Cyber Insurance for IT Service Providers, Software & SaaS

What Insurance Does an IT Service Provider Need?

IT service providers, software houses, managed service providers (MSPs) and SaaS vendors should model their own cyber risks and potential claims from their customers separately. A compromised administrator account can affect several customers at once. An error in advice, configuration or software, on the other hand, can cause a financial loss even without a cyberattack.

That is why the question “cyber insurance or professional indemnity?” is not enough. What matters is how cyber and IT professional indemnity cover interlock, and which gaps remain between the two policies.

Cyber Insurance or IT Professional Indemnity?

Risk area	Cyber insurance	IT professional indemnity / financial loss liability
Your own security incident	Depending on the policy: forensics, recovery, crisis support and your own business interruption	Usually not the focus
Breach of data or confidentiality	Depending on the terms: own costs and third-party claims	May cover claims arising from professional activity; scope varies
Faulty advice or configuration	Only where expressly included	Typical core of IT professional indemnity
Faulty software or failure to perform	Cyber cover alone is often not enough	Depends on the business description, contract and exclusions
Outage at a cloud or hosting partner	Only with suitable service provider or business interruption cover	Customer claims may need to be reviewed separately

Product names are not standardised. Ask for written confirmation of which policy responds first in an incident, how double insurance is handled and whether recourse or exclusion clauses create a gap.

Why Customer and Admin Access Concentrates Risk

Remote maintenance, RMM tools, support accounts and cloud administration consoles bundle privileges. If such an account is compromised, the incident can reach beyond your own environment. In its supply chain guidance, the Federal Office for Cybersecurity (NCSC) explicitly distinguishes between partners with privileged access, software suppliers and important service providers such as SaaS partners or service desks.

For the risk review, you should document:

whether every customer account is clearly assigned to one person and one tenant;
where multi-factor authentication is enforced for privileged and external access;
how rights are granted, reviewed and revoked when someone leaves;
whether customer systems are separated technically and organisationally;
which actions are logged and how anomalies are handled;
how emergency access is protected and its use monitored.

Contractual, Cloud and MSP Concentration

A single platform, cloud account or RMM system can be critical for many customers at the same time. This creates two different kinds of concentration:

Technical concentration: a compromised tool, update or administrator account reaches several environments.
Contractual concentration: a single incident can trigger reporting obligations, service level commitments and claims from several customers at once.

So do not only review the total sum insured, but also sub-limits and aggregate limits. Definitions of serial events, contingent business interruption, cloud outages, software errors and contractually assumed liability are also important.

The NCSC recommends continuously reviewing IT/OT supply chains, dependencies and requirements for providers, and regulating liability and quality requirements, among other things, in supplier contracts. This contract review does not replace an insurance analysis, but it provides the necessary input for one.

Your Own Outage Remains a Separate Risk

Even if no customer makes a claim, the provider itself can be hit:

subscription or project revenue is lost;
support and development are tied up in incident response;
development, build or production environments have to be rebuilt;
data and configurations have to be restored and checked;
external forensics, legal advice and crisis communication are needed.

Use the sum insured scenario calculator to add up your own outage and external costs in a traceable way. Potential customer claims should be documented separately so that they are not counted twice in the same calculation.

Coverage Points to Include in the Quote Request

incident response, forensics, data and system recovery;
your own business interruption, including a suitable valuation method and waiting period;
outage or security incident at cloud, hosting and other critical service providers;
third-party claims for data protection, confidentiality and network security;
cyber fraud and social engineering only if this risk is needed and expressly offered;
coordination with IT professional indemnity and existing liability policies;
sub-limits, annual aggregates and treatment of multiple affected customers;
exclusions for known vulnerabilities, unsupported systems or contractually assumed liability;
requirements regarding the emergency hotline, approved service providers and consent before costs are incurred.

The specific quote is always what is binding. A product name alone does not tell you whether a particular customer or cloud scenario is included.

Which Documents Insurers and Brokers Need

Prepare a precise business description and revenue breakdown: consulting, custom development, standard software, hosting, SaaS, managed services and access to customer systems create different risks. Add:

number and type of customers with privileged access;
critical cloud, hosting, RMM and CI/CD dependencies;
secure development, update and release processes;
tenant separation, logging and protection of secrets;
backup and tested recovery procedures;
contractual liability caps, service levels and information obligations;
previous incidents, known vulnerabilities and outstanding improvements.

The questionnaire guide helps you prepare this information in a structured way.

What Do Swiss Sources Show?

The NCSC half-year report 2025/1 describes attacks within the supply chain as a key challenge: after an attack on an IT company, its business customers may also be affected. This maps directly onto the concentration risk of MSP, software and SaaS providers.

In 2023, the FHNW (University of Applied Sciences and Arts Northwestern Switzerland) surveyed a total of 502 managing directors of Swiss SMEs with 4 to 49 employees. 11 per cent reported a successful cyberattack that required considerable effort to remedy; 55 per cent of the companies that had already been attacked reported a financial loss. These figures describe Swiss SMEs as a whole and are not a loss ratio specific to IT companies.

The SECO SME portal brings together protective measures and positions cyber insurance as a possible financial cushion alongside prevention and emergency preparedness. For IT providers, the key point remains not to lump own losses, customer liability and professional errors together in one blanket assumption.

Sources

Test Quotes Against the Same Scenarios

Request cyber and IT professional indemnity quotes based on the same business description, the same customer access and the same cloud dependencies. BTAG can explain differences in cover, exclusions, sub-limits and policy coordination.

Compare cyber and liability quotes