$10M Professional Liability (E&O) Insurance for Cybersecurity Consultants

For cybersecurity consultants, a $10M Professional Liability (E&O) requirement usually comes from a very large client and is usually met with Technology E&O as a primary policy plus follow-form excess layers.

What does a $10M requirement mean for cybersecurity consultants?

Professional Liability (E&O, for Errors & Omissions) insurance can help when a client says your services caused a financial loss. For tech work, the policy is usually called Technology E&O. A $10M clause often reads like this:

• Per claim and aggregate: the most paid for one claim, and for all claims in the policy year. See how limits are written.
• Two coverages: Technology E&O responds to failed services. Cyber usually responds to data events and breach costs. See how they differ.
• Claims-made: the policy covers claims made while it is active. The retroactive date is the earliest date of work it covers.
• Primary plus excess: if the clause does not say you may stack policies, confirm with the client that primary plus follow-form excess meets it.

Who asks cybersecurity consultants for $10M?

The number reflects what could go wrong at the client, not the size of your firm. It usually comes from:

• Banks, insurers and asset managers that give you access to production systems
• Health systems and health plans where you may see patient data
• Some large government programs and prime contractors, though most public-sector contracts ask for less
• Large enterprises signing a master services agreement (MSA) for managed monitoring or an incident response retainer

Here is a hypothetical situation, not a real event. A firm finishes a penetration test (an authorized simulated attack on a client's systems), and the report says a client's network is sound. Months later, attackers use a flaw the test did not flag, and the client blames the report. See the $5M article for the more common ask.

How is $10M built?

A primary policy pays first. An excess policy pays only after the layer below it is used up. "$5M xs $5M" means a $5M layer above the first $5M. At $10M, it is usually placed as a tower (several policies stacked).

Every layer should share the same retroactive date, policy period and named insured (the business the policy covers), with no gaps. Many Professional Liability policies pay defense costs inside the limit, so confirm each layer treats them alike. Layers this high are rarely found online, and a broker usually places them. Morrow can help you find them.

What will underwriters ask for?

• Your service mix: penetration testing, security assessments, compliance readiness, virtual CISO work (part-time security leadership), incident response or managed monitoring (watching client systems for threats), and whether you promise outcomes such as "no breach" or only deliver advice
• Whether you test live production systems, and how you get written authorization and set the scope in each engagement
• What access you hold to client networks, credentials and data
• Your use of subcontractors, and a copy of the contract that requires $10M
• Your standard agreement, including any limitation of liability clause (a cap on what you owe a client)
• Three to five years of loss runs (a report listing past claims) and your current retroactive date

What affects the cost?

• Your services. Live testing, managed monitoring and incident response usually cost more to insure than advisory work.
• Revenue and client size. Larger clients and bigger engagements raise the exposure.
• How the tower is built. The primary layer usually costs the most per $1M. Higher excess layers are often priced lower per $1M.
• Claims history and contracts. Past claims and outcome promises in your contracts may raise the price or shrink the limit offered.
• Retention and defense terms. Retention works like a deductible. Defense outside the limit usually costs more.

Frequently asked questions

Can a small cybersecurity consulting firm get $10M in Professional Liability (E&O)?

Sometimes, but it can be hard. Smaller firms may be offered less than $10M. One path is a $1M or $2M primary plus excess layers where the market allows. Written scopes of work, signed authorization and a clean claims history often help. Morrow can help you find it.

Does my commercial umbrella count toward $10M?

Almost never. A commercial umbrella usually excludes professional services. You usually need a higher primary limit or follow-form excess Professional Liability. Read more on umbrellas.

Can my client be added as an additional insured on Professional Liability?

Usually not on Professional Liability, though some Technology E&O and Cyber policies may add a client by request when a written contract requires it. That protection is limited to claims arising from your services. A certificate of insurance (a one-page summary proving your coverage) proves coverage but grants no rights. Ask whether every layer follows the same terms.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.