Almost every software contract caps the vendor's liability, often tied to the fees paid over a period. A security tool vendor will not insure you against every breach, and you should not expect it to. What you can do is read the cap, ask about carve outs for data protection and confidentiality, and match the answer to your risk. This is general information, not legal advice.
What a cap usually looks like
A typical clause limits each side's total liability to a multiple of fees paid or payable in a recent period, and excludes indirect losses such as lost profit. Details vary a great deal, so read the actual text. Three things matter most:
- The amount. What is the cap, and is it per claim or total over the term?
- The exclusions. Which losses are excluded altogether?
- The carve outs. Which claims sit outside the cap?
Why a cap is not unreasonable
A scanner or monitoring tool reduces risk. It does not control whether you fix what it finds, whether an attacker uses a different route, or whether your own staff misconfigure something. A vendor that accepted unlimited liability for anything that went wrong on your systems would be pricing a promise it cannot control. Be wary of the reverse too: a vendor that promises complete protection. Our guide to evaluating a zero vulnerability promise explains why.
Carve outs worth asking about
- Confidentiality breaches by the vendor.
- Data protection obligations, where a vendor mishandles personal data in breach of the DPA. Some vendors offer a higher cap, called a super cap, for this. Whether they do is a negotiation.
- Indemnities for third party intellectual property claims against the product.
- Gross negligence or wilful misconduct, which many legal systems do not allow to be capped.
Not every vendor will agree, and smaller contracts have less room to negotiate. Ask anyway, and write down what you were told.
Match the ask to your exposure
If the tool only sees public repositories, the data exposure is low and the standard cap may be fine. If it holds private source, secrets or personal data, your risk is higher, and the vendor's data handling terms matter more than the number. Ask your own counsel what level of cap is acceptable for each kind of tool.
Insurance and the vendor
Ask whether the vendor carries cyber and professional liability insurance and whether it will state that in writing. The existence of cover does not change the cap, but it indicates whether the vendor could pay a claim.
Quick check
Can a vendor guarantee we will not be breached?
No honest vendor can. A tool reduces risk and gives you information. You still have to act on it.
Should we always negotiate the cap?
Not always. For low sensitivity tools the standard cap may be acceptable. Focus effort on data handling and confidentiality terms where the real risk sits.
Last reviewed: 19 October 2026.
