trust, and the deals that stall while you're dealing with the fallout, and many companies and investors also require some form of Cyber Insurance before they'll partner with you or fund you, so opting out can put both the incident costs and a deal at risk at the same time.
How do I file a Cyber Insurance claim?
Contact your broker or insurer as soon as you become aware of an incident, even if you're not certain it rises to the level of a covered claim. Most Cyber policies have reporting requirements, and waiting too long can complicate coverage. Your insurer will typically ask for a description of what happened, when you discovered it, and what systems or data were affected. From there, your carrier coordinates the response, which may include forensic investigators, legal counsel, and breach notification support depending on the nature of the incident. If you're a Vouch client, you can file directly through your account and a member of the team will follow up within one business day.
Is there a deductible when I file a claim?
Depending on how your Cyber Insurance policy is structured, there will likely be a retention fee or deductible. Most Cyber policies are designed to protect companies from catastrophic losses, not routine customer disputes, so the higher the limits you request and the more risk exposure your company carries, the higher your retention or deductible is likely to be.
When should a startup buy Cyber Insurance?
Many startups purchase Cyber Insurance before they think they'll need it. Common triggers include signing enterprise customers, raising venture funding, handling sensitive customer information, or entering industries where partners require proof of coverage. Buying coverage before these milestones helps avoid delays during fundraising or contract negotiations.
Does Cyber Insurance cover cloud service outages?
It can, depending on the policy. Many Cyber Insurance policies include business interruption coverage that may apply if a covered cyber event affects your business operations. Some policies also include contingent business interruption coverage for certain outages involving third-party cloud providers or vendors. Because coverage varies, it's important to understand exactly how your policy treats cloud-related disruptions before relying on it.
Vouch Specialty Insurance Services, LLC (CA License #6004944) is a licensed insurance producer in states where it conducts business. A complete list of state licenses is available at vouch.us/legal/licenses. Insurance products are underwritten by various insurance carriers, not by Vouch. This material is for informational purposes only and does not create a binding contract or alter policy terms. Coverage availability, terms, and conditions vary by state and are subject to underwriting review and approval.
.png)
