A founder we work with asked a version of this question the week before a board meeting: is $2M in Cyber Insurance normal for a company our size? It's one of the most common questions that comes up at renewal, before a fundraise, or right after a big customer contract lands. The honest answer is that it depends on a lot more than size.
Most people reach for the same shortcut when they're trying to answer it: find out what "similar companies" carry, then match it. But similar is doing a lot of unearned work in that sentence. Two companies in the same industry, at the same funding stage, with the same headcount, can carry very different real risk once you factor in entity structure, contract obligations, and what's driving their exposure. A number that ignores those differences is a guess dressed up as data.
Getting the comparison right starts with getting "similar" right, then checking your own limits, retentions, and coverage lines against a comp set that matches your business, not just its label.
Key Takeaways
- "Similar company" usually means same industry and similar size, but the factors that actually change your risk, entity structure, contract obligations, and revenue mix are far less visible and often matter more.
- Coverage limits should scale with capital raised and revenue, not match a peer snapshot. A company that just closed a $30M round has a different Directors & Officers (D&O) Insurance conversation than one still under $5M raised, even if they're the same age and industry.
- Contracts are frequently the real, binding benchmark. In calls with Vouch clients and prospects, customer, investor, or licensing requirements set the actual coverage limit far more often than any peer comparison does.
- D&O and Cyber pricing have both been softening industry-wide, while Technology Errors & Omissions (Tech E&O) is hardening specifically around AI exposure. A benchmark from even a year ago, or from a company without meaningful AI use, can point you the wrong direction today.
- A published number can tell you what other companies pay. It can't tell you whether your entity structure, your contracts, or your vertical make you a different risk than the "similar" company it's comparing you to. That's where an experienced advisor adds real judgment.
What Makes a Company "Similar" to Yours
When most people compare their coverage to "similar companies," they mean two things: same industry and similar size. Those are the two variables you can see from outside a company, so they're the two everyone defaults to. They're also not the two that matter most.
A company's real risk profile, the thing that should determine what it carries, comes from a few factors that rarely show up in a public comparison:
- Funding stage and capital raised. A company that just closed a Series B carries different exposure than one that raised the same amount two years ago and has since spent it down.
- Contract and customer requirements. Enterprise contracts, investor side letters, and licensing agreements often specify exact coverage minimums that have nothing to do with peer averages.
- Entity structure. A company with a single Delaware C-corp is a different comparison than one with multiple entities, international subsidiaries, or a mix of full-time and fractional leadership. In calls with Vouch clients and prospects, entity structure comes up as a factor in roughly 1 in 10 benchmarking-related conversations, more often than most founders expect.
- Vertical-specific risk. A SaaS company handling standard customer data and a HealthTech platform handling patient data can look identical in size and stage and be genuinely different risks.
None of this makes peer data useless. It means a label like "Series B SaaS company" or "$10M ARR professional services firm" isn't specific enough to build a real comparison on. A comparison that's useful starts with companies that match on the factors driving risk, not just the ones that happen to be visible.
Why Coverage Limits Vary So Much Between Similar Companies
Once you're comparing companies that are genuinely alike, the reason their coverage still differs comes down to three drivers.
Capital Raised and Revenue
D&O, Cyber, and Tech E&O Insurance limits are meant to move with your capital raised and revenue, not stay fixed at whatever you started with. In practice, that means the guidance a company gets at $2M raised looks different from the guidance it gets at $30M raised, even if nothing else about the business has changed.
A few patterns show up consistently in conversations with Vouch clients and prospects. Cyber limits in the $5M range tend to make sense once a company is doing $25M to $50M in revenue. D&O limit increases usually get flagged once capital raised crosses somewhere in the $30M to $40M range. Employment Practices Liability Insurance (EPLI) limits typically scale by headcount tier rather than revenue. None of these are hard rules. They're starting points that shift as your numbers change, which is exactly why a single peer number, frozen at whatever stage that peer happened to be at, stops being useful the moment your own numbers move.
