ICT and SaaS Insurance: A Complete Guide for Australian Tech Founders

This article is general in nature. For advice specific to your situation, book a call with the Pocket team.

What insurance does a tech business actually need?

Tech businesses face risks that standard insurance was never designed to cover. A bug that costs a client six figures. A data breach that triggers a regulatory investigation. A patent dispute that forces you to rebuild your codebase. None of these are covered by a generic business policy.

The cover you need starts with ICT Insurance (IT Liability) — Professional Indemnity and Public Liability built for tech, with IP protections usually sitting within the PI section. Cyber cover (which generally includes media liability) may be packaged into the same policy or arranged separately, depending on the insurer.

This guide explains what ICT Insurance is, what it covers (and what sits separately), how it changes at each stage of growth, and one wording trap worth watching for.

TL;DR

At its core, ICT Insurance (also called IT Liability) is Professional Indemnity and Public Liability built for technology businesses — covering your professional service failures and third-party injury or damage. IP protections typically sit within the PI section itself. Cyber cover (which generally includes media liability) may be packaged into the IT Liability policy or arranged as its own separate policy, depending on the insurer. Pocket can arrange it either way. If you're building software for clients, storing customer data, or operating a SaaS platform, you need this cover from Day 1, and your requirements grow materially as your business scales.

Key facts:

• ICT Insurance (IT Liability) is Professional Indemnity + Public Liability at its core: IP protections usually sit within the PI section, and cyber cover (which generally includes media liability) may be packaged in or arranged as a separate policy, depending on the insurer.
• Watch the wording: some IT Liability policies carry a full cyber exclusion, which can create problems when a claim sits in the grey area between a professional error and a cyber event. Checking for this is exactly where a broker earns their keep.
• When you raise or sign enterprise clients, insurance often becomes a precondition — but which cover depends on who's asking. Investors typically require Directors & Officers (D&O) cover before a round closes (often $2-5M by Series A); enterprise clients typically require PI and cyber before they'll sign. It's a commercial prerequisite, not just risk management.
• Under Australia's Privacy Act, many businesses must notify affected individuals and the OAIC of eligible data breaches, and the notification, response, and legal costs add up quickly — often well before any fine is considered.
• The average self-reported cost of cybercrime for a small Australian business is $56,600 (Source: ASD Annual Cyber Threat Report 2024-25).
• ICT Insurance is not the same as standard Professional Indemnity. Most standard PI policies explicitly exclude cyber events, IP claims, and technology-specific risks.

What is ICT Insurance?

Who this is for

ICT Insurance (Information and Communications Technology Insurance) is purpose-built cover for businesses that build, sell, or operate technology products and services. It's the right policy if you:

• Build software for paying customers (SaaS, apps, platforms, APIs)
• Provide IT consulting, implementation, or managed services
• Store, process, or transmit customer data
• Develop products that integrate with or depend on third-party systems
• Provide cloud, hosting, or infrastructure services
• Operate e-commerce platforms that handle payments

Standard Professional Indemnity is not a substitute. Most generic PI policies contain explicit exclusions for cyber events, intellectual property disputes, and technology-specific failures. If you're a tech business buying a standard PI policy, you may be uninsured for your most likely claims.

Do you need it?

Yes, from Day 1 if: you have any paying customers, users (even free), client data, or contractual obligations around software performance or data handling.

Probably not, if: you're a pure consulting business with no software product, no customer data, and no contractual deliverables involving technology. (A standard PI policy likely suffices.)

Get an ICT Insurance quote from Pocket →

What ICT Insurance covers

It helps to think of ICT cover in two layers: the core (what an IT Liability policy is built on) and cyber (which may be packaged in or arranged separately, depending on the insurer).

A quick note on how the pieces fit, because it trips people up: IP cover usually sits within the PI section of the IT Liability policy itself, while media liability can fall into either PI or cyber depending on the circumstances. Cyber cover itself may be packaged into the IT Liability policy or arranged separately, depending on the insurer.

The core: Professional Indemnity + Public Liability

This is what "ICT Insurance" or "IT Liability" fundamentally is. Every tech business building or servicing for clients needs these two.

