Your product guards the customer. When it fails, the claim is yours.Founded by a software developer who runs an AI app.
Detection, email security, identity and scanning products fail on every customer at once, and the loss is the customer’s own breach or outage. We place technology E&O and cyber together for security vendors so a claim is not argued between two policies.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What cybersecurity company businesses actually need.
Technology E&O
Claims that your product missed a threat, blocked legitimate work, or shipped an update that broke customers’ systems.
Without it — A security product is sold on the promise that something will not happen, so the customer’s lawyer reads every incident as a broken promise.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — Your own environment is a high-value target in your customers’ supply chain, and your response costs, restoration and liability to customers whose data was exposed through you sit here.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — What the company told customers, investors and regulators about its own security is a leadership exposure, and it has been the subject of enforcement.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — The certificate every enterprise customer asks for first, with the professional services and technology exclusions read before you rely on it.
Managed service provider coverage
If you also run security for customers as a service rather than only selling a product, the managed-service version of the same aggregation applies.
Without it — A service failure is judged on what you did or failed to do, not on a defect in a release, and the policy wording differs.
Media liability
Covers claims arising from what you publish (defamation, copyright and trademark infringement, invasion of privacy and misuse of a person’s likeness) on an annual policy for creators, podcasters, publishers and authors.
Without it — Threat reports, benchmarks and marketing claims about detection rates are published statements, and a competitor or customer can dispute them.
What the regulators actually wrote down.
CrowdStrike says a Rapid Response Content configuration update was released on Friday, July 19, 2024 at 04:09 UTC and reverted at 05:27 UTC, that it affected Windows hosts running sensor version 7.11 or newer that were online in that window, and that Mac and Linux hosts were not impacted.
CrowdStrike, Falcon Content Update preliminary post-incident report · checked 2026-11-01
Microsoft estimated that the CrowdStrike update affected 8.5 million Windows devices, less than one percent of all Windows machines.
Microsoft, Helping our customers through the CrowdStrike outage (July 20, 2024) · checked 2026-11-01
In May 2025 a Georgia state judge in Fulton County Superior Court let Delta Air Lines proceed with gross negligence and computer trespass claims against CrowdStrike over the July 2024 outage while dismissing fraud claims based on statements made before the parties signed their June 2022 agreement; CrowdStrike says it acted within that agreement and had retracted the update within 78 minutes. The ruling dealt with a motion to dismiss and decided nothing about who was at fault.
Fulton County Superior Court order (Judge Kelly Lee Ellerbe, May 2025), as reported by BankInfoSecurity, May 20, 2025 · checked 2026-11-01
On November 20, 2025 the SEC and the defendants filed a joint stipulation dismissing, with prejudice, the SEC’s civil action against SolarWinds Corporation and its chief information security officer in the Southern District of New York (No. 1:23-cv-09518-PAE); the SEC said the decision was made in the exercise of its discretion and does not necessarily reflect its position on any other case.
U.S. Securities and Exchange Commission, Litigation Release No. 26423 (November 20, 2025) · checked 2026-11-01
In July 2024 the Southern District of New York narrowed the SEC’s SolarWinds case to securities fraud claims based on the company’s statements about its cybersecurity before the incident, and rejected the SEC’s internal accounting controls theory.
S.D.N.Y. (Judge Engelmayer), July 2024 order, as summarized by Covington’s Inside Privacy · checked 2026-11-01
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Less common, severe
A faulty update or release disrupts many customers on one day
Covered by Technology E&O, with cyber for the customers’ restoration costs
One release becomes many claims at once, so the policy aggregate and any single-event limit decide how much of the total is covered. Contract liability caps decide how much a customer can recover from you at all.
Common
Your product missed an attack and a customer was breached
Covered by Technology E&O, with cyber for response costs
The customer’s loss looks like a cyber claim and the allegation is a product failure, so each policy can point at the other. Placing both with one insurer, or two written to read together, narrows that argument.
Less common, severe
Your own systems or build pipeline are compromised and customers are affected
Covered by Cyber liability
Third-party liability to customers whose environments were reached through you is a separate grant from your own breach costs, and some forms restrict it or exclude contractual liability.
Less common, severe
Statements about your security are challenged by a regulator or investor
Covered by Directors and officers
A cyber policy answers a breach, and a claim that leaders misdescribed their security practices is a management liability claim. Check that the D&O form does not carve out cyber events.
What our cybersecurity company clients ask us.
Why can one security product failure become so many claims?
Because the same release goes to every customer. On July 19, 2024, CrowdStrike says a content update released at 04:09 UTC and reverted at 05:27 UTC affected Windows hosts running a particular sensor version, and Microsoft estimated 8.5 million Windows devices. Each customer then has its own loss and its own contract. For an insurer this is aggregation: many claims from one cause on one day. The limit you buy, and whether it applies per claim or across all of them, matters more than for a vendor with a handful of clients.
What happened in the Delta lawsuit against CrowdStrike, and what does it teach a vendor?
Delta sued over the July 2024 outage in Georgia state court. In May 2025 the Fulton County judge let gross negligence and computer trespass claims proceed and dismissed fraud claims based on statements made before the 2022 contract. It was a ruling on a motion to dismiss, so it decided nothing about who was at fault, and CrowdStrike says it acted within its agreement. For a vendor the lesson is about contracts: the liability cap and the exclusion of indirect losses in your customer agreements shape what a claim can recover, and what a court will allow around them is argued, not assumed.
