Insurance Office of America markTechnology Insurance Practice
Book a coverage review

Where programs go wrong

Five things most agents miss on a technology account

A lot of tech companies get insured like any other office: a package policy, a cyber quote, and an E&O form picked mostly on price. Here's what we find when we review a program that was built that way.

Updated October 2026

1. The gap between general liability and E&O

GL usually excludes professional services. Many tech E&O forms exclude bodily injury and property damage. When something you built, configured, or support causes physical damage, each policy can point at the other. We check which one actually answers.

Physical damage caused by your work. Who answers?

2. The customer agreement you signed versus the policy you bought

Enterprise MSAs ask for uncapped data breach indemnity, specific E&O and cyber limits, additional insured status, and waivers. Most E&O forms exclude liability you took on by contract that you wouldn't otherwise owe. We read the insurance exhibit and the indemnity clause against your wording before you sign.

3. E&O and cyber drawing from one limit

A combined form is common, and often the right call. But if your own ransomware recovery, a customer's lost revenue claim, and the defense costs on both come out of a single $2 million aggregate, one bad quarter can leave nothing for the next claim.

4. Social engineering

A spoofed vendor email that redirects a six-figure payment is one of the most common losses in this class. Standard crime forms exclude money you send voluntarily, and cyber coverage for it is often sublimited well below the main limit.

5. Remote employees in states your comp policy doesn't list

Hire a developer who works from home in Colorado, and whether that injury is covered can turn on what's written in item 3.C and when the carrier was told. Four states don't allow private comp at all. The same remote footprint brings each state's employment laws onto your EPLI.

Workers' compensation and employee statesNorth Dakota, Ohio, Washington, and Wyoming are state fund only. Colorado, Georgia, and North Carolina show example employee locations not listed on a policy.AlabamaAlaskaArizonaColoradoFloridaGeorgiaIndianaKansasMaineMassachusettsMinnesotaNew JerseyNorth CarolinaNorth DakotaOklahomaPennsylvaniaSouth DakotaTexasWyomingConnecticutMissouriWest VirginiaIllinoisNew MexicoArkansasCaliforniaDelawareDistrict of ColumbiaHawaiiIowaKentuckyMarylandMichiganMississippiMontanaNew HampshireNew YorkOhioOregonTennesseeUtahVirginiaWashingtonWisconsinNebraskaSouth CarolinaIdahoNevadaVermontLouisianaRhode Island

State fund only. No private workers' comp.

Example: employee works here, state not listed on the policy.

North Dakota, Ohio, Washington, and Wyoming require state fund coverage. Colorado, Georgia, and North Carolina illustrate employees working in states not listed on a policy. All other states appear in light gray.

Almost none of this means buying more insurance. Most of it is making the policy wording match the work you actually do.

Common questions

Does general liability cover a technology company's professional mistakes?

Usually not. GL typically excludes professional services. Financial loss a customer blames on your software or service is a technology E&O exposure.

Is social engineering fraud covered by cyber insurance?

Sometimes, but it's often sublimited well below the main limit, and standard crime forms exclude money you send voluntarily. The sublimit and the conditions attached to it are worth checking.

Which states don't allow private workers' comp insurance?

North Dakota, Ohio, Washington, and Wyoming require coverage through a state fund. Employees there need to be handled separately from your regular comp policy.

Find out what your program is missing

Book a 30-minute call. You'll get a one-page findings summary marking each item fits, thin, or gap, with what it takes to fix.

One useful read a month

Contracts, coverage, and risk for technology company owners and CFOs. No fluff.