Imagine you run a small software consultancy. One Tuesday, three separate emails land in your inbox: a client says the integration you built corrupted a week of their orders and they want you to cover the lost revenue; your own systems were breached overnight and 4,000 customer records are now in a stranger's hands; and a competitor claims the comparison chart on your homepage uses their trademarked logo without permission. Three crises, three lawyers, three very different insurance policies — and the painful question behind each one is the same: which policy actually pays?
If you carry only one of the three — technology errors and omissions (E&O), cyber liability, or media liability — at least one of those emails is coming out of your own pocket. This guide explains what each policy covers, where they overlap, where the gaps hide, and how a small tech or creative business should think about buying all three without overpaying.
The Three Policies in One Picture
All three are liability policies, meaning they pay for harm your business causes to others (plus your legal defense). But each responds to a different kind of harm:
| Policy | Answers the question | Triggering event | Typical buyer |
|---|---|---|---|
| Tech E&O | Did your professional work fail? | Bug, outage, missed deadline, breach of contract that costs a client money | Software vendors, developers, IT consultants, MSPs |
| Cyber liability | Were systems or data attacked? | Breach, ransomware, funds-transfer fraud, privacy violation | Any business that stores data or runs on computers |
| Media liability | Did your content harm someone? | Defamation, copyright or trademark infringement, advertising injury | Agencies, publishers, creators, any business that advertises |
The short version: E&O covers what you did wrong, cyber covers what was done to you (and the data fallout), and media covers what you published. Now the details that decide real claims.
Tech E&O: When Your Work Product Is the Problem
Technology E&O — sometimes called tech professional liability — covers claims that your technology product or service failed to perform as promised and cost your client money. The classic triggers are software bugs, failed implementations, missed deadlines, negligent advice, and breach of contract.
Picture a freelance developer whose invoicing-system migration double-bills a client's customers, or an MSP whose misconfigured backup leaves a client unable to recover after a server failure. The client sues for the financial loss your work caused. That is an E&O claim: nobody hacked anyone, no data was stolen — your work simply did not do what you said it would.
Three things to understand about tech E&O:
It is the policy your enterprise clients will demand. Most vendor contracts and master service agreements require proof of E&O coverage, often at limits of $1 million per claim and $2 million aggregate, before you can sign. If you sell into larger companies, E&O is not optional — it is a cost of being allowed in the room.
It covers economic loss, which general liability does not. A standard general liability policy covers bodily injury and property damage, not a client's lost profits because your code failed. Business owners who assume their general liability or business owner's policy covers professional mistakes discover the gap only when a claim is denied.
Defense costs can erode your limits. Many E&O policies pay legal defense out of the same limit that pays settlements, so a $1 million policy with $300,000 in defense bills has $700,000 left for the actual claim. When comparing quotes, ask whether defense is inside or outside the limits — outside is meaningfully better coverage at the same face amount.
If you build, integrate, host, advise on, or manage technology for clients, tech E&O is your foundation policy. Everything else layers on top of it.
Cyber Liability: When the Attack Reaches You
Cyber liability covers the costs of responding to and recovering from a cyber incident — plus lawsuits blaming you for one. It has two halves:
First-party coverage pays your own incident costs: forensic investigation to find out what happened, legal guidance on breach-notification duties, customer notification and call-center costs, credit monitoring, ransomware negotiation and payment, data restoration, lost business income during downtime, and funds-transfer fraud when a spoofed email tricks someone into wiring money to criminals.
Third-party coverage pays when others sue you over the incident: customers whose data was exposed, regulators pursuing fines and penalties (where insurable), and payment-card brands assessing costs after card data is compromised.
The numbers explain why this policy exists. Small businesses pay an average of roughly $130 to $145 per month for cyber coverage — about $1,500 to $1,750 a year — while a single breach involving customer records can cost a small business anywhere from $120,000 into seven figures to investigate and resolve. A few years of premiums cost less than one uninsured incident, and only an estimated 10 to 20 percent of small and midsize businesses carry the coverage at all.
Note what cyber does not do: it does not cover the claim that your software was badly written. If your client's data leaks because of a vulnerability in code you shipped, your client's lawsuit against you for professional negligence goes to your tech E&O — while your own forensics and notification costs go to your cyber policy. One incident, two policies, two different bills. This is the single most misunderstood split in tech insurance, and the reason technology businesses typically need both.
Media Liability: When Your Content Is the Problem
Media liability — a form of E&O written for publishing risks — covers claims arising from content you create or distribute: defamation and disparagement, copyright and trademark infringement, invasion of privacy, plagiarism, and false advertising.
You do not need to be a media company to need it. Any business that publishes blog posts, runs ads, posts on social media, sends marketing email, or puts comparison pages on its website is publishing. A stock photo used beyond its license terms, a case study that quotes a client who never approved it, a social post that repeats an unverified claim about a competitor — each is a media claim waiting for the wrong reader.
Two misconceptions leave businesses exposed here:
"My general liability covers advertising injury." Partly, and that is the trap. Commercial general liability policies include a limited personal-and-advertising-injury section, but it is narrow, capped at the policy's modest limits, and written for slip-and-fall businesses that occasionally advertise — not for businesses whose content is the product. Agencies, publishers, developers with content-heavy marketing, and anyone doing comparative advertising routinely outgrow it. Media liability is the purpose-built replacement.
