SaaS Insurance Explained in 5 Minutes

You're running a cloud HR platform. Payroll is your bread and butter. One afternoon, the API you depend on for payroll processing goes down. 14 hours later, 25 of your clients have missed their payroll deadlines. Late fees are stacking up. Employees are calling their HR department in a panic. When the dust settles, you're staring at $380,000 in client losses and $65,000 in your own loss revenue. And now the question is, does your insurance actually cover any of this? If the scenario makes you uncomfortable, good. That's exactly what we're going to be talking about here today. Hi, I'm Gordon Coyle. And for over 40 years, I have worked with startup early stage firms, up to seven, eight and nine figure businesses, helping them navigate the complex world of business insurance. I have seen every problem and costly mistake you can imagine. And here I share the insider strategies and real world solutions that protect your business and save you money. Today, we're talking about SAS insurance, what you actually need, what it costs, and where most programs completely fall apart. Here's what most SAS founders get wrong right out of the gate. They buy a general liability policy or a BOP, and they think they're covered. They're not. General liability covers physical injuries and property damage. Someone trips in your office, that's general liability, but it explicitly excludes professional services, software failures, and data breaches. That's 100% of your actual SAS exposure, every bit of it. So if a client sues you because your software went down and they lost money, GL doesn't respond. If you get hit with ransomware and 50,000 user records get exposed, general liability doesn't respond. If your board gets sued over security oversight, general liability doesn't respond. You need a coordinated coverage stack, not a single policy. So what does that stack look like? There are three policies that form the core of any SAS insurance program. First is tech E&O, which stands for errors and omissions. This is the policy that covers client losses when your software fails. Bugs, outages, missed SLAs, failed integrations. If your contract says you'll deliver a service and something goes wrong, this is the policy that responds, and your contracts are pushing liability onto you whether you realize it or not. Second, cyber insurance. This covers breach response, ransomware, business interruption, and privacy lawsuits. Even for small firms, breach costs average $120,000 to $1.24 million. And here's the detail most people miss. If you depend on a third-party vendor like AWS or Stripe and they go down, your base cyber policy probably doesn't cover your lost revenue. You need a dependent business interruption endorsement. That typically costs $200 to $500 a year. Remember that API failure I mentioned at the top of this video? A $200 a year investment would have saved $345,000. Now, the third option is D&O, or directors and officers liability insurance. If you're raising capital, your investors are going to require this. It protects against lawsuits over fundraising decisions, security oversight, and employment issues. VCs check for this coverage during their due diligence. If you don't have it, it can delay or kill a funding round. Now, what does it all cost? It depends on four things. Your revenue and the sensitivity of your data, which you handle, your security controls, which is the biggest lever you actually control, your SLA commitments, and your claim history. On the security side, here's what makes the biggest difference. MFA everywhere can lower your premiums by 20% to 30%. Endpoint detection drops it another 15% to 25%. Tested offline backups are not optional. They're required. Without MFA or backups, you're looking at premiums that are 50% to 100% higher, or you may get declined entirely. For ballpark numbers, if you're a startup with less than a million in revenue and you have your security controls in place, you're looking at $100 to $200 a month for a million dollars of limit. Growth stage, $1 to $10 million in revenue. You're probably in that $200 to $500 a month range with $2 million limits. As you scale past $10 million, it's $500 to $1,500 a month. And enterprise, $50 million plus, bank on $1,500 to $5,000 or more per month. So SaaS insurance is real. It's variable, and it's driven by your specific operations and your security posture. The price question matters, but the more important question is whether what you're buying actually works. Two SaaS companies with identical controls can get very different coverage outcomes depending on what their contracts promise, which vendors they depend on, and how their losses would realistically unfold. That's why this is a decision, not a form you fill out. If you're not sure your current program covers your SaaS exposure correctly, that's exactly what I look at in an insurance confidence assessment. 30 minutes, no pressure, no obligation, just an honest look at whether your coverage actually matches what your business does and what your contracts require. There's a link below to set up a call with us. Subscribe for more content like this. I cover everything like this a few times a week. Drop me a question in the comments if there's something you'd like me to tackle.