$2M Professional Liability (E&O) Insurance for Cybersecurity Consultants

For cybersecurity consultants whose client contract asks for $2M, you usually need a Professional Liability (E&O) policy, often Technology E&O, with $2M per claim and $2M aggregate.

What does a $2M requirement mean for cybersecurity consultants?

Professional Liability (E&O, short for Errors and Omissions) can help when a client says your work caused them a financial loss. For security firms, the form is usually called Technology E&O. In a hypothetical case, a client says a penetration test report missed an exposed system and gave false comfort before a breach. A $2M clause often reads like this:

• Per claim: the most the policy pays for one claim. Here, $2M.
• Aggregate: the most it pays for all claims in a policy year. A $1M/$2M policy has only $1M per claim, so it can fall short.
• Claims-made: Professional Liability is almost always written this way. The policy covers claims made and reported while it is active, for work done after the retroactive date (the earliest date of work it covers).
• Cyber wording: some master services agreements (MSAs) ask for Technology E&O and Cyber limits separately. Read which limit applies to which coverage. See Professional Liability vs. Cyber.

Who asks cybersecurity consultants for $2M?

• Enterprise buyers whose procurement teams use one MSA template for every vendor.
• Banks, insurers and fintechs, which treat a security vendor as part of their own risk.
• Healthcare organizations that give vendors access to patient systems.
• Government and defense contractors that pass requirements down to subcontractors.
• Managed service providers and larger consultancies that hire you as a subcontractor.

Smaller projects often ask for $1M, and clients with large data exposure may ask for $3M. $2M often comes up when a firm moves from small clients to enterprise contracts.

How is $2M built?

At $2M, the limit is usually one primary policy (the policy that pays first), written as $2M/$2M. Some firms add excess layers (extra policies above the primary) only at higher limits. A commercial umbrella almost never covers Professional Liability, so it usually cannot fill the gap. See Does a commercial umbrella cover Professional Liability?

Security firms usually need Technology E&O, not a general consulting form (compare Technology E&O with Miscellaneous E&O). Many policies pay defense costs inside the limit, so legal fees can reduce what is left for a settlement. Additional insured status (coverage for a client under your policy) is usually not available on Professional Liability. Where a carrier does offer it, it is narrow and often limited to the client's liability arising from your services. Check what your contract asks for and whether a carrier can meet it. A certificate of insurance (a one-page proof of coverage) shows your coverage but does not change the policy. Many clients accept one.

What will underwriters ask for?

An underwriter is the insurer's reviewer who decides whether to offer coverage and on what terms. For security work, they often ask:

• Your service mix: penetration testing, red teaming, compliance audits, virtual CISO work, incident response or managed monitoring.
• How you set scope, get written authorization to test and document rules of engagement.
• Whether your contracts or reports promise a result, such as "no breach" or "audit pass."
• How you store and protect client data, credentials and test findings.
• Your largest clients, their industries and the contract requiring $2M, plus any limitation of liability clause (a cap on what you owe a client).
• Loss runs (a report of past claims), known incidents and your current retroactive date.

What affects the cost?

• Services offered. Hands-on testing and managed monitoring may cost more than advisory work.
• Client industries. Finance and healthcare clients may raise the cost, because a mistake there can mean larger losses.
• Revenue and contract size. Bigger engagements mean bigger possible losses.
• Claims history and controls. Written scopes, authorization letters and peer review may help.
• Retention and defense terms. A higher retention (what you pay before the policy pays) may lower premium. Defense outside the limit may add cost.

Frequently asked questions

I'm a cybersecurity consultant with $1M today. How do I get $2M Professional Liability?

Ask Morrow to request quotes for a new $2M policy. Where the market allows, the new policy may keep your retroactive date, so past work may stay covered. A gap in coverage can leave work uncovered, so line up dates before you switch, and report any known incident to your current carrier before you switch.

Does Technology E&O cover a breach at my own cybersecurity firm?

Usually not. Technology E&O mainly responds to claims about your services, and a breach of your own systems is usually a Cyber matter. Many firms buy both, because they hold client credentials and reports.

Will Professional Liability pay if my contract guaranteed a result?

Not always. Many policies limit coverage for promised results or contract liability beyond what the law would impose (see the contractual liability exclusion). Careful contract wording matters.

Why does the retroactive date matter when I switch to a $2M policy?

It decides which past work is covered. Moving to a new policy with a later date may leave older projects uncovered, so ask Morrow to seek quotes that keep your current date where the market allows.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.