Cyber & Tech E&O · Startups
Cyber insurance for startups: what it covers, when you need it and what it costs
Cyber insurance for startups pays the forensic, legal, notification, ransomware and recovery costs of a security incident, plus the privacy claims and regulatory proceedings that follow, and it is the policy investors, lenders and enterprise customers ask to see before they sign. Startups pay a median of roughly $2,900 a year, and most pay between $1,000 and $8,800 (Vouch, 2026).
Reza Azar · Senior Insurance Broker · OnePark Risk
Last updated October 19, 2026
The short answer (as of October 2026)
- What it covers: your own incident costs (forensics, breach counsel, notification, ransomware response, data restoration, lost income) and your liability to customers, partners and regulators for the failure.
- When you need it: the first time you store customer records, sign an enterprise MSA with insurance requirements, take payments, ship AI features on customer data, or answer an investor or lender diligence request.
- What it costs: a median of roughly $2,900 a year, with most startups paying between $1,000 and $8,800 (Vouch, 2026). Limits, revenue, data and security controls decide where you land.
- Why it is usually combined with Tech E&O: for a software company the same breach is both a security failure and a product failure, so carriers write the two together on one form with one retention.
What is cyber insurance for startups?
Cyber insurance for startups is a policy that pays the costs of a security or privacy incident: the forensic, legal, notification and recovery bills you face directly, and the claims that customers, partners and regulators bring against you afterward. It is written for companies that hold data, run software or take payments, at any stage.
Policies are modular: each insuring agreement carries its own limit, and ransomware and social engineering often sit under lower sublimits. Read the schedule before you bind.
First-party coverage
First-party agreements pay your own costs after an incident, whether or not anyone sues you:
- Incident response: breach counsel, forensics and crisis communications.
- Notification and credit monitoring: the letters, call center and monitoring that breach laws and contracts require.
- Cyber extortion: negotiation, and the ransom where payment is legal and the carrier consents.
- Data and system restoration: rebuilding data and systems from backups or from scratch.
- Business interruption: lost income and extra expense while your systems, or a cloud provider you depend on, are down.
- Funds transfer fraud and social engineering: money moved by a spoofed invoice or a compromised mailbox, usually sublimited.
Third-party coverage
Third-party agreements defend and settle the claims others bring because of the incident:
- Network security and privacy liability: claims from customers, partners or individuals whose data or systems were exposed through yours.
- Regulatory proceedings: defense costs and, where insurable, fines under state privacy laws or HIPAA.
- PCI assessments: card-brand assessments after a payment-card incident, where endorsed.
- Media liability: defamation and intellectual-property claims from content you publish.
Cyber insurance vs Tech E&O
Cyber insurance responds to a security or privacy failure; Tech E&O responds when your product fails to perform and a customer holds you financially responsible. An outage caused by a breach can trigger both, which is why carriers write them together for software companies. Our guide to Tech E&O vs cyber liability draws the line claim by claim.
When does a startup need cyber insurance?
A startup needs cyber insurance the first time someone outside the company can hold you responsible for a security failure: the first customer record you store, the first enterprise contract that names insurance requirements, the first investor diligence list, the first payment you process. Buying before the trigger is cheaper and faster than buying under deal pressure.
| Trigger | Why it matters | What to do |
|---|---|---|
| You store PII or PHI | Breach-notification laws and HIPAA apply the day the data lands | Size first-party limits to the records you hold |
| Your first enterprise MSA or security questionnaire | Procurement wants a certificate naming cyber limits before signature | Buy the limit the contract names |
| An investor or lender asks | Diligence lists and loan covenants increasingly require proof of cyber and D&O | Bind before the closing checklist |
| You take payments | PCI assessments follow a payment-card incident | Confirm PCI coverage is endorsed |
| You ship AI features on customer data | Training and inference on customer data widen the privacy and contract exposure | Disclose the use case in the application |
Enterprise contracts are the most common forcing function; our guide to insurance requirements in enterprise contracts explains how to read the clause.
