Combined tech E&O and cyber policy

A combined tech E&O (errors and omissions) and cyber policy brings two parts together in one contract. One is the insured's liability for a fault in performing its technology service. The other is security or data breaches, with their first-party covers (notification, restoration, extortion, business interruption). SaaS (software as a service) vendors, integrators and managed service providers buy it in that form because their losses often trigger both at once. Ransomware at a managed service provider encrypts its own servers, which is a cyber matter, then knocks out its clients' service, and they allege breach of contract. With two policies and two insurers, the incident opens an allocation dispute that can last longer than the crisis. With a combined policy, a single adjuster handles the file, usually a single retention applies, and the boundary is settled internally. The trade-off is the limit. Most often, the two parts share an annual aggregate: restoration and the ransom erode the limit the insured will need when client claims arrive, six months later. Some policies split limits by part, or add a dedicated liability limit. The boundary remains, though. An outage with no intrusion, like the faulty update of July 2024, falls under the E&O part; it enters the cyber part only if that part covers non-malicious system failure. Penalties and service credits promised by contract often remain, in both parts, under the assumed liability exclusion, unless expressly written back. Some wordings accept service credits as damages when they settle a claim.