Guides
Cyber insurance vs tech E&O: which policy pays when
Cyber pays your breach and outage costs and data claims; tech E&O pays customers' losses when your product fails. Where they overlap and where gaps hide.
Cyber insurance responds to a security or privacy event: it pays your own breach response and recovery costs, and it defends data-related claims against you. Technology errors and omissions (tech E&O) responds when a customer says your product or service failed to do its job and cost them money. A tech company usually needs both, because a single incident can trigger either policy, and which one answers often depends on how the loss is characterized.
The basic split
IRMI describes tech E&O as coverage for providers of technology services or products, with liability insuring agreements for technology services, technology products, media content and network security breaches. It describes cyber and privacy insurance as intended to protect consumers of technology products and services, while noting that the two "do offer a number of the same insuring agreements." That overlap is what trips buyers.
| Cyber | Tech E&O | |
|---|---|---|
| Trigger | A security or privacy event: breach, ransomware, extortion, outage | A claim that your product or service failed or was negligently delivered |
| Whose loss | Mostly yours (first-party), plus liability to people whose data you held | Your customer's financial loss (third-party) |
| Typical payments | Forensics, notification, restoration, extortion, cyber business interruption and dependent system failure, privacy liability, regulatory defense | Defense and damages in customer suits, sometimes regulatory proceedings and subrogation claims |
| Who buys it | Nearly every business that holds data or depends on systems | Companies that sell technology, software, IT or digital services |
For the first-party and third-party mechanics, see first-party vs third-party cyber coverage. For the vendor-side policy in detail, see Technology E&O insurance for software, SaaS and IT firms.
Which policy responds: common scenarios
The answer depends on form wording, but this is how the standard splits tend to work.
| Scenario | Likely responding policy |
|---|---|
| Ransomware locks your own servers and you lose a week of revenue | Cyber |
| A bug in your software miscalculates your customers' invoices | Tech E&O |
| A hacker steals your customers' records from your hosted platform | Cyber for your response costs and privacy claims; tech E&O if customers also allege you failed to deliver secure service |
| Your update crashes customers' systems | Customers' claims against you under tech E&O; your own losses possibly under cyber system-failure coverage |
| You miss the go-live date on an implementation | Tech E&O, unless a delay exclusion applies |
| An employee wires funds after a spoofed email | Crime or social engineering coverage, sometimes cyber, rarely tech E&O |
The July 2024 CrowdStrike outage showed the split in practice. CyberCube estimated global insured losses of $400 million to $1.5 billion, and Moody's said claims would be driven by business interruption under cyber systems-failure coverage, with a smaller number arising under tech E&O policies. Those were early estimates, but they show the structure: customers' own lost income runs through their cyber systems-failure cover, while customers' claims against the vendor belong on its liability policies. See System failure, cloud outages and the CrowdStrike lesson.
The classification problem
Because the policies split by cause, a loss can fall between them. A major outage may look like a cyber event, but if no covered security event occurred, the cyber policy may not respond while tech E&O would. The reverse also happens: a breach caused by a coding error may be argued to be a "service failure" and not a "security failure."
The main exclusion to watch is the professional services (or technology products and services) exclusion in cyber forms. In a guest post on The D&O Diary, IRMI's Robert Bregman described it as an exclusion that "eliminates coverage for what are essentially technology E&O exposures" and said cloud providers and web designers should buy tech E&O. The exclusion can be written broadly, reaching claims that arise from or relate to professional errors, so a technology company must read its definition of professional services before assuming its cyber policy treats its own customer-facing work as covered. Look for a carve-back that restores coverage for a breach of confidentiality or network security failure, even when it occurs while performing services.
Tech E&O forms have their own limits. Their breach-of-contract and delay exclusions, warranty carve-outs and software copyright wording are covered in Technology E&O insurance for software, SaaS and IT firms. Travelers notes on its tech E&O page that many forms carry a delay exclusion and that software copyright infringement is commonly excluded.
