1. The gap between general liability and E&O
GL usually excludes professional services. Many tech E&O forms exclude bodily injury and property damage. When something you built, configured, or support causes physical damage, each policy can point at the other. We check which one actually answers.
2. The customer agreement you signed versus the policy you bought
Enterprise MSAs ask for uncapped data breach indemnity, specific E&O and cyber limits, additional insured status, and waivers. Most E&O forms exclude liability you took on by contract that you wouldn't otherwise owe. We read the insurance exhibit and the indemnity clause against your wording before you sign.
5. Remote employees in states your comp policy doesn't list
Hire a developer who works from home in Colorado, and whether that injury is covered can turn on what's written in item 3.C and when the carrier was told. Four states don't allow private comp at all. The same remote footprint brings each state's employment laws onto your EPLI.
State fund only. No private workers' comp.
Example: employee works here, state not listed on the policy.


4. Social engineering
A spoofed vendor email that redirects a six-figure payment is one of the most common losses in this class. Standard crime forms exclude money you send voluntarily, and cyber coverage for it is often sublimited well below the main limit.