The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Where other companies suffer an attack, a software company can distributeit. Anyone who reaches your build environment, your package repository or your signing keys does not need to break into your customers: your own update mechanism carries the code inside, past the firewall your customer had in place for exactly this purpose.
That shifts the emphasis to liability and to the question of what your licence and supply terms say. Users claim for downtime, data loss and their own recovery costs. Where a defective product causes loss to others, Article 6:185 of the Dutch Civil Code also comes into play, alongside the ordinary basis in tort in Article 6:162 DCC.
If you mainly manage customers' systems rather than distributing your own product, the cyber insurance for IT companies fits better; if you run the underlying infrastructure yourself, look at the one for hosting companies.
What does cyber insurance for software companies cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Your release chain is the real insured object
The questions an insurer asks a software company are rarely about your office network and almost always about the route from source code to customer: who can deploy to production, is there two-factor authentication on the repository, are builds signed and is there separation between development, test and production environments. Are third-party dependencies clearly documented? What you state about this is a disclosure within the meaning of Article 7:928 of the Dutch Civil Code and determines whether the cover holds up after an incident.
A defect in the code is not an incident, until it becomes one
Cyber policies cover loss arising from a security incident. A functional error leading to wrong calculations is a professional error and belongs with professional indemnity. A vulnerability exploited by third parties sits in between: cover then depends on whether you took up the report and patched it in time. Known, unremedied vulnerabilities are excluded at many insurers. So document when you received a report and what you did with it.
What your terms promise becomes your exposure
Availability guarantees, penalty clauses for late delivery and promised repair periods increase the claim without increasing the insurance. Liability accepted contractually that goes beyond liability in law, and penalties under a contract, are excluded on almost every cyber policy. Rebuilding or re-delivering your own software after an incident is not an insured loss either. The policy pays the loss suffered by your customers, not your own development hours.
Source code and customer data in your test environment
Two things leak more often at software companies than the production environment: the repository with source code and keys, and test environments holding real customer data because that made testing easier. The first is a trade secret and rarely replaceable. The second makes you, without any legal basis, the processor of data you did not need. Anonymise test data and scan your repository for keys committed by mistake; insurers ask expressly about the use of production data outside production.
What does your premium depend on?
Number of active users or installations. How many customers an infected or failing release can hit at once is the most important scaling factor.
Distribution model. Automatic updates to customer systems weigh more heavily than software the customer installs manually.
Security of the release chain. Access control on the repository and build environment, signed builds and a separated production environment.
Undertakings in your supply terms. Availability guarantees and liability limits determine how large a claim can turn out to be.
Personal data processed in your service. If you run a service yourself holding customer data, the data breach risk comes on top of the product risk.
Management of external components. Insight into the third-party libraries used and the speed with which you patch vulnerabilities in them.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your activities, turnover and wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
An update from us contained malicious code. Are customers' claims covered?
If the infection results from a break-in in your environment, liability towards affected customers falls under the cover in principle, together with the forensic investigation and the crisis communication. The limiting factors are the sum insured per year, which applies to all customers together, and penalty clauses in your contracts. Developing and rolling out a clean version again is your own cost.
Does a breach arising from a third-party library fall under the policy?
In principle yes, because there too there is a security incident. What matters is whether the vulnerability was already known and could have been remedied. Insurers exclude loss arising from vulnerabilities for which a patch had been available for a long time. So keep track of which external components you use and when you updated them. That overview is your most important document when a claim arises.
Does the cyber policy replace our professional indemnity insurance?
No. A calculation error, a missed specification or an implementation that does not do what was agreed is a professional error without a security incident. Those claims belong with professional indemnity. The cyber policy picks up where an attack, ransomware or a data breach lies behind the loss. The two policies exclude each other's territory, so the join has to be checked deliberately when taking out cover.
We host our software for customers ourselves. Does that change the cover?
Yes, because you then carry the availability risk alongside the product risk and are usually the processor of your customers' data. An outage of your service then becomes business interruption at dozens of customers at once, and a breach in your environment is a breach of their data. State this expressly in the application. It determines both the premium and the sum insured you need.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
