| name | business-insurance |
| description | Complete business insurance guide for SaaS founders — Errors & Omissions (E&O/Tech E&O), Cyber Liability, Directors & Officers (D&O), General Liability, Workers Compensation, Key Person, Employment Practices Liability (EPLI), and when each becomes necessary. Covers what triggers insurance needs (first enterprise customer, fundraising, hiring), cost estimates by stage, and how to shop for coverage. Triggers on: "business insurance", "startup insurance", "E&O insurance", "cyber insurance", "D&O insurance". |
| license | MIT |
| compatibility | Claude Code, Jesse, Codex, Hermes, Windsurf, OpenCode, Gemini CLI, Copilot, Zed, VS Code, Goose |
| metadata | {"version":"1.0.0","author":"LeadMagic","category":"founder-led","tags":["insurance","e-and-o","cyber","d-and-o","liability","risk-management","compliance"],"related_skills":["soc2-compliance","legal-for-founders","data-privacy-compliance","security-assessments","fundraising-strategy"],"frameworks":["Vouch — Startup insurance specialists","Embroker — Tech/SaaS insurance","Coalition — Cyber insurance","Founders Shield — Startup risk management","At-Bay — Cyber and E&O insurance"]} |
Business Insurance for SaaS
Overview
Insurance is boring until you need it — then it saves your company. Enterprise
customers demand proof of insurance. Investors require D&O coverage. A data
breach without cyber insurance can bankrupt a startup. The mistake: waiting
until a contract requires insurance to start shopping. Policies take 2-4 weeks
to bind. Losing a $100K deal because you don't have insurance is an unforced
error. This skill covers every insurance type a SaaS founder needs, when it
becomes necessary, and how to get it.
Authoritative Foundations
- Vouch — Startup insurance specialists — Startup insurance specialists
- Embroker — Tech/SaaS insurance — Tech/SaaS insurance
- Coalition — Cyber insurance — Cyber insurance
- Founders Shield — Startup risk management — Startup risk management
- At-Bay — Cyber and E&O insurance — Cyber and E&O insurance
When to Use
Trigger phrases: "business insurance", "startup insurance", "E&O insurance",
"cyber liability", "D&O insurance", "what insurance do I need", "enterprise
customer requiring insurance", "insurance for SaaS", "technology E&O"
Insurance Timeline by Stage
| Stage | Insurance Needed | Why | Annual Cost |
|---|
| Pre-launch / $0 ARR | None typically | No customers, no employees, no risk | $0 |
| First customer / <$100K ARR | General Liability (optional) | Office lease, events, basic protection | $300-800 |
| First enterprise deal | Tech E&O + Cyber | Enterprise contract requires it | $2-5K total |
| First employee | Workers Comp (required) | State law — mandatory with employees | $500-2K |
| Fundraising / $1M+ ARR | D&O | Investor requirement, board protection | $2-5K |
| 5+ employees | EPLI (Employment Practices) | Protection against wrongful termination, discrimination claims | $1-3K |
| $5M+ ARR | Full stack: E&O, Cyber, D&O, GL, EPLI, Key Person | Mature company, material risk | $15-30K/yr total |
| Key founder dependency | Key Person (Life + Disability) | If founder is incapacitated, company survives | $1-3K |
Insurance Types Deep Dive
1. Technology Errors & Omissions (Tech E&O)
What it covers: Claims that your software caused financial loss to a
customer due to errors, bugs, downtime, or failure to perform as promised.
Also covers intellectual property infringement (not patent).
Typical coverage: $1M per occurrence / $2M aggregate (minimum for enterprise).
Some enterprises require $5M.
Real scenarios it covers:
- Your API goes down for 4 hours. Customer loses $50K in revenue. They sue.
- A bug in your billing system overcharges 200 customers. They demand refunds + damages.
- Your software doesn't deliver the results you promised in the sales process.
What it DOESN'T cover:
- Intentional wrongdoing or fraud
- Bodily injury or property damage (that's General Liability)
- Data breaches (that's Cyber)
- Employment claims (that's EPLI)
Cost: $1,500-5,000/yr depending on revenue, coverage limits, and risk profile.
Trigger event: First enterprise or mid-market customer. Their procurement
team will ask for a Certificate of Insurance (COI) listing them as additional
insured. Without it, deal blocked.
2. Cyber Liability Insurance
What it covers: Costs related to data breaches, hacking, ransomware, and
privacy violations. Covers: forensic investigation, legal fees, notification
costs, credit monitoring for affected customers, PR/crisis management, and
regulatory fines (where insurable).
Typical coverage: $1M (minimum). $2-5M if you handle sensitive data.
Real scenarios it covers:
- Customer database breached. 5,000 records exposed. Notifications required.
Forensic investigation identifies the vulnerability. Legal counsel manages
regulatory reporting. Total cost: $200-500K. Cyber insurance covers it.
- Ransomware attack encrypts your production servers. $50K ransom demand.
Insurance covers negotiation, ransom payment, and recovery costs.
- Customer sues you for failing to protect their data under your DPA.
What it DOESN'T cover:
- Pre-existing breaches (before policy effective date)
- Intentional acts by the insured
- War or state-sponsored attacks (some policies exclude this)
- Regulatory fines in all jurisdictions (check policy)
Cost: $1,500-5,000/yr. Premium heavily influenced by your security posture:
SOC2, penetration testing, MFA, encryption — all reduce premiums.
Trigger event: You store ANY customer data. Even if you don't have
enterprise customers yet. One breach can kill an uninsured early-stage startup.
