A seed round should buy tech errors-and-omissions (E&O) and cyber insurance together first, usually at $1M limits. Buy at the first paying customer or when you start holding customer data.
Tech E&O covers product failure that costs a customer money. Cyber insurance covers the security event itself, including forensics, notification, restoration, interruption and extortion. Risklytics describes this paired $1M purchase as the practical starting point, not a full program at formation, in its startup insurance checklist.
Table of Contents
- What does each half pay for?
- Why do enterprise deals demand it?
- Why is basic business coverage not enough?
- What must you fix before you bind?
What does each half pay for?
IMD Insurance explains the split: tech E&O pays when your product fails and causes client loss, while cyber pays for the incident response itself. A missed bug that shuts down a customer's checkout is E&O. The forensic work, customer notices, system restoration and extortion talks are cyber.
The Insurance Information Institute divides cyber further into first-party and third-party protection. First-party covers your own costs for response, interruption and recovery. Third-party covers lawsuits from customers and actions by regulators after the event.
Why do enterprise deals demand it?
First enterprise contracts typically require $1M–$2M each of tech E&O and cyber, plus $1M per-occurrence general liability. IMD Insurance identifies that bundle as a common deal requirement in its guide for startups.
That makes the bundle a sales tool, not just risk cover. A seed team can answer security review faster with certificates ready. Without those limits, procurement can stall a paid pilot.
Why is basic business coverage not enough?
The Insurance Information Institute notes a standard Business Owners Policy covers only limited cyber events. A startup that needs breach, interruption, extortion and liability protection needs a standalone cyber policy.
Small firms face outsized ransomware risk. Verizon's DBIR analysis, reported by Infosecurity Magazine, found ransomware in 44% of studied breaches and in 88% of SMB breaches, with a $115,000 median payment, in its 2025 breach coverage. IBM's 2025 report put average breach cost at $4.44M globally and $10.22M in the U.S.
What must you fix before you bind?
IMD Insurance warns that insurers treat MFA, backups and application answers as warranties. A seed startup should fix controls before binding.
A gap found after a claim can reduce or deny payment. Bind only after those controls are live and documented.
- Turn on MFA for email, cloud, code and admin access
- Keep tested, offline backups for code and customer data
- Match the application exactly to deployed tools and practices
- Save proof of MFA, patching and backup tests