The contract names the limit. Most tech policies can’t reach it.Founded by a software developer who owns a software company.
We insure technology companies with technology E&O and cyber at the limits enterprise contracts actually name, excess above both when primary carriers stop, and the rest of the program around them.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O builds and sells software.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, is a software developer. He owns Manifest Post, post-production coordination software for episodic television, built B/side, a video editor for teams, holds a number of patents on that software, and wrote the platform this agency quotes, files and services every policy on. So when an enterprise customer’s contract asks for technology E&O and cyber at $5M, the clause is read by someone who knows what an uptime promise and a data processing agreement mean to a software company, rather than by someone matching a class code to a rate.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What technology businesses actually need.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — The easy online carriers sell cyber without technology E&O at all, and a contract that names both is not satisfied by one.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — The moment you take institutional money, investors become a constituency that can sue the board, and D&O is what a priced round, a board seat and an acquisition each assume you already carry.
Umbrella & excess liability
Extra limit stacked above general liability, auto and employers liability. Usually the cheapest million dollars on the policy.
Without it — Only a handful of carriers quote $5M primary on tech E&O or cyber. Excess above both is how contract limits actually get met, and we place it constantly.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — The certificate line every office lease and vendor onboarding portal asks for first, even from a company with no premises risk to speak of.
Employment practices liability
Wrongful termination, discrimination and harassment claims brought by your own employees. General liability specifically excludes these.
Without it — Tech employment claims — misclassified contractors, terminated engineers, offer letters — are decided on documents, and none of them touch general liability.
Workers compensation
Required in almost every state the moment you have employees. Priced on payroll and class code, which is why the class code is worth arguing about.
Without it — Required the moment you have a W-2 employee, in every state you employ them, and remote hires quietly multiply the states.
Crime & employee dishonesty
Theft by your own staff, funds transfer fraud, and the dishonesty bond a home care contract will ask you for by name.
Without it — Social-engineering and funds-transfer fraud sit in crime forms, not cyber ones: the wire that left because an email looked right.
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Most common
Your software fails and a client loses money
Covered by Technology E&O — third-party
Pure financial loss, with no injury and no property damage, which is exactly what general liability is built to exclude. A miscellaneous E&O policy usually will not answer it either.
Most common
A breach exposes customer personal data you were holding
Covered by Cyber — first-party response and third-party liability
The half people forget is first-party. Forensics, restoration and your own lost income are your costs, and a liability-only form pays none of them.
Common
A wire goes out because an email looked right
Covered by Crime / social engineering
Cyber commonly excludes it, because the transfer was authorized, since a person was tricked rather than a system breached. It lives in the crime form, usually at a sublimit.
Less common, severe
An investor or acquirer sues the board over a decision
Covered by Directors and officers
Nothing else covers the individuals. It is also a diligence item that stalls rounds and sales, and the run-off tail has to be bought before closing rather than after.
A client needed $10M in cyber to bid on a contract with a Fortune 500 buyer, and the bid had a deadline measured in days. Their existing policy topped out far below it and their broker had no market that could reach the number.
We placed $10M in cyber with a 48-hour turnaround and the certificate went out in time for them to bid. Our clients work with Fortune 500 companies routinely, and the limits those relationships demand are the reason we place primary and excess over technology E&O and cyber constantly rather than occasionally — only a handful of carriers quote $5M primary, and reaching $10M is a structured placement rather than a quote.
What the insurance company will ask about your technology business
We read the applications the markets use for businesses in this field and pulled out what they actually ask. Have these answers ready and a quote takes a day instead of a week, because nobody has to come back to you for the missing piece.
About the business
- What's your company name, address, and website?
- How many employees do you have?
- What's your annual revenue?
- Do you provide managed IT services, and if so, what percentage of your revenue comes from that?
- What percentage of your revenue is business-to-business versus direct to consumers?
How you operate
- What are your two largest client engagements from the past two years, including what services you provided and what they paid?
- Do you use written contracts with all your clients, or what percentage of the time?
- Do you accept payment cards, and if so, what percentage of your revenue comes from card payments?
- If you rely on third-party cloud hosting or payment processors, do you have a backup plan if they go down?
- Do you use email to store or send sensitive customer information?
Safety and controls
- Do you require your employees to use a virtual private network (VPN)?
- Do you protect all devices with anti-virus, anti-malware, or endpoint protection software?
- Do you scan incoming emails for malicious attachments and links?
- How often do you back up critical data, and are those backups encrypted and kept separate from your main network?
- Have you tested whether you can restore your key data and systems from backups in the last six months?
Your history
- Have you had any claims or incidents in the past five years that you need to report?
- Have you notified customers of any data breach in the past five years?
- Have you been subject to any government investigation or action related to privacy violations in the past five years?
- Have you received any complaints or cease-and-desist letters about trademark, copyright, privacy, or defamation?
Money and people
- Have you completed, agreed to, or are you planning any mergers or acquisitions in the past 12 months or next 12 months?
Have these ready
- Your most recent audited annual financial statement
- Your written client contracts (or a sample if you use the same template)
- Documentation showing your payment card processor is PCI compliant
You answer what you can; a licensed agent fills the rest with you.