Combined policies
Many carriers sell the two together. Tokio Marine HCC's TechGuard combines technology services liability with privacy regulatory defense, breach event costs, cyber extortion and cyber crime on one form. Travelers markets CyberRisk Tech, which its site says covers both breach-of-contract and negligence claims. The Hartford argued in a sponsored piece in Risk & Insurance that tech companies should carry both coverages, whether through one policy or two, and that the insured should know which policy answers which exposure.
A combined form helps because it removes the argument over whether a loss was "cyber" or "service." It does not remove the need to read it. Questions to ask:
- Shared or separate limits? One aggregate shared by every insuring agreement means a breach and a failure-to-perform claim in the same policy year compete for the same dollars. Separate limits, or a dedicated cyber limit inside the package, protect against that.
- Retention by coverage part. Cyber response costs and E&O defense may carry different retentions.
- Retroactive date. Tech E&O is claims-made with a retroactive date, and software claims can surface years after release. Cyber forms often carry their own retroactive date or a prior-knowledge condition. Ask for both in writing.
- Definitions. "Security failure," "professional services" and "wrongful act" decide which grant applies.
- Panel and notice. Cyber claims often route through a breach hotline and panel vendors, while E&O claims go to claims counsel. Make sure your incident plan names both notice channels.
Contracts decide what you must buy
Customers write insurance requirements into master agreements, and technology vendors usually see both. A typical clause asks for tech E&O and cyber at stated limits, with the customer as an additional insured or notice of cancellation. A separate indemnity clause often makes the vendor responsible for the customer's own breach costs, such as notification and credit monitoring for the customer's data. Whether your policies pay that indemnity depends on the contractual liability exclusion and its carve-backs. A policy that excludes liability assumed under contract may fail exactly where the contract moved risk to you. Run the draft through the contract insurance requirements checker before signing, and see contractual risk transfer: shifting liability by contract and insurance and how to review the insurance requirements in a contract.
Hypothetical example
Say a managed service provider with 40 employees hosts billing systems for 120 small clients. An attacker enters through a compromised remote-access account and encrypts the MSP's environment, and customer data is exfiltrated. This is an invented scenario to show how the policies split.
- Cyber: pays the MSP's forensics, restoration, extortion negotiation, legal counsel and its own business interruption, subject to retention and any ransomware sublimit (see ransomware sublimits and coinsurance in cyber policies).
- Tech E&O: answers when clients sue claiming the MSP failed to protect their data or deliver the contracted service. Clients' own downtime and breach costs are third-party losses.
- The seam: if the cyber policy has a professional services exclusion without a carve-back, the carrier may argue the client claims arise from the MSP's services. If the E&O policy excludes data breach, the MSP may find that neither answers a client claim that is part breach and part service failure.
Who needs which
- A retailer, clinic or manufacturer that uses technology: cyber is the core cover. Tech E&O is usually unnecessary unless you also sell software or services.
- A software, SaaS or IT firm: both. Customers' contracts often require both anyway. See Software and SaaS company insurance and IT consultant and MSP insurance.
- A marketing agency or web developer: both, plus media liability. See Marketing agency insurance and media liability insurance: defamation, copyright and content claims.
- Any firm adding AI features: ask how AI-related errors and exclusions interact with each policy. See AI liability insurance: how insurers are treating artificial intelligence risk.
Use the cyber insurance readiness checklist to prepare security evidence for underwriters, which supports both applications.
Key takeaways
- Cyber covers your own security-event losses and data liability; tech E&O covers customers' financial losses from your product or service failing.
- Policies split by cause of loss, so a single incident can raise a dispute over which one applies. A combined form or aligned wording reduces that risk.
- The professional services exclusion in cyber forms and the data-breach and contract exclusions in tech E&O forms are where the gaps live. Ask for carve-backs.
- With combined policies, check whether limits are shared and whether the retroactive date applies to every coverage part.
- Customer contracts often dictate limits and indemnities, so compare your policies to the contract before you sign.