Cyber insurance for a small software company: what the application asks and what a policy pays
The questions on a 2026 cyber application in the carriers' own words (MFA, offline backups, EDR, 30-day patching, payment callbacks), the case where one wrong MFA answer voided a policy, what each cover pays with three claims worked through, the exclusions that bite, median premiums for small tech firms ($179 a month for cyber, $110 for tech E&O) and how the policy has to match your customer contracts.
The first time most small software companies think about cyber insurance is when a customer's contract asks for it. A hospital wants $5 million of technology errors and omissions cover including cyber liability, with the hospital named on the policy and a certificate within ten business days. The founder calls a broker, gets an application of forty-odd questions, and has to answer them by Friday.
Those answers matter more than the premium. The application becomes part of the policy, and a wrong "yes" can void it after a claim. This piece goes through what the 2026 applications ask, in the carriers' own words, what each part of a policy pays, the exclusions that catch small firms, what small tech companies actually pay, and how the policy has to fit the contracts you sign.
What the application asks
Cyber applications have grown from 20 or 30 yes-or-no questions before 2022 to 40 to 60 now. The questions below are from forms the carriers still publish: Travelers' CyberRisk application and its MFA and social engineering supplements, Coalition's US application and CFC's US private enterprise form. Chubb, At-Bay, Beazley and Cowbell mostly quote through broker portals, but they ask the same things.
CFC also asks for your Microsoft Secure Score if you use Office 365. That's a useful hint: underwriters increasingly want evidence (screenshots, scan results) rather than a tick.
Why one wrong answer can cost the whole policy
Coalition's signature block says it plainly: "If a policy is issued, this application will attach to and become part of the policy", and the insurer "reserves the right to rescind the policy." That isn't theoretical. In 2022 an Illinois electronics firm, International Control Services, suffered ransomware a few weeks after Travelers issued a $1 million cyber policy. Its application said multi-factor authentication protected administrative and remote access; in fact only the firewall had it. Travelers sued to rescind, the firm agreed, and the court declared the policy void from the start. The company got nothing, not even defence costs.
The practical rule: answer for what is true on the day you sign, not for what you plan to switch on next month. If MFA is missing on one admin console, say so and fix it before the policy starts; brokers can usually update an answer before binding.
What a policy pays
A cyber policy is a bundle of separate covers, each with its own limit (often a sublimit inside the main one). Travelers' application lists sixteen. For a small software company the ones that matter fall into two groups:
Two terms change what you actually receive. Policies are usually written "defence within limits": Travelers' wording says the limit "may be completely exhausted, by amounts paid as defense costs." A $1 million policy that spends $400,000 on lawyers has $600,000 left for damages. And business interruption needs both the waiting period and the money retention to be passed before it pays.
Three claims, worked through
An invoice redirect. A customer's "accounts team" emails new bank details; you pay a $180,000 invoice to the fraudster. With a $250,000 social engineering sublimit and a $2,500 retention, the policy pays $177,500. If you report within 72 hours, Coalition lowers the retention on funds transfer fraud, and the bank may claw some back: Coalition recovered $21.8 million for policyholders in 2025, $202,000 on average where it succeeded.
Two invoice redirects. In Perry & Perry Builders v. Cowbell Cyber (W.D. Texas, March 2026), a builder lost $874,863.70 across two fraudulent ACH payments. The policy's cyber crime limit was $250,000 per claim; the insurer paid $250,000 and the court held the second payment did not open a second limit. Uninsured loss: $624,863.70. The sublimit, not the headline limit, is the number to read.
A 30-hour outage of a small SaaS. Revenue is $1.2 million a year, about $137 an hour ($1,200,000 / 8,760). With an 8-hour waiting period, business interruption pays 30 - 8 = 22 hours, so about $3,000 of lost revenue before the retention. For a small subscription business, the loss of revenue during the outage is rarely the big number. What costs money is the forensics, the lawyer, the customer credits under your SLA (often excluded as "contractual penalties") and the customers who sue.
What claims cost in 2025
Two things stand out for a software company. Ransomware hits technology firms harder (At-Bay's tech average is 72% above its overall figure), because restoring production systems and customer data takes longer. And the commonest claim isn't ransomware at all but money sent to the wrong account after someone read a mailbox, which is why the funds transfer questions and the sublimit deserve as much attention as the MFA ones.
The exclusions that bite
- Contract liability. "The Insurer will not pay Loss arising out of liability assumed by an Insured" (Travelers). If your contract promises to indemnify the customer for anything beyond what the law would make you pay anyway, that extra promise isn't covered. Breach notification costs, PCI assessments and privacy-policy obligations are carved back in; uncapped indemnities and service credits are not.
- War and state-backed attacks. Since 31 March 2023 every Lloyd's cyber policy must carry a state-backed cyber attack exclusion (Lloyd's Market Bulletin Y5381, model clauses LMA 5564-5567), on top of a war exclusion. The fear comes from NotPetya: Merck claimed $1.4 billion and Mondelez about $100 million under property policies whose war exclusions their insurers invoked. New Jersey courts ruled Merck's war exclusion didn't reach a cyberattack, and Mondelez settled in the middle of its trial in October 2022; Merck settled in January 2024. Cyber wording now names state-backed attacks so that argument can't be had again.
- Unpatched software. Chubb's neglected software endorsement gives 45 days to patch a published CVE; after that, more of the loss shifts to you at 45, 90, 180 and 365 days. End-of-life software is treated the same way by several carriers.
- Things you already knew about. Anything an officer knew before the policy began is out.
