Cyber Insurance vs Tech E&O vs Crime Insurance: Which Do You Need?

Cyber insurance covers breaches, ransomware, system downtime, and privacy claims. Technology errors and omissions covers claims that software or IT services you provide failed or caused a client a loss. Crime insurance covers stolen money and property, including employee theft. Most businesses need cyber; tech companies usually add tech E&O; anyone moving large payments should coordinate cyber with crime.

By Trella Commercial · Updated October 3, 2026

The short version

Cyber: your costs and liability when your systems or data are attacked or exposed.
Technology errors and omissions (tech E&O): liability when the technology products or services you sell fail or cause a client a financial loss.
Professional liability (E&O) for non-tech firms: liability for mistakes in your professional services, such as accounting, design, or consulting.
Crime: your own money, securities, and property stolen, including by employees, plus certain fraudulent transfers.
The overlaps are where claims go wrong. Wire fraud can fall under cyber, crime, both, or neither. A client's breach caused by your IT work can fall under cyber, tech E&O, or both. Coordinating the policies matters more than having all of them.

The three policies side by side

	Cyber	Tech E&O	Crime
Core question	Were our systems or data attacked or exposed?	Did our technology product or service fail a client?	Was our money or property stolen?
Whose loss	Yours (first-party) and claims against you (third-party)	Your clients' financial losses, claimed against you	Yours
Typical events	Ransomware, data breach, system outage, privacy lawsuit	Software bug, failed implementation, missed deadline, security failure in a product you provide	Employee embezzlement, forged checks, computer or funds transfer fraud
Covers employee theft	No	No	Yes
Covers wire fraud	Often, under a social engineering or funds transfer sublimit	No, unless it causes a client claim	Often, under computer fraud, funds transfer fraud, or a social engineering endorsement
Typical buyers	Nearly every business	Software, SaaS, IT services, managed service providers, developers	Businesses with employees handling money, and anyone moving large payments

Where the overlaps are

Wire fraud and fake invoices

Business email compromise is one of the most expensive frauds businesses face. The FBI's Internet Crime Complaint Center logged 21,442 business email compromise complaints in 2024, with reported losses of more than $2.77 billion. Coverage can sit in two places:

Scenario	Cyber policy	Crime policy
A hacker gets into your bank portal and sends money out	Funds transfer fraud, if included	Computer fraud or funds transfer fraud
An employee is tricked by a fake "vendor" email into wiring money	Social engineering, if included, usually sublimited	Social engineering endorsement, if added, usually sublimited
Your hacked email sends customers a fake invoice and they pay the criminal	Invoice manipulation, if included	Usually not covered
An employee steals by sending payments to themselves	No	Employee theft

Because both policies often carry sublimits and different conditions, such as requiring a call-back to verify payment changes, line up the wording so a loss is not denied by both. Some businesses put social engineering under one policy deliberately and leave it off the other.

A client's breach caused by your work

For technology companies, one incident can trigger both policies:

What happens	Policy that usually responds
Your own network is breached and your client data is exposed	Cyber (breach response, privacy liability)
Your software flaw lets attackers into a client's systems, and the client sues	Tech E&O, and possibly cyber network security liability
Your IT outage stops your client's operations, and the client sues for lost income	Tech E&O
Your own systems are down and you cannot serve clients	Cyber (business interruption)

This is why most insurers sell combined tech E&O and cyber policies to technology businesses. One form avoids arguments between two insurers about which one owes the claim. Check whether the combined limit is shared between the two parts.

Professional services firms

Accountants, attorneys, consultants, architects, and agencies carry professional liability for mistakes in their services. Two cyber-related exposures can fall between policies:

A client wires money to a criminal after receiving fake instructions from your hacked email. The client may claim you were negligent. Professional liability may or may not respond, and some forms exclude cyber-related claims.
Your firm's breach exposes client data. That is generally a cyber claim, not a professional liability claim.