Contracts and Investor Requirements
The most reliable benchmark many companies have isn't a peer company at all. It's already sitting in their own contracts. Enterprise customers, investors, and licensing partners frequently specify a minimum Cyber Insurance limit or Errors & Omissions (E&O) Insurance limit as a condition of doing business, and that number is often higher, and always more binding, than whatever a similar company happens to carry.
This shows up often enough to name directly: in calls with Vouch clients and prospects, contract or investor requirements set the actual coverage limit in roughly one out of every twelve benchmarking-related conversations, more often than a straightforward peer comparison does. If your biggest customer contract requires $3M in Cyber coverage, that number matters more than what a similar company down the street carries.
Vertical Risk
Regulated, pre-revenue, or higher-risk verticals change the math again. A pre-revenue Fintech company operating in a regulated space can carry real exposure that a standard peer benchmark understates entirely, because "typical for an early-stage company" assumes a risk profile that a regulated business doesn't share. The same holds in Health & Life Sciences and Web3, where a standard peer number can miss exposure that only shows up once an underwriter looks closely at the business model.
Why This Year's Market Makes an Old Benchmark Unreliable
Even a well-matched peer company from a year ago can point you the wrong direction today, because the market itself has been moving in different directions depending on the coverage line.
D&O and Cyber pricing have both continued to soften. The Council of Insurance Agents & Brokers' Q2 2026 Commercial P/C Market Survey found Cyber premiums down 3.2%, the ninth consecutive quarterly decrease for that line, with D&O also among the lines seeing rate reductions. That follows a broader shift in the first quarter of 2026, when premiums fell across all account sizes for the first time since 2017. If your last benchmark came from a company that renewed even 18 months ago, it's likely reflecting pricing the market has already moved past, and overall startup insurance costs have shifted enough since then to matter.
Tech E&O is moving in the opposite direction, and the reason is specific: AI exposure. Lawsuits involving generative AI grew nearly tenfold between 2021 and 2025, and state insurance regulators had approved more than 80% of carrier requests to add AI-related exclusions to corporate policies by early 2026, according to a CSIS analysis. More than 60 property and casualty insurance groups filed for AI exclusions in 2026 policies alone. A similar company that isn't building with AI, or wasn't a year ago, is no longer a fair comparison for one that's now shipping AI features, even if everything else about the two businesses matches.
D&O has its own version of this problem. Securities class action settlements hit a nearly three-decade high, a median of $17.3M in 2025, according to Cornerstone Research, even as overall D&O pricing has softened. Litigation risk and premium direction aren't always moving together, which is exactly the kind of nuance a static peer number can't capture.
Crypto and financially distressed companies show the same pattern from another angle. They're a hard-market exception sitting inside an otherwise soft D&O market, which means similar by stage or size alone stops being a useful comparison once real risk enters the picture.
A Practical Framework for Comparing Your Coverage to Similar Companies
Once you've defined a real comp set and accounted for where the market stands, here's what an actual comparison looks like.
What to Compare
- Limits. Not a flat number, but one indexed to your revenue, capital raised, and contract requirements.
- Retentions. What you're responsible for before coverage kicks in. Two companies can carry the same headline limit with very different real protection depending on retention.
- Coverage lines carried. Make sure you're comparing the same set of policies. A similar company carrying D&O, Cyber, and Tech E&O isn't a fair comparison for one that's also carrying EPLI and Crime Insurance.
- Exclusions. Two "$2M Cyber" policies can cover meaningfully different things, especially as AI-related exclusions become more common.
How to Index the Comparison
Start from your own numbers, not the comparison. List your current capital raised or trailing revenue, your known contract or investor requirements, and any vertical-specific risk that applies to your business. Only then look at what similar companies carry, and use it as a sanity check rather than a starting point. If a peer number is meaningfully higher or lower than what your own drivers suggest, that gap is worth understanding before deciding it means anything.