What startup cyber insurance covers and excludes
A startup cyber policy covers the direct costs of responding to an incident and the liability that follows it, within the limits and sublimits on the declarations page. It excludes incidents you already knew about, bodily injury and property damage, improvements to your systems, and losses that stem from war or from failures of infrastructure you do not control.
| Typically covered | Typically excluded or limited |
|---|---|
| Forensics, breach counsel and crisis communications | Incidents or circumstances known before the policy started |
| Notification, call center and credit monitoring | Losses on unpatched or end-of-life systems, where the policy imposes security conditions |
| Ransomware negotiation and payment where legal | Betterment: upgrading systems beyond their pre-incident state |
| Data and system restoration | Bodily injury and property damage |
| Business interruption and extra expense | War, and failures of power, internet or other infrastructure you do not control (wording varies) |
| Funds transfer fraud and social engineering (sublimited) | Contractual penalties beyond what you would owe at law, unless endorsed |
| Privacy and network security liability | Intentional or criminal acts by the insured |
Two exclusions deserve a closer read. Some policies condition coverage on maintaining the controls you declared in the application, so a lapsed MFA rollout can become a coverage argument after a loss. And contractual liability wording decides whether the service credits in your MSAs are covered or carved out.
How much does cyber insurance cost a startup?
Startups pay a median of roughly $2,900 a year for cyber insurance, and most pay between $1,000 and $8,800 (Vouch, 2026). Established small businesses report a median closer to $129 a month (Insureon, 2025), but startups buy higher limits, hold more sensitive data and answer enterprise contract requirements that push their premiums above that line.
Carriers price cyber from the loss side. Sophos's State of Ransomware research puts the median ransom paid at roughly $1M and average recovery costs around $1.53M, and ransomware is the claim underwriters model first.
A California example: seed-stage software companies there commonly see roughly $1,500–$3,000 for a $1M limit, per our California cyber insurance guide. Treat it as one state's illustration, not a national benchmark. For pricing by stage, read the full cyber insurance cost guide.
Cost drivers
Five inputs explain most of the spread between $1,000 and $8,800:
- Revenue. The base rating factor on most forms.
- Records and data sensitivity. How many personal records you hold, and whether they include health, financial or biometric data.
- Limits and retention. A $2M limit costs more than $1M; a higher retention brings the premium down.
- Industry. Fintech, healthtech and payment processors rate higher than a B2B tool holding no consumer data.
- Security controls. MFA, endpoint detection, tested offline backups, email security and a SOC 2 report each move the quote; missing MFA can close markets entirely.
How security controls lower your premium
Underwriters price what they can verify. A SOC 2 or ISO 27001 report shows that an independent auditor examined your controls, which can improve pricing and widen the markets willing to quote; see our guide to SOC 2 and cyber insurance. For companies that have done the work, OnePark Risk's controls-qualified program through Tokio Marine Kiln at Lloyd's of London has an illustrative price anchor of approximately $2,500 per year for $1M of combined Cyber + Tech E&O coverage for eligible companies with SOC 2 or ISO 27001 validation. This figure is illustrative only and is not a quote or an offer of coverage; actual pricing requires underwriting and carrier approval, and coverage is subject to carrier availability, eligibility, terms, and conditions.
How much cyber coverage does a startup need?
Match your largest contract first: if an enterprise MSA requires $2M of cyber coverage, buy $2M. Without a contract driving the number, most seed and Series A companies start with $1M–$2M in limits, enterprise contracts commonly require $1M–$5M, and you step up as the records you hold and your revenue grow.
Limits are a function of what a bad week would cost you, not of what the premium saves you. Four checks:
- Contracts. Take the highest cyber limit named in any clause you have signed or expect to sign this year.
- Records. Estimate how many individuals' data you hold; notification costs scale with that number.
- Revenue at risk. Estimate what a week of downtime costs in lost revenue and service credits.
- Retention. Choose a retention you could pay from cash the week of an incident.
There is no advantage in buying a $5M tower before anyone asks for it.
Cyber insurance by startup type
The policy form is similar across startup types, but the exposure that drives underwriting differs. SaaS companies are rated on uptime and customer data, fintechs on funds and regulatory scope, healthtech on protected health information, AI companies on training data and model output, and biotech on research data and partner contracts. Each has its own guide.
SaaS companies
Multi-tenant platforms concentrate every customer's data behind one login, so one credential compromise becomes a multi-party notification event. See the SaaS cyber insurance guide.
Fintech companies
Funds transfer fraud, social engineering and regulatory proceedings dominate fintech claims, and sponsor banks set their own limit requirements. See the fintech cyber insurance guide.
Healthtech companies
Protected health information brings HIPAA notification duties and higher per-record costs, and covered entities ask for a business associate agreement. See the healthtech cyber insurance guide.
AI companies
Training on customer data, model output that can defame or infringe, and prompt injection are new questions on the application. See the AI company cyber insurance guide.
Biotech and life sciences
Research data, lab systems and pharmaceutical partner contracts shape the exposure more than consumer records do. See the biotech cyber insurance guide.