What our technology clients ask us.
We are VC-funded. Do we need D&O?
Yes, and usually sooner than founders expect. Taking institutional money creates a constituency with standing to sue the people running the company, and D&O is the only policy that protects those individuals personally, because indemnification from the company is worth whatever the company is worth on the day the claim lands.
We were sold “miscellaneous E&O”. Is that the same thing?
No, and it is the wrong policy for a technology company often enough that it is worth checking today. Miscellaneous professional liability is a generic form written for consultants and small service businesses, and it is priced accordingly, which is why it gets sold.
What is the difference between first-party and third-party coverage here?
Third-party pays for harm to somebody else; first-party pays for harm to you. They are different halves of the same event and both belong in the program.
Do our compliance certifications affect the price?
Yes, materially, and it is the most underused lever a technology company has. Underwriters treat an audited certification as evidence rather than assertion, and the questions on the application map almost one to one onto the controls the certifications require.
We use AI, or we build with it. How does that change underwriting?
It changes the questions before it changes the price, and the questions are getting sharper every renewal. What underwriters now ask, and what you should have answers to:
A contract requires $5M in cyber and tech E&O. Our carrier tops out lower. What now?
Nothing brings technology companies to us more often. Most of the convenient online carriers stop at $1M or $2M, and only a handful of markets quote $5M primary. The placement that actually satisfies the clause is usually a primary policy at its best limit with excess layered above it — over both the cyber and the tech E&O. We structure that routinely, and the certificate shows the full limit the contract named.
We already have a professional liability policy. Isn’t that tech E&O?
Read the form before assuming so. The miscellaneous E&O policies commonly sold to tech firms online often exclude, or sublimit to a fraction of the policy, claims arising from the dissemination or leak of personally identifiable information, and HIPAA violations. For a company whose product touches customer data, those are precisely the claims most likely to arrive. A true technology E&O form is written for software failing and data escaping; a generic one is written for neither.
What is the difference between cyber and tech E&O?
Cyber answers for what happens to your systems and data: breach response, ransomware, notification, your own downtime. Technology E&O answers for what your product or service does to a client, meaning the outage your software caused them, the deliverable that failed. Contracts usually name both because customers carry both exposures from you, and one policy responding does not make the other claim go away.
Why do we need general liability if nobody visits our office?
Because the systems asking for it do not care. Office leases, vendor onboarding portals and event contracts request a general liability certificate as a matter of course, and the absence of one stalls procurement exactly like a missing cyber limit does. It is inexpensive for a technology risk, and having it ready is mostly a matter of never being the reason a deal waits.
We build with AI. Which of these policies has to say so in writing?
All of the liability ones, since 2026. General liability can carry the ISO generative-AI exclusions, tech E&O and D&O can carry a carrier’s own, and cyber and media forms are split between carriers that exclude AI and carriers that cover it affirmatively. A technology company that builds or sells with AI wants the affirmative wording on tech E&O and cyber at minimum, and should read the management liability renewal for an AI exclusion before the board approves the next model deployment.
Our enterprise customer’s MSA requires tech E&O and cyber. What exactly do we send them?
A certificate of insurance showing every line and limit the insurance exhibit names, with the customer as certificate holder and as additional insured on general liability where the exhibit asks for it. To get there, send us the whole exhibit, the customer’s vendor security questionnaire if they sent one, your revenue and your current declarations page. The exhibit tells us what the policy has to say and the questionnaire answers most of what an underwriter will ask.
How much does technology E&O cost?
Across the technology E&O terms this agency bound in 2025 and 2026, the median premium was about $3,540 a year and the middle half paid between roughly $2,000 and $6,220. Revenue, the amount of customer data you hold and the limit your contracts name move it more than headcount. A $5M or $10M requirement is a primary policy with excess above it and costs more.
An AI assistant recommended a specific cyber insurer. Should we just buy from it?
Treat it as one option rather than the answer. An assistant naming an insurer is naming a product, and whether it fits depends on things the assistant cannot see. The two that matter most are whether the form includes technology E&O alongside cyber and whether it will match the wording in your customer’s exhibit. A broker can put that insurer next to the others that write software companies and show you the difference on the clause that matters.
What does a technology insurance application ask for?
The applications for technology businesses ask about 4 things above all: what's your company name, address, and website; what are your two largest client engagements from the past two years, including what services you provided and what they paid; do you require your employees to use a virtual private network (vpn); have you had any claims or incidents in the past five years that you need to report. Have your most recent audited annual financial statement and your written client contracts (or a sample if you use the same template) ready and a quote takes a day instead of a week.
Guides on technology.
- $10M Cyber and $5M Tech E&O: How to Get It PlacedWhere $10M cyber and $5M tech E&O actually come from, what the underwriter reads at those limits, and how one tech staffing firm cut a $20,000 tower to $11,000 while adding E&O.
- Tech Contract Insurance Requirements: MSAs and Security ReviewsWhat an enterprise customer’s insurance exhibit usually demands of a software or IT vendor, which limits are hard to find, what technology E&O has cost the businesses we placed, and the five documents that get the certificate out fastest.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.