Ask your broker how your professional liability and cyber policies treat each one. See the law firm story and CPA firm story for how this plays out.

Which combination fits your business?

Business	Cyber	Tech E&O or professional liability	Crime
Retail shop or restaurant using a payment processor	Recommended	Not usually needed	Worth considering if staff handle cash or deposits
Medical, dental, or wellness practice	Strongly recommended (health data)	Medical malpractice is separate	Worth considering for billing staff
Accounting, law, or consulting firm	Strongly recommended	Professional liability needed	Recommended if you handle client funds or a trust account
Software, SaaS, or IT services company	Strongly recommended	Tech E&O needed, often combined with cyber	Recommended as headcount grows
Contractor or trades business	Recommended if you take deposits or wire payments	Not usually needed	Recommended for payment and payroll fraud
Property manager or real estate office	Strongly recommended (wire fraud risk on deposits and closings)	Professional liability often needed	Recommended
Nonprofit	Recommended (donor and client data)	Directors and officers is the related policy	Recommended (employee theft and donation fraud)

This is a starting point, not a recommendation for any particular business. Contracts often settle the question: client agreements frequently require specific limits for cyber, professional liability, or both.

How to buy them so they work together

Start with an inventory of how money moves: who can send wires, approve vendors, and change bank details.
Decide where social engineering lives, cyber or crime, and make sure the sublimit is meaningful.
For tech businesses, prefer a combined tech E&O and cyber form, or at least the same insurer for both.
Check the "other insurance" clauses so two policies do not each point to the other.
Match retroactive dates on claims-made policies when you renew or switch.

Common questions

What is the difference between cyber insurance and tech E&O?

Cyber insurance covers your losses and liability when your own systems or data are attacked or exposed. Tech E&O covers claims that the technology products or services you provide to others failed or caused them financial loss. Technology companies usually need both and often buy them combined.

Does cyber insurance cover employee theft?

No. Theft of money or property by your own employees is covered by a crime policy under employee theft coverage. Cyber insurance focuses on outside attacks, data breaches, and privacy claims.

Does crime insurance cover wire fraud?

Often, depending on the insuring agreements. Computer fraud and funds transfer fraud coverage respond when an outsider moves money without your authorization. When an employee is tricked into sending money, most crime policies require a social engineering endorsement, usually with a lower sublimit.

Do I need both cyber and crime insurance?

If your business moves meaningful amounts of money by wire or ACH, or employees handle funds, the two together close gaps neither closes alone. Cyber covers the breach, ransomware, and liability side; crime covers employee theft and many fraudulent transfers.

Is professional liability the same as tech E&O?

Tech E&O is professional liability written for technology businesses. It covers failures of software, systems, and IT services. Other professional liability forms cover mistakes in accounting, legal, design, consulting, and similar services, and they often exclude technology and cyber claims.

Sources

This page is general information. How a loss is covered depends on the wording of your actual policies. Reviewed October 2026.

