The short answer
A $5M Tech E&O and cyber requirement may be met by a single policy or by primary and excess layers, depending on carrier capacity. Check whether the contract asks for separate or shared limits, and review sublimits and exclusions. Pricing and timing examples below are illustrative; underwriting determines the actual offer and when each layer can bind.
Use this guide to prepare questions, not to establish coverage. Any unsourced costs, limits or timing ranges are illustrative planning examples, not quotes, verified market averages or carrier commitments.
What a $5M Tech E&O and cyber requirement means, line by line
| Contract wording | What satisfies it |
|---|---|
| Technology errors and omissions, $5M | Tech E&O at $5M: covers customer losses when your product fails |
| Network security and privacy (cyber), $5M | Cyber liability at $5M: covers claims after a breach |
| Incident or breach response | First-party cyber: forensics, legal, notification |
| Ransomware or cyber extortion | Extortion coverage; check for a sublimit |
| “Separate limits” | Two dedicated limits; one shared $5M falls short |
| Coverage for 3 years after termination | Keep renewing, or buy an extended reporting period (tail) |
| Retroactive date on or before contract start | Never let the retroactive date reset when you switch carriers |
Most startups buy E&O and cyber as one combined policy: one application and a lower price. The trade-off is a shared limit, so one large breach can use up what would pay an E&O claim. For how claims-made Tech E&O works in general, see Tech E&O coverage for startups. General liability lines in the same exhibit work differently; see what a $1M/$2M general liability requirement means.
How to build $5M: primary plus excess
Few carriers write a $5M primary policy for an early-stage company, so most programs stack layers. Excess pays only after the layer below it is used up.
| Structure | Best fit |
|---|---|
| $5M primary | Larger companies with clean controls |
| $3M primary + $2M excess | Most Series A SaaS companies |
| $2M primary + $3M excess | Seed to Series A |
| $1M primary + $4M excess | Hardest to place; many excess carriers want $2M underneath |
Excess does not raise sublimits. A $500,000 ransomware sublimit in the primary policy stays $500,000 in a $5M tower. If the contract requires full-limit ransomware coverage, fix it in the primary.
Cyber sublimits to check before you certify $5M
| Coverage | Typical startup primary | Risk to the contract |
|---|---|---|
| Incident response | Full limit | Low |
| Ransomware and extortion | Full limit, or $250K to $1M | High if the contract names ransomware |
| Your own business interruption | Full limit after an 8 to 12 hour wait | Rarely named |
| Social engineering fraud | $100K to $250K | Rarely named |
The steps before a $5M program is in place
| Step | What needs to happen |
|---|---|
| Application | Provide operations, revenue, contracts, security information and disclosures |
| Primary review | Resolve questions and compare offered coverage, exclusions and sublimits |
| Excess review | Confirm each layer’s terms, attachment and underlying-policy requirements |
| Binding and evidence | Complete the carrier’s requirements and obtain written coverage confirmation before issuing evidence |
If the deadline is too tight, ask counsel and the customer whether an extension is possible. No fixed number of days is guaranteed for a new placement.
What underwriters ask before quoting Tech E&O and cyber
- Revenue, and your largest contract’s value
- What your product does, and what a customer loses in a one-day outage
- Data you hold: types (PII, health, payment) and record count
- MFA on email, remote access and admin accounts
- Endpoint detection (EDR) and offline backups you have test-restored
- SOC 2 status, standard contract terms and any prior incidents
Missing or incomplete security controls can affect eligibility or terms; each carrier sets its own underwriting requirements.
How much $5M Tech E&O and cyber costs a startup
There is no universal multiplier from $1M to $5M. The following figures are illustrative budgeting examples; primary and excess carriers price the actual risk and wording.
| Company | $1M combined, annual | $5M program, annual |
|---|---|---|
| Under $1M revenue, no sensitive data | $1,500 to $4,000 | $5,000 to $12,000 |
| $1M to $5M revenue B2B SaaS | $4,000 to $9,000 | $12,000 to $27,000 |
| $5M to $20M revenue, holds PII | $9,000 to $20,000 | $27,000 to $60,000 |
Illustrative annual budgeting ranges, not quotes or measured placement averages. Actual pricing requires underwriting; taxes and fees may be additional. Health or financial data can change the underwriting questions and available terms. See startup insurance cost by funding stage.
When to ask the customer to lower the $5M requirement
Ask counsel whether the requirement fits the transaction and what changes, if any, to discuss with the customer. Topics can include:
- Match the limit to the contract value or your liability cap
- Accept a combined E&O and cyber limit
- Accept a ransomware sublimit
- Step the limit up as the contract grows
Who can place $5M Tech E&O and cyber
StartupInsurance.ai can help explore primary and excess options and compare the offered wording with the insurance requirements you provide. A higher limit does not remove exclusions or guarantee that a particular claim is covered. See our coverage and placement guide and insurance buying-model comparison.
Get a contract check
Send us the insurance exhibit, your revenue and your deadline. We provide an initial written review within one business day after receiving the necessary information, with questions and next steps. Carrier quotes, coverage decisions and policy changes may take longer. Get a free contract check.
A few more answers
Frequently asked questions
Can I get $5M Tech E&O and cyber insurance in 24 hours?
Do not rely on that deadline before underwriting. The carrier must approve the risk and terms, and any excess layers have their own requirements. Send the complete requirement and application early so the team can assess what is feasible.
Does a combined Tech E&O and cyber policy satisfy a contract that lists them separately?
Only if the contract allows combined limits. If it says "separate limits," one shared $5M falls short. Buy separate limits, or ask the customer to accept a combined limit in the redline.
What does $5M Tech E&O and cyber typically cost a seed-stage SaaS company per year?
The table uses a $5,000–$12,000 annual budgeting example for a company under $1M in revenue. It is not a measured market average or quote. Limits, data, operations, controls and terms determine the actual price.
What is a retroactive date, and why does my customer care?
It is the earliest date of work a claims-made policy covers. Customers want it on or before the contract start so claims about early work are covered. Keep it when you switch carriers; a reset leaves a gap.
Does Tech E&O cover breach of contract claims?
It depends on the allegation and wording. Contract-related claims may fall within or outside covered professional services, and contractual-liability exclusions can matter. A contract check is not a coverage determination for a future claim.
Do I need SOC 2 to get cyber insurance?
Requirements vary by insurer and risk. Carriers may ask about SOC 2 and controls such as MFA, endpoint protection and backups. A certification or a control checklist does not by itself guarantee eligibility or favorable pricing.
Can my customer be an additional insured on my Tech E&O policy?
Availability and scope vary. Do not promise this status or substitute a waiver without checking the offered policy and the customer’s agreement. See endorsement considerations.
General information, not a coverage determination or legal advice. Unless a specific source is identified, prices and timing ranges are illustrative planning examples—not measured market averages, quotes or guarantees. Policy wording, carrier, state and your company’s operations determine what applies.