How do you get $10M of cyber insurance, or $5M of tech E&O, when nobody will quote it?

What this means for you

• Your website is your application. An underwriter at these limits reads your site before your submission, and every service listed on it is an exposure they price. A services page that still mentions marketing, development or hosting you stopped offering years ago is priced as if you still do it. Fix the website before the submission goes in, not after the decline.
• The excess is priced off the primary. An excess layer does not have its own underwriting story; it follows the primary and is rated as a share of it. Every dollar you take off the primary comes off the excess as well, which is why the argument is always with the primary underwriter and never with the excess market.
• Put tech E&O on the primary rather than beside it. A combined cyber and technology E&O form is one underwriting decision and one price, and for a firm that places people into client systems it is usually cheaper than a cyber policy alone was. Two policies from two carriers is two prices, two retentions and an argument about which one responds.
• If you hold no data, your contracts are the exposure. Staffing firms often have no environment of their own to breach. What the underwriter is pricing is what your agreements make you responsible for: a placed engineer with production access, an indemnity clause that puts their errors on you, and the limits the client wrote into the exhibit. Bring the agreements to the submission, because they are the risk.
• Count your records before the underwriter does. The number of people whose personal information you hold, including every candidate who ever sent you a resume, is the first question asked at $5M and above. A firm that knows the number, and can say where it lives and who can reach it, is a different submission from one that guesses.
• A past decline is not a permanent one. The account in the example had been declined by the same carrier that later wrote it. What changed was the submission, not the business. A decline is an underwriter’s answer to the question they were asked; ask a more accurate one and the answer can change.

Related questions

Why can’t I get $10M of cyber from an online marketplace?

Because the platforms are built to price a small limit from a short form, and neither the limit nor the form stretches to $10M. At that size a carrier wants to know how many personal records you hold, what security controls and endpoint detection you run, and what your client agreements make you responsible for, and no instant-quote form asks. The limit is placed by a broker as a primary policy with an excess layer above it, underwritten by a person who reads the submission.

What does a cyber underwriter ask at $5M and above?

The number of personal records you hold, and what protects the systems that hold them: multi-factor authentication, endpoint detection and response, backups that are tested, and who administers it all. For a business that runs its own environment those answers drive the price. For a staffing or services firm with no environment of its own, the underwriter turns to the client agreements, because the exposure is whatever those agreements put on you.

Does $5M of tech E&O come as a separate policy from cyber?

It can, and it usually should not. Most technology programs put cyber and technology E&O on one combined form, because an incident at a technology provider is often both at once: a breach of data and a failure of the service. One form is one underwriter, one price and one retention, and in the placement described on this page adding tech E&O to the primary cyber policy produced a lower price than the cyber policy had carried on its own.

What technology E&O responds to

We are a staffing company with no servers. Why is our cyber so expensive?

Usually because the underwriter priced a business you are not running. A staffing firm’s submission is read from its website and its contracts, and a website that still lists managed services, development or marketing describes a technology company with client environments to break. The fix is to make the website say what the firm does now, and to bring the client agreements so the underwriter can see what you are actually responsible for. In the example on this page that alone cut the price roughly in half.

Insurance for IT staffing firms

Will a client accept $5M primary plus $5M excess as $10M?

Normally, yes. A contract that requires $10M of cyber is asking for $10M of limit available to a claim, and a primary policy with a following-form excess layer above it provides exactly that. The certificate shows both policies. Read the insurance exhibit before you rely on that, because a small number of contracts specify how the limit is to be structured, and it is easier to negotiate that sentence before signature than to rebuild a tower after it.

How much does $10M of cyber cost?

It depends on what the underwriter reads, which is the whole point of this page. The one figure we can give you is real: a tech staffing firm was paying almost $20,000 for a $10M tower and now pays $11,000 for the same limit with technology E&O added, after the submission and the website were corrected to describe the business as it operates. Two firms with the same limit and the same revenue can be priced very differently on the strength of their contracts, their record count and their controls.

What cyber liability covers