Our enterprise customer’s contract requires tech E&O and cyber. What limits do we need, and what do we send them?

What this means for you

• Send the whole insurance exhibit, not a summary of it. The limits are the part everybody reads. The sentences that cause trouble sit around them: whether the customer must be an additional insured, whether the coverage must be primary and non-contributory, how many days of cancellation notice are promised, what rating the carrier must hold and how long the coverage has to stay in force after the contract ends. We match the policy to the exact words, so we need the exact words.
• Send the security questionnaire with it. The customer’s vendor security review asks about multi-factor authentication, encryption, backups, access control and incident response, and a cyber application asks nearly the same questions. A SOC 2 report or an ISO 27001 certificate is evidence an underwriter can rely on, and it moves the price. Answering both documents once, consistently, is faster and cheaper than answering them twice.
• Count your records. The first question at higher limits is how many people’s personal information you hold or can reach, including what sits in your customers’ environments if your product touches it. A vendor that knows the number gets a cleaner quote than one that guesses.
• Line up the liability cap and the insurance. Most MSAs carry a limitation of liability clause, often with carve-outs for data breaches and confidentiality that sit above the general cap. If the carve-out is uncapped or set at several times the fees, the insurance limit is what actually stands behind it. Read the two clauses side by side before you sign, and ask us before you agree to a number no carrier will sell.
• Check what you already own. A policy bought online as professional liability may not be technology E&O at all, and the gap shows up on the certificate when the customer’s procurement team compares it to their exhibit. Send the current declarations page and we will tell you whether it can be endorsed up or has to be replaced.

Related questions

What limits do enterprise customers usually ask a software vendor for?

Most insurance exhibits we see ask for technology E&O and cyber at $1M to $5M each, general liability at $1M per occurrence and $2M aggregate, workers comp at statutory limits, and sometimes crime or an umbrella. Large enterprise and Fortune 500 buyers sit at the top of that range and sometimes ask for $10M of cyber. The limit usually scales with how much of the customer’s data you can reach rather than with the size of the deal.

Can our customer be added as an additional insured on the tech E&O and cyber policies?

Usually not in the way the exhibit imagines. Additional insured status is a general liability concept, and most professional liability and cyber forms do not add other organizations as insureds. What procurement teams generally accept is the customer as certificate holder on those lines, additional insured on general liability, and the notice of cancellation the policy actually provides. Raise it before signature, because a sentence like this is easier to correct in a redline than to explain after the certificate is rejected.

Certificate holder versus additional insured

Our customer sent a vendor security questionnaire. Is that an insurance question?

Partly. The questionnaire is the customer checking your controls, and a cyber application is a carrier checking the same controls before it prices you. The answers have to agree, because an application that claims multi-factor authentication everywhere while the questionnaire admits gaps is the kind of mismatch that surfaces at claim time. Send us the completed questionnaire and any SOC 2 report and we will build the submission from them.

Tech E&O against cyber

How much does tech E&O cost for a software company?

Across the technology E&O terms this agency bound in 2025 and 2026, the median premium was about $3,540 a year and the middle half paid between roughly $2,000 and $6,220. Revenue, how much customer data you hold and the limit the contract names move it more than headcount does. A $5M or $10M requirement is a tower with excess above the primary and costs more; one $10M cyber tower we placed came to $11,000 with technology E&O included.

How a $10M cyber tower gets placed

Our current policy tops out at $1M or $2M. What do we do?

Keep the primary if the form is right and buy excess above it, or move to a market that writes a higher primary limit on a combined technology E&O and cyber form. Which is cheaper depends on how the primary underwriter reads your business. Both produce a certificate showing the full limit the contract named, and customers normally accept a primary policy plus excess as meeting the requirement.

How long does it take to get a certificate that satisfies the contract?

A complete submission at ordinary limits usually turns around in days. Higher limits take longer because a person underwrites them, though one client needing $10M of cyber for a Fortune 500 bid had it placed in 48 hours. The delay is nearly always a missing document, so the exhibit, the questionnaire, your revenue and your current declarations page up front are what make it fast.

Can I ask ChatGPT or another assistant to send you the request?

Yes. Paste the insurance exhibit into the assistant and ask it to prefill our quote form at boring.insure/quote with your business name, contact details and the exact limits the contract names in the comments. Nothing is sent until you review it and press send, and a licensed agent reads every request. Assistants can find the full instructions at boring.insure/for-assistants.

Applying for insurance through an AI assistant

We use AI in the product. Does the contract or the policy care?

Increasingly both. Customers now ask whether the product sends their data to a model provider, and 2026 renewals can exclude AI output from technology E&O unless the policy covers it affirmatively. Tell the carrier what the AI feature does and which model it calls, and get wording that covers it rather than an exclusion nobody read.

Tech E&O for AI features that touch customer data