How OnePark Risk places startup cyber insurance
OnePark Risk starts with a controls review, builds one combined cyber and Tech E&O submission, and markets it across more than 100 major insurance carriers and excess lines carriers throughout the country. Before you bind, we check the wording that decides claims: ransomware sublimits, social engineering and contractual liability. Standard certificates issue the same day once coverage is bound.
- Controls review. We go through MFA, endpoint detection, backups, email security and any SOC 2 or ISO 27001 report before the application goes out.
- One combined submission. Cyber and Tech E&O go to market together, sharing one retention and one claims process.
- Broad marketing. The submission goes to the admitted and excess lines markets that write early-stage technology companies; we return limits, sublimits and retentions, not just premiums.
- Wording review. Before binding we read the ransomware sublimit, the social engineering agreement, the contractual liability language and any controls conditions against your contracts.
- Certificates. Once bound, standard certificate requests issue the same day.
Ready to place startup cyber coverage? Tell us what your contract or investor requires. We come back with markets, limits and wording, not a single quote.
Request a Coverage Review · Speak With an Advisor
Licensed in New York, California, Delaware, Massachusetts, Pennsylvania, New Jersey, Nevada, Florida, and Virginia.
Cyber insurance for startups by location
Where you are incorporated and where your customers live both matter. State breach-notification statutes, privacy laws such as the CCPA and the New York SHIELD Act, and local carrier appetite change the questions underwriters ask and the limits customers expect. These guides cover the markets where OnePark Risk places startup cyber coverage most often.
- Cyber insurance in California: CCPA and CPRA exposure and seed-stage pricing.
- Cyber insurance in New York: SHIELD Act duties and NYDFS rules.
- Cyber insurance in Boston: 201 CMR 17.00 and vendor exposure in Massachusetts.
- Cyber insurance in San Francisco: California privacy duties for SaaS, AI and marketplaces.
- Cyber insurance in Los Angeles: Breach duties and controls for startups and media-tech.
- Cyber insurance in Florida: FIPA's 30-day breach notice.
Related coverages
Cyber insurance is one policy in a startup program, not the whole program. Tech E&O responds when your product fails a customer, D&O protects founders and directors in investor and regulatory disputes, and general liability covers the premises and bodily-injury claims landlords and contracts ask about. These guides cover the policies startups most often buy alongside cyber.
- Tech E&O insurance: Coverage when your software fails to perform.
- D&O insurance for startups: When investors require it and what it costs.
- Insurance for SaaS companies: The full program for a software business.
- Startup insurance: How the policies fit together by stage.
- Get a cyber insurance quote: What to have ready and how carriers compare.
Frequently asked questions
Do startups need cyber insurance?
Most do once they hold customer data, take payments or sign enterprise contracts. Enterprise customers and investors routinely ask for cyber coverage, and a single incident can cost far more than an early-stage company's runway allows.
How much does cyber insurance cost for a startup?
Venture-backed startups pay a median of about $2,900 a year for cyber insurance, and most pay between $1,000 and $8,800 (Vouch, 2026). Revenue, records held, the limit you buy and your security controls determine your price.
What does startup cyber insurance cover?
It covers your own costs after an incident, such as forensics, notification, data restoration, lost income and extortion. It also covers claims from others whose data was exposed, plus regulatory defense where insurable. Social-engineering fraud is often included or available as an add-on.
What's the difference between cyber insurance and Tech E&O?
Cyber covers your breach costs and privacy claims. Tech E&O covers clients' financial losses when your product or service fails. Startups that sell software usually buy both on one combined policy.
How much cyber coverage does a startup need?
Start with your largest customer contract. Early-stage startups commonly carry $1M–$2M, and enterprise contracts often call for $1M–$5M. Increase limits as you hold more records and sign bigger customers.
Does SOC 2 lower cyber insurance premiums?
Documented controls such as MFA, EDR, backups and a SOC 2 report generally improve underwriting outcomes. Companies validated through Agency may qualify for OnePark's controls-qualified Cyber and Tech E&O program, subject to eligibility.
Your AI assistant can request this coverage
An AI agent or assistant acting for your business can request this coverage from OnePark: it uses the same browser forms a person does, and no MCP server, API key, or integration is required. The agent cannot bind coverage, and submitting a request does not guarantee carrier approval or a quote. Your business’s authorized representative approves any purchase in writing.
Business insurance for AI agents · Your AI assistant can now request business insurance from OnePark · How it works for agent builders
Sources
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.