Is a claim about a missed attack a tech E&O claim or a cyber claim?
Usually both, and the overlap is the trouble. The customer’s loss is a breach, which sounds like cyber. The allegation is that your product did not do what you sold, which is technology E&O. A cyber policy responds to your own incident and may exclude contractual liability and claims that your product failed to perform, while a tech E&O policy may exclude the data breach costs. The cleanest answer is one insurer writing both, or two policies built knowing about each other.
Does our liability cap in the customer contract protect us?
It limits what the customer can recover from you, and your insurance should be sized with it in mind, but it is not a guarantee. A cap can be argued around, for example with a gross negligence or trespass theory, which is the kind of claim that survived the early stage in the Delta case. Enterprise buyers also commonly require insurance limits well above the cap. Send us the master agreement and the security addendum before we choose a limit.
What did the SEC’s case against SolarWinds change for a security company?
It showed that the company’s own public statements about its security can be the claim, separate from any customer loss. The SEC sued SolarWinds and its security chief in 2023; in July 2024 the Southern District of New York narrowed the case to claims about pre-incident cybersecurity statements, and on November 20, 2025 the SEC dismissed the case with prejudice, saying that did not necessarily reflect its position on any other case. A security company that sells to the public or to investors should treat what it says about its own controls as something its directors and officers coverage may be asked to answer.
What will the underwriter ask a cybersecurity company?
What the product does and whether it acts on its own: does it only alert, or does it block, quarantine or change a customer’s systems automatically. Whether updates go to all customers at once or in stages, and what testing comes before release. Whether the product has kernel-level or administrator access in customer environments. The standard customer contract, its liability cap and any uptime or detection guarantee. Whether you also run security as a managed service. What machine learning or AI model drives detection and whether a person reviews its output. Revenue, customer count by size, regulated customers such as hospitals or banks, countries served, prior claims, and your own security controls and certifications.
Our detection uses AI and sometimes gets it wrong. Is that covered?
A wrong detection, a false positive that blocks a customer or a miss that lets an attack through, is the product failing, which is what technology E&O is for. The question is wording: some 2026 forms add exclusions or conditions for AI output, and general liability forms may carry a generative AI exclusion. Tell the insurer plainly that detection is model driven and ask whether AI output is in or out. If your product also generates text for customers, such as a summary of an incident, that output is part of the same question.
What if the AI makes changes on its own, like isolating a customer’s machine?
An automated response is an action rather than advice, and the loss from a wrong action, such as taking a hospital workstation or a production server offline, falls on the customer at once. Underwriters ask which actions are automatic, whether the customer can set them to alert only, and whether there is a rollback. Contract terms that make the customer responsible for configuring those actions help the defense and do not prevent the claim.
Can a security product failure involve bodily injury?
Only in a narrow way, and only if you sell to places where systems affect people, such as a hospital, a utility or a clinic. If an outage in such a customer is later blamed for harm to a person, the allegation is that your product failure led to an injury, which technology E&O forms commonly exclude. Contingent bodily injury, an injury someone says came from relying on your product rather than from anything you physically did, can be added on some forms and not at all on others. It is worth asking about if your customers include health care.
We use AI to write our own code. Does that change anything?
It changes what the underwriter asks about testing and review, because a security product with an unreviewed flaw is the worst case for your customers. Describe how code is reviewed before release and how much is written by AI tools. The builder’s side of this, including what shipped from an AI-assisted build, is in our guide, and the page for sellers of the coding tools themselves is separate.
Do you also cover managed security services?
Yes. If you run monitoring and response for customers as a service, you are closer to a managed service provider than to a software seller, and the claim is usually a failure to respond or to configure rather than a defect in a release. The policy language differs on both, so tell us which parts of your revenue are product and which are service.
We have customers outside the US. Does the policy follow us?
Not automatically. Many technology E&O policies only defend claims brought in the US or Canada, and a customer in another country can sue under its own law and contract. Data protection laws abroad also affect your cyber coverage. Check where claims can be brought before you sign a European or Asian customer.
Which NAICS codes does this page cover?
Security companies are classified by what they do. The 2022 NAICS codes most relevant are 541512 Computer Systems Design Services, 541519 Other Computer Related Services, 513210 Software Publishers, 541511 Custom Computer Programming Services, 541513 Computer Facilities Management Services and 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. The code you carry on the application is not the whole story, because the underwriter prices what the product does.
Where does this fit with insurance for AI apps in other industries?
A security vendor’s claim is the customer’s breach, while a fitness app’s is a user’s injury and a trip planner’s is a stranded traveler. Each industry has its own gap between policies. We keep the pages by industry so the exposure you read about is yours.
Is there an example of the policy gap in our own work?
Our founder, Kevin Kelsey, owns a fitness app with a built-in AI coach, TrainRec by Manifest Post, and has placed AI apps. The finding from a real placement was that an AI that gives personal guidance reads to an underwriter more like a professional than like software. A security vendor learns the same lesson about its contracts: how the product is described changes how the policy treats it.
Guides on cybersecurity company.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.