More in this guide

Cyber Insurance for Washington and Idaho Small Businesses: The Complete Guide
The complete guide this page is part of.
Washington Data Breach Notification Law: What a Small Business Must Do
Washington's breach law, RCW 19.255, explained for small businesses: what counts as personal information, the 30-day deadline, Attorney General notice, what the notice must say, vendors, encryption, and penalties.
Washington's My Health My Data Act: The Privacy Risk Most Businesses Miss
Washington's My Health My Data Act (RCW 19.373) reaches gyms, wellness studios, salons, apps, and retailers, not just health care. Who it covers, what it requires, the 2,000-foot geofence ban, and how cyber insurance fits.
What Does Cyber Insurance Cover? First-Party and Third-Party Coverage, Explained
Every part of a cyber insurance policy explained: breach response, ransomware, business interruption, data restoration, wire fraud, liability, regulatory, PCI, and media coverage, plus how limits, sublimits, and waiting periods work.
What Cyber Insurance Does Not Cover (and the Exclusions That Matter)
The cyber insurance exclusions and conditions that cause denied claims: prior knowledge, failing to maintain security controls, war and infrastructure exclusions, wrongful collection, betterment, contractual liability, and the gaps between cyber and crime.
Does My BOP or General Liability Policy Cover a Data Breach?
Why most business owners policies and general liability policies do not cover data breaches, ransomware, or wire fraud: the 2014 data breach exclusions, the electronic data exclusion, the small cyber endorsements some BOPs add, and how to check your own policy.
Do Small Businesses Need Cyber Insurance?
A practical way to decide whether your small business needs cyber insurance: the questions that matter, what Washington breach data shows about businesses like yours, and when a small policy or no policy is reasonable.
How Much Cyber Insurance Does a Small Business Need?
A step-by-step way to choose a cyber insurance limit for a small business: count your records, estimate downtime, find your largest payment exposure, check contracts, and set sublimits and a retention that fit. With Washington breach-size data.
What Drives the Cost of Cyber Insurance (and How to Lower It)
Why cyber insurance quotes vary so much between businesses: the rating factors insurers use, the security controls that move price and eligibility most, and practical ways to lower your premium without losing the coverage that matters.
What a Cyber Insurance Application Asks: MFA, Backups, Training, and More
The questions on a small business cyber insurance application, section by section: company details, data, multifactor authentication, backups, endpoint protection, patching, training, payment controls, and prior incidents, with a checklist to prepare.
A Client Contract Requires Cyber Insurance: What the Clause Means and What to Buy
How to read the cyber insurance requirement in a client, vendor, or lease contract: limits, coverage parts, additional insured, primary and noncontributory, notice, claims-made terms, certificates, and the red-flag clauses to negotiate.
Does Cyber Insurance Cover Wire Fraud and Fake Invoices?
How cyber and crime policies treat wire fraud, fake vendor invoices, CEO impersonation, and customers paying criminals: social engineering, funds transfer fraud, and invoice manipulation coverage, sublimits, verification conditions, and what to do in the first hour.
Ransomware and Cyber Insurance: What It Pays For, Including the Ransom
What a cyber policy pays after a ransomware attack: negotiation, the ransom where lawful, forensics, restoration, lost income, breach notification, and lawsuits. Plus the sanctions rules on paying, what insurers require, and the first steps to take.
Cyber Business Interruption: When Your Systems, or Your Vendor's, Go Down
How cyber business interruption coverage works: what it pays, waiting periods, the period of restoration, dependent business interruption for cloud and software vendors, system failure, how the loss is calculated, and lessons from the Change Healthcare and CrowdStrike outages.
What to Do in the First 24 Hours After a Data Breach in Washington
A practical first-24-hours checklist for a small business after a data breach or ransomware attack in Washington: who to call, what to preserve, what not to do, how the 30-day notice clock works, and how your cyber insurance fits in.
Cyber Insurance for Dental and Medical Practices in Washington
Cyber insurance for Washington dental offices, medical clinics, therapists, and other health practices: HIPAA breach rules alongside Washington law, the My Health My Data Act, vendor outages like Change Healthcare, and the coverage features that matter most.
Cyber Insurance for Law Firms and CPA Firms in Washington
Cyber insurance for Washington law firms, CPA firms, and tax preparers: the professional rules on client data (RPC 1.6, the FTC Safeguards Rule, IRS WISP), trust account and wire fraud risk, tax season exposure, and how cyber and professional liability fit together.
Wire Fraud in Washington Real Estate Closings: Escrow, Agents, and Cyber Coverage
How closing wire fraud works in Washington real estate, who is exposed (escrow agents, brokerages, lenders, attorneys, buyers, sellers), what Washington regulators tell escrow agents, the coverage each party needs, and what to do in the first hour.

Find out what your current policies actually cover.

Send us what you have. We review it line by line against your leases and contracts, and tell you plainly what is missing. Free, and no obligation.

Get a free policy review Call (425) 537-7773