Most enterprise procurement teams require a minimum of $1 million per occurrence and $2 million aggregate for both tech E&O and cyber liability. Larger customers, particularly those in financial services and healthcare, frequently require $5 million or $10 million limits. A typical enterprise SaaS agreement will specify these thresholds alongside requirements for general liability and umbrella coverage.

The challenge for growing SaaS companies is that higher limits carry higher premiums, and the jump from $1 million to $5 million is not linear. You need to evaluate whether your contract pipeline justifies the spend, and whether excess layers or quota-share structures can bridge the gap at a reasonable cost.

Your customer contracts almost certainly contain mutual indemnification clauses. The insurance question is whether your policy's third-party coverage aligns with the indemnification obligations you have accepted. If you have agreed to indemnify a customer for losses arising from a breach of their data on your platform, your cyber policy's third-party insuring agreement needs to respond to that specific scenario.

Watch for gaps between what your contract promises and what your policy actually covers. A common mistake: agreeing to indemnify a customer for regulatory fines they incur because of your breach, while holding a policy that excludes regulatory proceedings or caps them under a sublimit. Bloc Cyber reviews the actual policy form, including sublimits, retentions, and waiting periods, before binding to ensure your coverage matches your contractual commitments.

When your platform stores data for 500 customers in a shared infrastructure, a breach is not one event from a liability perspective: it is 500 potential claims, each with its own notification timeline, regulatory jurisdiction, and damages calculation. Underwriters view this aggregated data exposure as systemic risk, which is why SaaS premiums run significantly higher than those for single-tenant software companies.

Your policy's aggregation clause determines whether those 500 claims count as one occurrence or many. This single provision can be the difference between a covered loss and an exhausted limit. Ask your broker how the form treats related claims and interrelated wrongful acts before you bind.

First-party business interruption coverage for SaaS companies should address both your own downtime losses and, where available, contingent business interruption for outages caused by your cloud infrastructure providers. If AWS, Azure, or GCP goes down and your platform goes with it, the waiting period and hourly sublimit in your policy form determine whether you recover anything meaningful.

Most standard forms impose 8- to 12-hour waiting periods before business interruption coverage triggers. For a platform generating $50,000 per day in recurring revenue, those hours represent real, unrecovered loss. Negotiating the waiting period down to 6 hours, or even eliminating it, is a concrete way to improve your coverage position.

Expect underwriters to ask about MFA enforcement, endpoint detection and response, encryption at rest and in transit, patch management cadence, and backup architecture. SOC 2 Type II certification is increasingly treated as a baseline, not a differentiator. Companies without it may face declinations from preferred markets or be pushed into surplus lines with higher retentions.

Your incident response plan also matters. Underwriters want to see a documented, tested plan that includes legal counsel, forensic vendors, and notification procedures. A plan that has never been tabletop-tested is, from an underwriting perspective, not a plan.

Annual recurring revenue and the volume of records under management are the two primary rating variables for SaaS cyber and tech E&O. A $5 million ARR company holding 2 million customer records will see materially different pricing than a $5 million ARR company holding 50,000 records. The record count drives breach-notification cost modeling, which is a significant component of the underwriter's loss projection.

Startups with limited revenue history may face minimum premiums that feel disproportionate to their size. That said, early-stage companies often carry the same architectural risk as larger peers, particularly if they have already onboarded enterprise customers with significant data volumes.

Do I need both tech E&O and cyber liability, or can one policy cover everything? You typically need both. Some carriers offer combined forms that bundle tech E&O and cyber, but the coverage grants are still separate insuring agreements. Review each grant individually to confirm there are no gaps.

What limits should a Series A SaaS company carry? Most Series A companies start with $1 million per occurrence / $2 million aggregate for each line. If your customer contracts require higher limits, you will need to match those requirements to close deals.

Does my policy cover regulatory fines under the CCPA? It depends on how the form is written. Some policies cover regulatory fines and penalties where insurable by law; others exclude them or cap them under a sublimit. California permits coverage for certain regulatory penalties, but the policy language controls.

Will my cyber policy respond if a breach occurs through my cloud provider? Contingent or dependent business interruption coverage may respond, but many forms impose restrictive waiting periods or exclude named cloud providers. Read the endorsements carefully.

How long does underwriting take for a SaaS company? Expect 2 to 4 weeks from completed application to bindable quote, assuming your security documentation is in order. Companies with SOC 2 reports and clean loss histories move faster.