Industry Insight
Technology companies are responsible for 30%+ of all downstream cyber incidents — making third-party liability critical.
Why Tech Businesses Need Cyber Insurance
Technology businesses carry the highest cyber risk of any sector. As custodians of client systems and data, a breach can trigger cascading third-party liability. Software vulnerabilities, open source dependencies and cloud misconfigurations all increase exposure. Cyber + Tech E&O combined cover is typically recommended.
Top Cyber Risks for Tech Businesses
- !Client system breach via your software
- !Cloud infrastructure compromise
- !Source code theft
- !DDoS attacks on services
- !Third-party software dependency attacks
Recommended Coverage for Tech Businesses
Typical Premium Range
Premiums vary based on revenue, data held, security controls in place, and coverage limits selected. Our brokers will find the best rate for your specific profile from multiple insurers.
Technology Companies: The Highest-Risk Cyber Profile
Technology companies face a unique and particularly complex cyber risk profile. Unlike most businesses where cyber risk is primarily about protecting their own data, tech companies also face the risk that their products, platforms or services could be used as the vector through which criminals attack their clients. This downstream liability — sometimes called "technology professional liability" or "Tech E&O" — can result in catastrophic claims when a software vulnerability or service failure affects hundreds or thousands of clients simultaneously.
Software Vulnerability and Tech E&O
If a vulnerability in software you develop or distribute allows criminals to breach a client's systems, your business may face significant liability. Tech E&O (Errors and Omissions) cover is specifically designed to respond to these claims — covering your legal defence costs and damages arising from a software or service failure that causes third-party loss. Cyber insurance and Tech E&O are often combined in a single specialist policy for technology companies.
Open Source Dependency Risk
Modern software development relies heavily on open source components and third-party libraries. The Log4Shell vulnerability of 2021 demonstrated how a single widely-used open source library can create simultaneous vulnerabilities across millions of applications. NZ tech companies that incorporate open source components into their software products face ongoing exposure from vulnerabilities discovered in those dependencies — even if their own code is perfectly secure.
Cloud Infrastructure and Misconfiguration
Cloud misconfigurations — accidentally making storage buckets or databases publicly accessible — are one of the most common sources of data breaches for technology companies. AWS, Azure and Google Cloud environments provide powerful tools, but their complexity means that misconfigurations are easily made and can expose large volumes of client data before the error is detected. Cloud security posture management has become a standard expectation in cyber insurance underwriting for technology companies.
SaaS Platform and Multi-Tenant Risk
Software-as-a-Service companies face a particularly concentrated risk: a single security breach of their platform infrastructure can simultaneously affect all of their clients. This multi-tenant risk makes SaaS providers among the highest-risk tech sub-sectors for cyber insurers, and premiums reflect the potential scale of third-party liability claims arising from a platform breach.
Cyber + Tech E&O Combined Cover
NZ technology companies should hold a combined cyber + Tech E&O policy that addresses both their own data breach and business interruption losses, and the downstream third-party liability arising from software or service failures. A single integrated policy avoids the coverage disputes that can arise when separate insurers each argue the other's policy should respond first. Our specialist brokers have experience placing combined tech cover for NZ companies of all sizes.
Written by the CyberCover Advisory Team
Licensed NZ insurance advisors specialising in cyber risk for New Zealand businesses. All content reviewed for accuracy and NZ regulatory compliance.
Last updated: May 2026 · Get personalised advice →
Frequently Asked Questions
What is the difference between cyber insurance and Tech E&O?
Cyber insurance covers losses from data breaches and network security failures. Tech E&O covers liability arising from failures in the technology products or services you provide to clients. Most NZ tech companies need both — and many specialist policies combine them in a single product.
Does cyber insurance cover a vulnerability discovered in our software?
The cost of fixing a discovered vulnerability and notifying affected users may be covered under some policies. Client claims arising from damage caused by the vulnerability are addressed by Tech E&O cover. Check whether your policy covers notification costs and remediation when a vulnerability is discovered, not just after an exploit occurs.
Are open source components we use covered under our policy?
If a breach occurs through a vulnerability in an open source component incorporated into your software, your cyber and Tech E&O policies will respond to the resulting claims. The fact that the vulnerability was in third-party code does not generally eliminate your liability to affected clients.
What cyber controls do underwriters require for tech companies?
Technology companies typically face more stringent underwriting requirements than other sectors: MFA on all systems is usually mandatory; evidence of secure development practices (SDLC), penetration testing, and cloud security monitoring is expected. Companies with SOC 2 or ISO 27001 certification may qualify for better terms.