SaaS companies are the exact type of business cyber insurers worry about most. You store customer data, you run infrastructure other businesses depend on, and a single outage or breach can trigger claims from multiple customers simultaneously. Standard cyber policies aren't always built for that.

Here's what cyber insurance for SaaS companies actually covers, where generic policies fall short, and what to look for when you're shopping.

Why SaaS risk is different

A retailer's cyber risk is mostly about protecting their own customer data. A SaaS company's risk extends further: you're holding customer data and providing the infrastructure your customers run their businesses on. That creates two distinct exposure layers most buyers overlook.

The first is first-party risk — what happens to your company when you're breached: forensic costs, notification expenses, ransomware response, lost revenue while systems are down.

The second is third-party (liability) risk — what happens when a breach or outage affects your customers. They can sue you for their damages. In SaaS, this is often the bigger exposure.

What a good SaaS cyber policy covers

A policy built for SaaS should include all of these — not just the first few:

• Data breach response — forensic investigation, legal counsel, customer notification, credit monitoring
• Business interruption (BI) — lost revenue and extra expenses when your platform is down due to a cyber event
• Dependent business interruption — BI triggered by an outage at a cloud provider (AWS, GCP, Azure) you rely on
• Ransomware / extortion — negotiation costs, ransom payments if necessary, recovery expenses
• Network security liability — third-party claims from customers or partners harmed by your breach
• Technology errors & omissions (Tech E&O) — claims alleging your software failed to perform as contracted
• Regulatory defense and fines — legal costs and penalties from GDPR, CCPA, HIPAA, or state breach notification investigations
• Media liability — claims related to content you publish or host (less common in B2B SaaS, but increasingly relevant)

Tech E&O: the coverage SaaS companies most often miss

Technology errors and omissions coverage — often called Tech E&O — is distinct from cyber insurance but frequently bundled with it. It covers claims that your software or service didn't work as advertised, causing a customer financial harm.

If your platform goes down and a customer loses a day of sales, they may allege your product failed. That's a Tech E&O claim, not necessarily a cyber claim. Many carriers sell cyber and Tech E&O as a combined policy. Some don't. If yours doesn't, you may have a gap.

Ask explicitly: does this policy include Tech E&O, or do I need a separate policy?

Limits: how much coverage does a SaaS company need?

There's no universal answer, but here are the factors that should drive your limit decision:

• ARR and revenue concentration — a ransomware event could knock you offline for days; your BI limit should cover realistic downtime
• Number of customers and records held — breach notification costs scale directly with customer count; $1M covers roughly 50,000–100,000 notifications
• Customer contract indemnification clauses — if your MSA requires you to indemnify customers for your breaches, your liability limit needs to reflect your largest customer's potential damages
• Cloud infrastructure dependency — heavy AWS or GCP dependency means dependent BI exposure; make sure that sublimit isn't too low

Most seed-to-Series A SaaS companies buy $1M–$2M limits. Series B and beyond, or any company with enterprise contracts containing meaningful indemnification language, should model out whether $5M is more appropriate.

What underwriters look at for SaaS companies

Cyber underwriters have gotten much more selective since 2021. For SaaS companies, the questions they care about most are:

• Do you have multi-factor authentication (MFA) on email, VPN, and admin access? This is now a hard requirement at most carriers.
• Do you have endpoint detection and response (EDR) software deployed across your environment?
• How do you handle customer data — do you encrypt at rest and in transit?
• Do you have a tested incident response plan?
• Do you conduct regular backups, and are they stored offline or in an immutable format?
• Do you have privileged access management (PAM) controls for production systems?

If you can't answer yes to the first two, you'll either be declined or face significantly higher premiums. Get those in place before you apply.

The bottom line

Cyber insurance for SaaS isn't just about data breaches — it's about protecting your revenue, your customer relationships, and your ability to keep running when something goes wrong. The right policy covers first-party costs, third-party liability, Tech E&O, and cloud dependency risk in a single package.

Shop on coverage quality, not just price. A policy with a $50K dependent BI sublimit is almost useless if you run on AWS. Read the exclusions before you bind.