$1M Professional Liability (E&O) Insurance for Cybersecurity Consultants

For cybersecurity consultants whose client contract asks for $1M: this usually means Technology E&O at $1M per claim, so check whether it also asks for a $2M aggregate.

What does a $1M requirement mean for cybersecurity consultants?

It means your Professional Liability (E&O, short for Errors and Omissions) policy must pay up to $1M when a client says your work caused a financial loss. Security firms usually buy it as Technology E&O. A clause in a master services agreement (MSA, the main contract for all work with a client) may read like this:

• Per claim: the most the policy pays for one claim. Here, $1M.
• Aggregate: the most it pays for all claims in a policy year. Here, $2M.
• Matching the numbers: a $1M/$1M policy does not meet a $2M aggregate. A $1M/$2M policy usually meets either wording, but check the rest of the clause.
• Claims-made: the policy covers claims made and reported while it is active, for work done after the retroactive date (the earliest work date the policy covers). That is why clauses ask you to keep coverage after the job ends.

See also Professional Liability limits explained.

Who asks cybersecurity consultants for $1M?

Mid-sized security clients, software companies and prime contractors most often ask for $1M.

• Mid-sized companies hiring you for a penetration test (an authorized attempt to break into their systems) or security assessment.
• Software companies that need compliance work, such as SOC 2 or ISO 27001 preparation, to close sales.
• Outsourced security leadership clients (a "virtual CISO" is a part-time security chief), often under an MSA.
• IT providers and prime contractors that subcontract security work and pass their insurance terms down to you.

$1M is a common starting point, but enterprise buyers, banks, healthcare organizations and government agencies often ask for more, especially for incident response and managed security work. If your contract asks for more, see $2M for cybersecurity consultants.

How is $1M built?

At $1M, the limit is usually one primary policy (the policy that pays first), with no excess layers (extra policies above it). Morrow can review the contract and your policy for problems, such as a retroactive date that is too late, wording that excludes security testing, or a clause that asks for more than the policy gives.

A commercial umbrella almost never covers Professional Liability. Clients are not added as an additional insured (named as covered under your policy) automatically. Some forms allow it when a written contract requires it, usually only for liability from your services. Some clients accept a certificate of insurance (a one-page summary of your coverage) instead, so check your contract. Many policies also pay defense costs inside the limit, so legal fees can shrink what is left for a settlement.

What will underwriters ask for?

An underwriter is the person at the insurer who decides whether to offer coverage and on what terms. For cybersecurity firms, they usually ask about:

• Your services and revenue share for each, such as testing, advisory, incident response or monitoring.
• Whether you only advise or also run or monitor client systems.
• Written scopes and signed authorization for every test.
• Whether contracts promise outcomes, such as "no breaches."
• How you protect your own systems and client data, and whether you use subcontractors.
• Revenue, largest engagements, prior claims, known incidents and your retroactive date.

What affects the cost?

• Type of work. Hands-on testing and incident response usually cost more than advice.
• System access. Running or monitoring client systems usually raises the price.
• Revenue and engagement size. Bigger contracts mean bigger possible losses.
• Claims history and contract terms. Prior claims or promised outcomes can raise it.
• Aggregate, retention and defense terms. $1M/$2M usually costs more than $1M/$1M. A higher retention (what you pay on each claim before the policy pays) usually lowers premium.

Frequently asked questions

What does a Professional Liability claim against a cybersecurity consultant look like?

It usually starts when a client says your work caused a financial loss. These examples are hypothetical. A firm finishes a penetration test and reports no serious findings. Months later, a client suffers an attack through a weakness the test missed, and says the report gave false comfort. In another, a monitoring rule a firm configured fails to alert, and the client blames the firm. Even an unfounded claim can be costly to defend.

Is $1M/$1M enough, or do I need $1M/$2M?

It depends on your contract. If it asks for a $2M aggregate, $1M/$1M does not meet it. If it only says $1M, confirm with the client which structure they accept. Morrow can review the clause with you.

I already have a policy. What if my contract needs more than $1M?

Request new quotes through Morrow, either a new primary at the higher limit or excess layers. When Morrow requests quotes, it can ask that your retroactive date and prior acts coverage be kept where the market allows. Report any known incident to your current carrier before you switch.

Do I need Cyber as well as Technology E&O as a cybersecurity consultant?

Often, yes. Clients commonly ask for both, since you hold sensitive access and data. Morrow can check whether the contract's wording is met by one combined policy or by two.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.