Tech E&O and Insurability as the Next Siting Constraint

The final piece of the picture is technology errors and omissions, and it matters because infrastructure operators have quietly become technology companies. An operator that sells connectivity, data services, platform access, or managed capacity is not merely exposed to attacks on its own systems; it is exposed to claims that its technology failed to perform and caused a customer a loss. That exposure is professional liability, and tech E&O is the coverage built for it.

Tech E&O responds when the operator's technology product or service errs and a third party suffers financial harm as a result — a service that underperforms its contract, a platform that fails at the wrong moment, a defect that cascades into a customer's operations. It overlaps with cyber liability at the edges and must be coordinated with it, because a single event can look like both a security failure and a professional failure, and an operator does not want its insurers arguing over which policy responds while the claim sits unpaid. Where an operator functions as a technology vendor, tech E&O and the cyber tower should be read together as one program with a deliberately managed boundary.

The systemic dimension of tech E&O is the same accumulation risk that haunts the rest of cyber. A single technology provider whose product sits inside thousands of customers' operations can, through one defect, generate simultaneous losses across all of them. The 2024 disruption caused by a faulty software update from a widely deployed security vendor — which grounded flights, halted hospitals, and interrupted operations worldwide, without any attacker involved — illustrated the exposure starkly. It was not a cyberattack; it was a technology failure that propagated at the scale of the vendor's footprint. For insurers, that event underscored that the accumulation problem is not limited to malicious attacks. Ordinary technology failure, at sufficient scale, produces the same correlated, book-wide loss that makes cyber uniquely difficult to underwrite. Tech E&O carries that risk directly, and it is priced and structured with the aggregation in view.

Now assemble the whole course into its thesis. Standalone cyber insurance exists because digital loss is systemic and demanded its own architecture. Ransomware forced the market to share loss through sublimits, coinsurance, and conditions, and to bend to sanctions law. The war and state-backed exclusions wall off the correlated tail of state conflict, with attribution as the contested hinge. Underwriting prices the operator's security posture directly into terms. Tech E&O extends the same logic to operators who have become vendors. Run the chain to its conclusion and one proposition stands out: insurability has become a hard constraint on infrastructure, of the same character as the availability of power and water.

The reasoning is direct. Critical infrastructure is capital-intensive and debt-financed, and lenders and investors require that the risks of an asset be adequately insured before they will fund or continue to back it. Cyber risk is now among the most material of those risks, and cyber coverage is increasingly expensive, sublimited, conditional, or — for operators with weak posture or intolerable systemic exposure — simply unavailable. If a project cannot obtain viable cyber and tech E&O coverage on acceptable terms, it cannot be financed on acceptable terms, and an operation that cannot be financed cannot be built or sustained. Insurability therefore sits alongside the classic siting constraints. An operator has always had to ask whether a site has enough power and enough water. It must now ask whether the risk the site will carry can be insured at all.

See what follows for practice. Insurability is not a downstream administrative task to be handled after the engineering and the financing are settled. It is an upstream design input. The security architecture that will make the operation insurable should be designed in from the start, because it is cheaper to build than to retrofit and because it determines the terms on which capital is available. The vendor relationships that concentrate accumulation risk should be chosen with insurability in mind. The boundary between cyber and tech E&O should be coordinated before the operator becomes a vendor at scale. Each of these is a decision that the market will price, and pricing it well is the difference between a project that pencils and one that does not.

The operator who internalizes the thesis stops treating insurance as a document purchased at the end and starts treating insurability as a property of the operation, engineered from the beginning. That is the practitioner's mandate. Power and water tell you whether a site can run. Insurability now tells you whether it can be financed, defended, and sustained through the losses it will inevitably face. It is the next siting constraint, and it should be treated with the same seriousness as the two that came before it.