"Copyright claims only happen to big publishers." Automated image-licensing enforcement and trademark policing have made small-business demand letters routine. A single unlicensed image can produce a settlement demand several times the cost of an annual media endorsement, and defense against even a meritless defamation claim runs deep into five figures.
For many small businesses, media liability arrives as an endorsement on a tech E&O or cyber policy rather than a standalone purchase — which is convenient, but means you should check the sublimit. A $25,000 media sublimit inside a $1 million E&O policy is not $1 million of media coverage.
Where the Lines Blur (and the Gaps Open)
Real incidents rarely respect policy boundaries. The dangerous overlaps cluster in three places:
Your code causes your client's breach. As noted above, the client's negligence lawsuit hits your tech E&O while your incident-response costs hit your cyber policy. If you carry only one, half the incident is uninsured. Technology businesses should treat E&O-plus-cyber as a pair, ideally from one carrier on a combined tech E&O/cyber form so the two halves cannot point fingers at each other over which coverage applies.
Your website content triggers both media and cyber. A defamatory blog post is a media claim; the same post exposing private customer data adds a privacy-liability element that may fall under cyber. Combined forms handle this more gracefully than separate policies with separate exclusions.
Contractual liability exceeds the policy grant. Your client contract may promise indemnification, warranties, unlimited liability, or specific security standards. E&O policies cover some assumed-by-contract liability and exclude the rest, and cyber policies often exclude failure to maintain promised security controls. Read the contract requirements against the policy exclusions before you sign the client deal, not after the claim.
And one structural trap spans all three policies: they are almost always claims-made, not occurrence-based. A claims-made policy covers only claims first made while the policy is active (plus an optional tail period). Let coverage lapse, and work you did for years is suddenly uninsured against claims filed tomorrow. When switching carriers, preserve your retroactive date — the backward-looking start of covered work — or you buy a gap with your new policy. Never let a claims-made policy lapse without buying tail coverage if you might ever be sued for past work.
How Much Coverage Costs and How to Buy It
Premiums vary with revenue, headcount, industry, data volume, limits, and claims history, but small-business benchmarks cluster usefully:
- Cyber liability: roughly $130 to $145 per month for a small business, or about $1,500 to $1,750 per year, with annual premiums ranging from a few hundred dollars for minimal data exposure to $8,000 or more for data-heavy firms.
- Tech E&O: typically $500 to $2,000 per year for solo developers and micro-firms at $1 million limits, rising with revenue and contract requirements. A small IT consultancy bundling general liability, E&O, cyber, and employment-practices coverage often lands between $3,500 and $5,000 a year all-in.
- Media liability: frequently cheapest as an endorsement — often a few hundred dollars a year added to E&O or cyber — with standalone policies for publishers and agencies running higher.
Five buying rules keep the spend efficient:
- Bundle tech E&O and cyber with one carrier. Combined forms cost less than separate policies and eliminate the finger-pointing gap when one incident triggers both.
- Match limits to your contracts, not your comfort. If your three biggest clients require $2 million aggregate, that is your floor regardless of what feels like enough.
- Protect the retroactive date. Get full prior-acts coverage or, at minimum, a retroactive date matching your first day in business, and carry it forward at every renewal and carrier switch.
- Document your security controls before you apply. Multi-factor authentication, encrypted backups, endpoint protection, and an incident-response plan are increasingly underwriting requirements for cyber — and the same controls earn better premiums.
- Read the exclusions for your actual risks. Prior-knowledge exclusions, broad professional-services exclusions inside cyber forms, and sublimited media endorsements are where cheap policies hide their cheapness.
Keep the Premiums (and the Paper Trail) in Your Books
Insurance is one of the few business expenses that is both fully deductible and frequently misbooked. Premiums for business liability coverage — E&O, cyber, media, general liability — are ordinary and necessary business expenses, deductible in the year paid. But a single "Insurance" ledger account hiding every policy invites two problems: you cannot see which coverage costs what at renewal time, and you cannot prove a loss history cleanly when an underwriter or auditor asks.
Better practice is a dedicated sub-account per policy — something like Expenses:Insurance:Tech-EO, Expenses:Insurance:Cyber, Expenses:Insurance:Media — so each renewal quote lands against its own history and premium trends are visible year over year. If you use plain-text accounting, hierarchical account names give you this structure for free; the Beancount documentation on getting started shows how account hierarchies organize themselves without any chart-of-accounts maintenance.
The same discipline applies to incident costs. Deductibles, uncovered legal bills, forensics, notification vendors, and credit-monitoring subscriptions should be tagged to the incident — a dedicated project tag or sub-account per event — so you can report the full loss to the carrier, substantiate the deduction, and, just as important, see what the incident really cost when you decide next year's limits. Businesses that scatter incident spending across generic accounts consistently underestimate their true exposure and underbuy limits the following year.
Finally, calendar your retroactive dates and renewal dates alongside your month-end close checklist. A lapsed claims-made policy is a bookkeeping failure with insurance consequences: the books look fine, right up until the uncovered claim arrives.
Protect the Business You Are Building
Your code, your systems, and your content are three different risk surfaces, and no single policy covers more than its own. If you sell technology work, start with tech E&O, pair it with cyber liability from the same carrier, and make sure your publishing — the blog, the ads, the comparison pages — is covered by a real media grant rather than the thin advertising-injury clause in your general liability. Match limits to your client contracts, guard your retroactive date, and keep every premium and incident cost where your books can find it.
Maintaining clear financial records is what turns insurance from a stack of PDFs into a managed business function. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
