Cyber insurance vs tech E&O in Singapore
The short difference
Cyber asks whether there was a security or privacy event. Tech E&O asks whether your work fell short of what you promised a client.
| Question | Cyber insurance | Tech E&O |
|---|---|---|
| What triggers it | Hacking, malware, ransomware, data breach, privacy event | Error, omission, negligence or breach of contract in your service |
| Whose loss | Your own costs first, then third-party claims | Your client's financial loss, claimed against you |
| Typical first-party cover | Forensics, notification, data restoration, lost income | None |
| Typical third-party cover | Claims and regulatory defence after a data event | Client claims for outage, defects, missed specifications |
| Policy basis | Usually claims-made | Claims-made, with a retroactive date |
| Who usually asks for it | Board, auditors, larger clients | Client contracts and procurement teams |
A software house, managed service provider or SaaS business carries both exposures. A business that only uses technology, such as a distributor, mainly needs cyber.
What cyber insurance covers
A cyber policy has two halves. The first-party half pays your own costs after an event. The third-party half pays claims made against you because of it.
- Incident response: forensic investigators, legal advice and crisis communications.
- Notification: costs of informing affected individuals and the regulator.
- Data and system restoration: rebuilding data and software damaged by an attack.
- Business interruption: lost income while your own systems are down.
- Cyber extortion: response costs for a ransomware demand, subject to the wording and the law.
- Privacy liability: claims from people whose data was exposed, and defence of regulatory investigations.
Singapore law sets the stakes. Under the Personal Data Protection Act 2012, an organisation that assesses a breach as notifiable must notify the PDPC within 3 calendar days. Since 1 October 2022, the maximum financial penalty is 10% of annual Singapore turnover above S$10 million, otherwise S$1 million. Owners of critical information infrastructure also carry incident-reporting and audit duties under the Cybersecurity Act 2018.
The threat level is not static. CSA's Singapore Cyber Landscape 2024/2025 reported a rise in local ransomware and infected-infrastructure cases. The PDPA breach article covers the breach response in more detail.
What tech E&O covers
Tech E&O is professional indemnity written for technology work. It pays damages and defence costs when a client alleges your product or service caused them a financial loss.
Typical claims include:
- A software release with a defect that stops a client's billing run for 2 days.
- A migration project that runs late and breaches a delivery milestone.
- A configuration error by a managed service provider that takes a client's site offline.
- Software that fails to meet the specification in the statement of work.
- A claim of infringement of a third party's intellectual property, where the wording includes it.
The policy defends the claim even when it has no merit. Defence costs on a contract dispute often run before any liability is decided.
Exposure lasts beyond the year the work was done. The Limitation Act 1959 gives 6 years to sue in contract or tort from when the cause of action accrues. Latent damage extends it. A tech E&O policy is usually claims-made, so it must be in force when the claim arrives, not only when the work was done. The retroactive date sets how far back past work is covered.
Tech E&O does not pay to fix your own code, refund your fees or cover your own lost income. Those are business costs, not liabilities to a client.
Where they overlap and where they leave gaps
The overlap sits in one scenario: a client's data is exposed through your system. The client's negligence claim falls under tech E&O. Individuals and the regulator fall under the privacy section of cyber.
| Scenario | Cyber | Tech E&O |
|---|---|---|
| Ransomware locks your own servers | Responds | Does not respond |
| Your code bug causes a client outage, no attack | Usually does not respond | Responds |
| Hacker uses your platform to reach a client's network | Responds to your costs; may respond to the client claim | Often responds to the client claim |
| Client data leaked from your system | Responds to notification, regulator and privacy claims | May respond to the client's negligence claim |
| You miss a delivery date | Does not respond | Responds if the client alleges negligence |
Three gaps recur:
- Exclusions that point at each other. Cyber may exclude professional services; tech E&O may exclude data breaches. Bought separately, both can decline.
- Contractual liability. Both exclude liability accepted under contract beyond what the law imposes. An uncapped indemnity sits outside both.
- Different retroactive dates. A past event may fall inside one policy and outside the other.
Placing both with one insurer, or on a combined wording, removes the first gap. The second is fixed in the contract, not the policy.
Which one a business needs
Three scenarios show the split.
Scenario 1: a 40-person SaaS company. It hosts client data and its platform runs client operations. A breach creates notification duties under the PDPA. A bug creates client claims for lost revenue. It needs both, ideally on matching retroactive dates.
Scenario 2: an 8-person IT consultancy. It configures systems on client premises and holds little client data. Its main exposure is an error that costs a client money. It needs tech E&O first. A cyber policy still covers its own systems, email and invoices against fraud and ransomware.
Scenario 3: a 150-person distributor with an online ordering portal. It sells goods, not technology services. Its exposure is its own downtime and customer data. It needs cyber. Tech E&O adds little, because clients do not pay it for technology work.
The decision turns on two questions. Do clients pay you for technology work? Do you hold personal data or run systems others depend on? Two yes answers mean both covers.
Frequently asked questions
Which policy pays if my software bug causes a client outage?
Tech E&O, provided the client alleges a financial loss from your error. Cyber usually does not respond, because there was no security or privacy event. Check that the tech E&O wording does not exclude outages caused by your own systems.
Which policy pays if my client's data is leaked from my system?
Usually both, for different parts of the loss. Cyber pays incident response, notification and privacy claims from individuals and the regulator. Tech E&O may pay the client's own negligence claim against you, if the wording does not exclude data events.
Do I need both if I am a SaaS company?
In most cases, yes. A SaaS business sells a service clients rely on and holds their data. Each exposure needs its own trigger. Many insurers offer both on one combined policy, which avoids the two wordings excluding each other.
Does PI include cyber in Singapore wordings?
A standard PI wording does not include first-party cyber costs such as forensics, restoration or your own lost income. Some PI wordings exclude data breach claims entirely. Others add a limited cyber extension with a sub-limit. Read the definition of "claim" and the cyber exclusion before relying on it.
Sources
General information only, not advice on any particular policy. Cover depends on the policy wording and the insurer's terms.