When to Stop Comparing on Your Own and Bring in an Advisor
A DIY comparison gets you most of the way. It's genuinely useful for sanity-checking a quote, pushing back on a renewal increase, or negotiating with a customer who's asking for more coverage than your business realistically needs. In calls with Vouch clients and prospects, that's the most common use of benchmarking data: less about finding the right number in the abstract, more about having something concrete to negotiate with.
It runs out in a few specific places. Coverage split across multiple brokers can make it hard to even see your own total program cost, let alone benchmark it. Genuinely novel exposure, like an enterprise contract with uncapped indemnification obligations, doesn't have a peer number to check against because there isn't a standard limit that applies. And entity structures that don't map cleanly to a single, simple business (multiple subsidiaries, international operations, fractional leadership) make a generic comp set close to meaningless.
This is where an experienced advisor's value stops being about access to more data and starts being about pattern recognition. An advisor who has placed coverage across companies with your entity structure, your contract patterns, and your vertical's risk profile has seen what similar really looks like from the inside, not just what similar companies report paying. That's a kind of judgment no published number can replicate.
Start From Your Own Numbers
The best benchmark for your coverage starts with correctly identifying what makes another company comparable to yours, then checking your limits, retentions, and coverage lines against that real comp set instead of a label. Get that right, and a conversation with an advisor who knows your vertical will tell you more in twenty minutes than any published number can.
Frequently Asked Questions
How much D&O Insurance should your company carry?
There's no single number that applies across every company at your stage. As a general starting point, many early-stage companies begin with $1M to $2M in D&O Insurance and increase it as capital raised grows, often revisiting the limit once a raise crosses the $30M to $40M range. Your actual number should reflect your capital raised, your board composition, and any investor requirements, not just what a similar-looking company carries.
How much Cyber Insurance do you need for a company your size?
Revenue is one of the biggest drivers. Companies doing $25M to $50M in revenue often carry Cyber limits in the $5M range, but that number moves quickly for businesses handling sensitive data, operating in regulated industries, or shipping AI features, regardless of revenue. Size alone isn't a reliable guide once any of those factors are in play.
Why did your insurance premium increase even though nothing changed?
Revenue and headcount growth, often following a funding round, can move your premium even without a claim or a deliberate change, since most coverage lines price off those numbers. Market direction matters too. Cyber and D&O pricing have both been softening industry-wide, while Tech E&O has been hardening specifically around AI exposure, so which lines moved, and in which direction, depends on what you carry.
Is a cheaper quote from another broker comparable coverage?
Not necessarily. A lower price on the same headline limit can come from a higher retention, narrower exclusions, or fewer coverage lines bundled in, all of which change what you're protected against. Before switching on price alone, compare retentions and exclusions line by line, not just the number on the declarations page.
What's the difference between comparing insurance quotes and benchmarking your coverage?
Comparing quotes means checking price for the same ask, usually during a renewal or when you're shopping brokers. Benchmarking means checking whether the ask itself, like your limits, coverage lines, and retentions, is right for your company in the first place. You can get a great price on the wrong amount of coverage.
Does your entity structure change what counts as a similar company?
Yes. Multiple entities, international subsidiaries, or a mix of full-time and fractional leadership can shift your real risk and pricing even when your industry and size look identical to a peer's. Two companies with the same revenue and headcount can be genuinely different risks once an underwriter looks at how the business is structured.
Vouch Specialty Insurance Services, LLC (CA License #6004944) is a licensed insurance producer in states where it conducts business. A complete list of state licenses is available at vouch.us/legal/licenses. Insurance products are underwritten by various insurance carriers, not by Vouch. This material is for informational purposes only and does not create a binding contract or alter policy terms. Coverage availability, terms, and conditions vary by state and are subject to underwriting review and approval.
.png)
