Incident response
- 24/7 reporting line
- Forensic investigation
- Recovery and restart
Cyber insurance for software companies
A software company supplies not only a product but also the channel through which an infection reaches all users at once.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
This page in another language: Nederlands
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
- Independent advice
- Several insurers
- Switching arranged
- Help with claims
In brief
Where other companies suffer an attack, a software company can distributeit. Anyone who reaches your build environment, your package repository or your signing keys does not need to break into your customers: your own update mechanism carries the code inside, past the firewall your customer had in place for exactly this purpose.
That shifts the emphasis to liability and to the question of what your licence and supply terms say. Users claim for downtime, data loss and their own recovery costs. Where a defective product causes loss to others, Article 6:185 of the Dutch Civil Code also comes into play, alongside the ordinary basis in tort in Article 6:162 DCC.
If you mainly manage customers' systems rather than distributing your own product, the cyber insurance for IT companies fits better; if you run the underlying infrastructure yourself, look at the one for hosting companies.
Independent, personal, sorted quickly
We compare your cyber insurance across dozens of insurers, explain where the real differences lie, and arrange the switch from start to finish — without you having to chase it yourself.
Cyber insurancePhoto coming soon
ComparePhoto coming soon
Get coveredPhoto coming soon
What does cyber insurance for software companies cover?
The structure of the cover in three parts, with an overview per situation below.
Own damage
What the incident costs you yourself.
- Data recovery and reconstruction
- Business downtime
- Ransom under consideration
Liability
Claims from customers and data subjects.
- Claims after a data breach
- GDPR notification costs
- Legal assistance
What is covered
| Situation | Cyber | AVB | BAV |
|---|---|---|---|
| Ransomware brings your systems down | Yes | No | No |
| Data breach involving personal data | Yes | No | Sometimes |
| Costs of notification and informing those affected | Yes | No | No |
| Fraud through a falsified payment instruction | Sometimes | No | No |
| Administrative fine from the regulator | No | No | No |
| Hardware that is physically damaged | No | No | No |
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
What does your premium depend on?
- Number of active users or installations. How many customers an infected or failing release can hit at once is the most important scaling factor.
- Distribution model. Automatic updates to customer systems weigh more heavily than software the customer installs manually.
- Security of the release chain. Access control on the repository and build environment, signed builds and a separated production environment.
- Undertakings in your supply terms. Availability guarantees and liability limits determine how large a claim can turn out to be.
- Personal data processed in your service. If you run a service yourself holding customer data, the data breach risk comes on top of the product risk.
- Management of external components. Insight into the third-party libraries used and the speed with which you patch vulnerabilities in them.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your activities, turnover and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
Why arrange it through Finass Verzekert?
We look at the terms as well as the premium, and stay your point of contact when there is a claim.
Independent
We are not tied to one insurer and compare on the basis of an objective analysis of several companies.
One fixed adviser
You call or email someone who knows your file. No menu options, no changing call centres.
Switching without hassle
We cancel your old policy and align the start date, so you are never a day without cover.
Help with claims
We report the claim and monitor how it is handled. In urgent cases you can reach us on the emergency line.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Your release chain is the real insured object
The questions an insurer asks a software company are rarely about your office network and almost always about the route from source code to customer: who can deploy to production, is there two-factor authentication on the repository, are builds signed and is there separation between development, test and production environments. Are third-party dependencies clearly documented? What you state about this is a disclosure within the meaning of Article 7:928 of the Dutch Civil Code and determines whether the cover holds up after an incident.
A defect in the code is not an incident, until it becomes one
Cyber policies cover loss arising from a security incident. A functional error leading to wrong calculations is a professional error and belongs with professional indemnity. A vulnerability exploited by third parties sits in between: cover then depends on whether you took up the report and patched it in time. Known, unremedied vulnerabilities are excluded at many insurers. So document when you received a report and what you did with it.
What your terms promise becomes your exposure
Availability guarantees, penalty clauses for late delivery and promised repair periods increase the claim without increasing the insurance. Liability accepted contractually that goes beyond liability in law, and penalties under a contract, are excluded on almost every cyber policy. Rebuilding or re-delivering your own software after an incident is not an insured loss either. The policy pays the loss suffered by your customers, not your own development hours.
Source code and customer data in your test environment
Two things leak more often at software companies than the production environment: the repository with source code and keys, and test environments holding real customer data because that made testing easier. The first is a trade secret and rarely replaceable. The second makes you, without any legal basis, the processor of data you did not need. Anonymise test data and scan your repository for keys committed by mistake; insurers ask expressly about the use of production data outside production.
Frequently asked questions
This is what people ask us most.
An update from us contained malicious code. Are customers' claims covered?
If the infection results from a break-in in your environment, liability towards affected customers falls under the cover in principle, together with the forensic investigation and the crisis communication. The limiting factors are the sum insured per year, which applies to all customers together, and penalty clauses in your contracts. Developing and rolling out a clean version again is your own cost.
Does a breach arising from a third-party library fall under the policy?
In principle yes, because there too there is a security incident. What matters is whether the vulnerability was already known and could have been remedied. Insurers exclude loss arising from vulnerabilities for which a patch had been available for a long time. So keep track of which external components you use and when you updated them. That overview is your most important document when a claim arises.
Does the cyber policy replace our professional indemnity insurance?
No. A calculation error, a missed specification or an implementation that does not do what was agreed is a professional error without a security incident. Those claims belong with professional indemnity. The cyber policy picks up where an attack, ransomware or a data breach lies behind the loss. The two policies exclude each other's territory, so the join has to be checked deliberately when taking out cover.
We host our software for customers ourselves. Does that change the cover?
Yes, because you then carry the availability risk alongside the product risk and are usually the processor of your customers' data. An outage of your service then becomes business interruption at dozens of customers at once, and a breach in your environment is a breach of their data. State this expressly in the application. It determines both the premium and the sum insured you need.
Every situation is different. For these situations we have a separate page.
- Compare business cyber insuranceThe main page
- Cyber insurance for web agenciesClient websites, management access, hosting
- Cyber insurance for IT companiesCustomer systems, access, supply chain risk
- Cyber insurance for marketing agenciesClient accounts, advertising budget, data
- Cyber insurance for webshopsPayment details, customer data, downtime
- Cyber insurance for hosting companiesCustomer systems, downtime, supply chain
- Cyber insurance for shopsTill system, card terminal, customer data
- Cyber insurance for psychologistsTreatment records, confidentiality, duty to report
- Cyber insurance for employment agenciesCandidate data, citizen service numbers, payroll processing
Read more
Ready to compare?
Request a quote without obligation. We will look at which insurer best matches your activities and your risk.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was compiled by Finass Verzekert (LinkedIn). Last updated on .
The information on this page is general in nature and is not personal advice.