Professional Indemnity for tech. Standard PI covers advice errors. ICT-specific PI extends to the full range of technology service failures:

IP protections like the last four typically sit within the PI section of an IT Liability wording, but it's worth confirming on your specific policy, as the exact inclusions vary.

Public Liability. Covers third-party injury or property damage connected to your business — for example, a client injured at your office, or damage caused during an on-site implementation. Standard for any operating business, and part of the IT Liability core. Note the PL limit typically doesn't match your PI limit — it's usually a minimum of $10M, and can be $10-20M depending on the insurer.

Cyber cover: packaged in, or arranged separately

Here's the part that trips people up. Cyber cover is not automatically part of an IT Liability policy. Some insurers package it into a single tech policy; many others cover PI/PL only, and cyber is arranged as its own separate policy. Pocket can arrange it either way — the right structure depends on the insurer and your risk.

Cyber and Privacy Liability:

The wording trap worth watching for

There's one thing worth checking on any IT Liability policy: some carry a full cyber exclusion. That's more than just "cyber isn't included" — it means the policy can decline to respond where a claim touches on a cyber event at all.

The problem is the grey area. Plenty of real-world claims sit somewhere between "a professional error or omission" and "a cyber event" — a coding mistake that also exposes data, for example. With a full cyber exclusion in place, an insurer may decline the whole claim simply because a cyber element was involved, even where your professional work was the root cause.

Not every insurer applies this exclusion, but it's common enough to look for. This is exactly the kind of wording a broker checks before you buy, and exactly the kind of gap you don't want to discover at claim time.

What's not covered

Important gap to know: ICT Insurance doesn't cover losses to your own business from a cyber incident, only third-party claims. If you want cover for your own income lost while recovering from a breach, you need a separate Cyber Insurance policy with a first-party Business Interruption extension. Pocket can combine these — talk to the team.

Who needs ICT Insurance and when

You need it from Day 1 if you are:

• Building software for paying customers
• Handling any customer data (even a free tier)
• Providing SaaS, PaaS, or cloud services
• Developing mobile or web applications
• Offering IT consulting or implementation services
• Taking online payments
• Storing user information

The question isn't revenue, it's exposure. A pre-revenue startup with 500 beta users has privacy liability from the moment it stores their email addresses. A bug in a free beta that corrupts user data can still generate claims.

A note on the Privacy Act (and why it's tightening)

There's a common misconception that privacy obligations only kick in once you're a big company. The reality is more nuanced, and it's changing:

• The threshold today: the Notifiable Data Breaches (NDB) scheme has historically applied to businesses with annual turnover over $3 million.
• But the exceptions catch many tech businesses regardless of size: the small business exemption does not apply if you handle health information, hold tax file numbers, trade in personal information, or are a government contractor. A health-tech or fintech startup, or any business whose product effectively deals in personal data, can be caught well under the $3M threshold.
• And it's tightening: privacy reform is progressively narrowing the small business exemption, bringing far more small businesses into scope over the coming period. Building good data-handling practices early is far easier than retrofitting them, and it's often the same moment you're signing enterprise contracts and raising capital that assume you're already compliant.

(Privacy law is actively reforming — treat this as general guidance and check your current obligations, or get advice, rather than assuming your status.)

Contracts and investors will require it

Many client contracts, particularly with enterprise customers, government, and large corporates, specify minimum insurance requirements. Common requirements:

A note on who requires what: investors typically require Directors & Officers (D&O) cover before a round closes — by Series A, term sheets commonly specify $2-5M D&O limits. Enterprise clients are the ones who typically require PI and cyber before they'll sign. So if you're approaching a raise, D&O is the one to have in place; if you're closing enterprise deals, PI and cyber. Getting either sorted late can stall the deal.

ICT Insurance by founder stage

Start smart — pre-launch to Year 1

Typical program:

• $1-2M Professional Indemnity (ICT-specific), with IP cover typically sitting within the PI section
• Public Liability typically $10-20M (it doesn't match the PI limit; usually a $10M minimum)
• $1M Cyber cover packaged with the above by some insurers, or arranged as a separate policy

You need this from Day 1 when: you have users (paid or free), client contracts, or any data obligations.