3. Directors & Officers (D&O) Insurance
What it covers: Claims against directors and officers for wrongful acts
in managing the company. Covers: breach of fiduciary duty, mismanagement,
employment-related claims from shareholders, securities claims.
Typical coverage: $1-5M depending on stage and funding.
Real scenarios it covers:
- Investor sues board for mismanagement after down round.
- Employee/shareholder claims dilution was handled improperly.
- Competitor claims your board member used confidential information.
- IPO/SPAC-related securities claims (later stage).
When you need it:
- Before your first VC round (investors will require it)
- When you have a board of directors
- When you have outside investors
Cost: $2,000-10,000/yr. Startups on the low end. Public companies: $100K+.
4. General Liability (GL)
What it covers: Bodily injury, property damage, personal injury (libel,
slander), advertising injury. NOT professional errors (that's E&O).
Typical coverage: $1M/$2M. Often combined with E&O in a package.
Real scenarios: Someone slips at your office. You damage a client's
property during an on-site visit. A competitor sues you for false advertising.
Cost: $300-800/yr. Cheapest coverage. Required for office leases and events.
5. Workers Compensation
What it covers: Employee injuries or illnesses arising from employment.
Required by law in almost every state as soon as you have W-2 employees.
Cost: $500-2,000/yr for office-based companies. Higher for physical work.
Trigger: First W-2 employee. No exceptions. It's the law.
6. Employment Practices Liability (EPLI)
What it covers: Claims of wrongful termination, discrimination, harassment,
retaliation, and other employment-related wrongs.
When you need it: 5+ employees. The risk of employment claims increases
with headcount.
Cost: $1,000-3,000/yr.
7. Key Person Insurance
What it covers: Life insurance or disability insurance on key founders.
If a founder dies or becomes disabled, the company receives a payout to
cover transition costs, recruiting, and lost momentum.
When you need it: Company depends on 1-2 people for survival. Investors
may require it on the CEO/CTO.
Cost: $1,000-3,000/yr depending on age, health, and coverage amount.
How to Shop for Insurance
Step 1: Work with a broker that specializes in startups. Don't go to
Geico or State Farm — they don't understand SaaS.
Recommended brokers:
- Vouch (vouch.us) — built for startups, fast quotes, digital-first
- Embroker (embroker.com) — tech/SaaS focused
- Founder Shield (foundershield.com) — risk management for startups
- Coalition (coalitioninc.com) — cyber + E&O specialist
Step 2: Get quotes from 2-3 brokers. Premiums vary significantly.
Step 3: Provide accurate information. Undisclosed risks = denied claims.
Step 4: Review policy exclusions. Know what's NOT covered.
Step 5: Pay annually. It's cheaper than monthly and you won't forget.
Output Format
BUSINESS INSURANCE — [Company]
Current Stage: [$X ARR, X employees, X enterprise customers]
POLICIES NEEDED:
| Policy | When | Coverage | Est. Cost |
|---|---|---|---|
| Tech E&O | [trigger event] | $XM | $X |
| Cyber | [trigger event] | $XM | $X |
| D&O | [trigger event] | $XM | $X |
| GL | [trigger event] | $XM | $X |
| Workers Comp | [trigger event] | $XM | $X |
BROKERS:
- [Name]: [quote / contact info]
ENTERPRISE REQUIREMENTS:
- [Customer 1]: requires $2M E&O + $2M Cyber + COI naming them as additional insured
- [Customer 2]: requires $1M E&O
Implementation Checklist
Quality Check
Before delivering, verify:
Common Pitfalls
-
No E&O before enterprise deal. Enterprise procurement asks for COI.
You don't have it. Deal blocked for 2-4 weeks while you shop for insurance.
Some customers walk away. Fix: Get E&O when you start targeting mid-market
or enterprise — before the first deal, not during it.
-
Thinking "we're too small to get sued." You're not. A $100K ARR startup
can be sued for $1M by a customer who lost money during your downtime. Fix:
Insurance is cheaper than being right in court.
-
Buying the cheapest policy. Lowest premium = most exclusions = claims
denied when you actually need it. Fix: Compare coverage, not just price.
Understand what's excluded.
-
Not naming enterprise customers as additional insured. Enterprise
contract says "name us as additional insured on your E&O." You buy E&O
but forget to add them. They reject the COI. Fix: Your broker handles
additional insured endorsements. Ask for one per enterprise customer.
-
Lying on the application. "We've never had a security incident." But
you had a breach last year. The insurer finds out. Claim denied. Policy
rescinded. Fix: Be honest on insurance applications. They can and will
investigate before paying large claims.
⚠️ Disclaimer
This skill provides general informational guidance based on publicly available frameworks and operator experience. It is NOT legal advice, accounting advice, tax advice, financial advice, insurance advice, or professional services advice.
Consult qualified professionals for your specific situation — attorneys for legal/equity matters, CPAs for tax and accounting, licensed brokers for insurance, and certified security assessors for compliance. This skill does not create a professional-client relationship. Use it as a starting point for research and preparation.
Execution Artifacts
references/framework-notes.md — Named frameworks and reference tablestemplates/output-template.md — Deliverable shell for agent outputscripts/check-output.py — Lightweight deliverable validator
Related Skills
legal-for-founders — Incorporation, IP, contracts, ToSsoc2-compliance — Security posture that reduces insurance premiumsdata-privacy-compliance — Compliance that cyber insurance expectssecurity-assessments — Pen tests and audits that insurers may requirefundraising-strategy — D&O insurance timing for VC rounds