- Infrastructure. An outage at your cloud provider, internet provider or power company isn't covered unless the system is under your control; dependent business interruption cover, if you bought it, is what responds to a provider's outage.
- Insiders with passwords. Travelers excludes fraudulent instructions sent by anyone who "ever had authorized access" to your passwords.
- AI. New in 2026: Beazley and QBE are drafting AI sublimits of about 10% of the policy limit (QBE's example: a $5 million policy paying about $250,000 for unauthorised use of AI systems), and W.R. Berkley has an absolute AI exclusion on its E&O products. Ask what your wording says if your product calls a model.
What small tech firms pay
Insureon's most common tech E&O policy has a $1 million per claim and $1 million aggregate limit with a $2,500 deductible; 51% of its buyers choose that, 15% choose $2 million and 11% choose $5 million. A $5 million requirement in a customer contract therefore moves you well above the median.
Prices are falling. Marsh's index shows US cyber rates down 3% in Q4 2025 and 2% in both Q1 and Q2 2026, the twelfth quarter in a row of global declines, and CFC says some small-business rates are close to 2019 levels. Only about 24% of US small businesses carry cyber cover at all (Morning Consult survey cited by Insurance Business, September 2026). If you were quoted in 2023, ask again.
Making the policy fit your contracts
Enterprise buyers publish what they want. Houston Methodist asks software and SaaS vendors for "Technology Errors & Omissions including Cyber Liability with minimum limits of $5,000,000 each claim", covering network security, privacy and privacy regulation fines, with the hospital as additional insured, a waiver of subrogation and an insurer rated A.M. Best A- VIII or better. Adobe ties the limit to the vendor's size: $5 million per occurrence for vendors up to $250 million revenue, $10 million up to $1 billion, $15 million above, and may withhold payment while a vendor is out of compliance.
Read the insurance clause and the liability clause together:
1. Match the limit to the cap. If the contract caps your liability for a data breach at 3x annual fees (a "super cap"), make sure your cyber and E&O limits reach that figure. A cap above your cover is money you pay yourself.
2. Strike indemnities the policy won't pay. The assumed liability exclusion means an indemnity broader than your legal liability is uninsured. Narrow it to third-party claims caused by your breach of the contract.
3. Ask before you agree to "additional insured". Many cyber forms can add a customer by endorsement, but not all; your broker can confirm in a day. Do it before you sign.
4. Keep cover after the contract ends. Policies are claims-made: the policy in force when the claim arrives pays. If a contract says cover must continue for two years after termination, keep renewing or buy an extended reporting period.
5. Send the certificate on time. ACORD certificates come from your broker; Houston Methodist wants one within 10 business days, Adobe within 7.
Our piece on the first enterprise contract goes through the liability and indemnity clauses in more detail.
Before you fill it in: an afternoon of fixes
Most of the answers that change the price are cheap to fix before you sign:
1. Turn on MFA for email, every admin console (cloud, domain registrar, code hosting, backups) and any remote access. Phishing-resistant keys for admins if you can.
2. Keep one backup copy where ransomware can't reach it (a separate account with its own MFA, or immutable storage), and restore something from it. Write down the date.
3. Put EDR on every laptop and server; most small firms use what comes with Microsoft 365 Business Premium or a standalone product.
4. Write a patch rule: critical patches within 14 days, everything within 30. List any end-of-life software and isolate it.
5. Adopt a callback rule for payments: any new or changed bank details are confirmed by phone, using a number you already had. Two people approve transfers above an amount you set.
6. List every incident of the last three years, even small ones nobody claimed for.
7. Ask for cyber and tech E&O from the same carrier, so a claim that is half software failure and half breach doesn't fall between two policies.
8. Read the sublimits page: social engineering, business interruption waiting period, regulatory fines, and any AI wording.
Most of these overlap with what a customer's security questionnaire asks; our guide to the security questionnaire covers which answers a five-person company can honestly give.
Check where you stand before the broker's questions arrive: 25 baseline security controls (MFA, backups, patching, incident response and more) as yes-or-no questions, with what to fix first. Runs in your browser.
Open the security baseline checkSources
Application forms: Travelers CyberRisk applications and supplements (CYB-14102 Ed. 01-19, CYB-14306 Rev. 03-23, CYB-14301; read 23 Oct 2026); Travelers CyberRisk policy form CYB-16001; Coalition US cyber application; CFC cyber application, US v25; HeroDevs on application length and end-of-life software (2026).
Cases and exclusions: Reed Smith on Travelers v. International Control Services (Jul 2022); Perry & Perry Builders v. Cowbell (2026); Lloyd's Market Bulletin Y5381 (Aug 2022); Business Insurance on the Merck settlement (Jan 2024); The Register on Mondelez v. Zurich (Nov 2022); Chubb cyber products and neglected software (read 23 Oct 2026); AI sublimits at Beazley and QBE (Apr 2026); Hunton on AI exclusions.
Claims and prices: Coalition 2026 Cyber Claims Report (Mar 2026); Coalition on funds transfer fraud; At-Bay 2026 InsurSec Report (Apr 2026); Insureon cyber cost (Apr 2026), tech insurance cost (May 2026) and waiting periods; EPIC on cyber business interruption (Oct 2023); FinTech Global on Amwins Cyber+ (Nov 2025); Marsh Global Insurance Market Index Q2 2026 and Q4 2025; Insurance Business on falling cyber rates (Sep 2026).
Contract requirements: Houston Methodist IT insurance requirements (2023); Adobe vendor insurance requirements (2018). This article explains how policies commonly work; your own wording and your broker decide what yours covers.