Scale strong — growing and hiring

Your cover needs to increase when:

• Revenue exceeds $1M
• You're storing thousands of customer records
• You're signing enterprise clients with higher PI requirements
• Contracts specify $5M+ cover
• You're processing sensitive data (health records, financial data)
• You're expanding internationally — GDPR, CCPA, and other jurisdictions
• You're raising significant capital

Typical program at this stage: $5M-$10M PI, $2M-$5M Cyber. Note the cover doesn't broaden as you scale — the limits grow with your PI and cyber limits (IP sits within PI, media within cyber, so they rise with those). Many businesses at this stage also start asking about D&O / Management Liability and Commercial Legal Expenses — not necessarily part of a typical ICT program, but worth a conversation.

Stay protected — established and optimising

Review your cover when:

• You launch new products or services with different risk profiles
• You change your tech stack significantly
• You've had a near-miss — a bug, a security incident, a client complaint
• You're being acquired or merging (representation and warranty exposure)
• You enter regulated markets (health, finance, government)
• Your data holdings grow materially

At this stage, your program is custom. The right limits, structures, and extensions depend on your specific business. Talk to the team rather than trying to work it out from a product page.

Coverage questions tech founders actually ask

"Isn't this just Professional Indemnity?"

Partly. ICT/IT Liability is built on Professional Indemnity, but it's PI designed for technology work. A generic PI policy covers advice errors ("I gave you bad advice and you suffered loss"); ICT-specific PI extends to software failures, system downtime, failed implementations, and data corruption, and is paired with Public Liability, with IP protections usually sitting within the PI section. Cyber (which generally includes media liability) is the piece that some insurers package in and others leave separate. And watch for a full cyber exclusion on some IT Liability policies — it can bite when a claim blurs the line between a professional error and a cyber event.

"What if we use open source code?"

You're still liable if open source components in your product lead to a third-party claim. IP cover may respond to infringement claims arising from open source use, but licence compliance breaches (like failing to open-source your own code as required, or misattributing authorship) sit in a genuine grey area under most wordings. This is worth confirming rather than assuming, and it's exactly the kind of clause a broker should check before you rely on it.

"Does this cover us if AWS goes down?"

Indirectly. If you have contractual SLA obligations to customers and your platform is unavailable due to infrastructure failure, ICT Insurance may cover client claims against you for the resulting loss. It doesn't cover your own lost income — that's a separate BI extension. It also doesn't cover you suing AWS (your ability to do that depends on AWS's terms of service).

"What about employee IP theft — taking code to a competitor?"

Most ICT policies include a fidelity component covering employee theft of IP and trade secrets. Prevention through strong IP assignment clauses, NDAs, and access controls remains the more practical first line of defence, but insurance covers the legal costs and losses when it does happen.

"Do VCs require this?"

The cover investors require is usually Directors & Officers (D&O), not PI. Most institutional investors want D&O in place before a round closes — by Series A, term sheets commonly specify $2-5M D&O limits, because incoming board members want personal liability protection as a condition of joining. PI and cyber are more often required by enterprise customers before they'll sign. So arrange D&O ahead of a raise, and PI/cyber ahead of enterprise sales. (D&O sits under Management Liability — ask us if you're approaching either milestone.)

Quick reference: ICT insurance program by business type

Indicative only. Your specific requirements depend on contract values, data volumes, and client requirements.

Your tech business needs tech-specific insurance

Standard insurance wasn't built for software failures, data breaches, or IP disputes. Pocket works with tech founders at every stage, from pre-launch to post-Series A, to build the right ICT program for where you are now and where you're going.

Book a free call with the team →

Or go straight to a quote: Get an ICT Insurance quote →

With Pocket is a business name of Insurance Services Holdings Pty Ltd (ABN 36 612 629 295, AFSL 491165). Member of NIBA. Part of the Steadfast Group. This article is general in nature and does not constitute financial or legal advice.