$3M Professional Liability (E&O) for Cybersecurity Consultants

Cybersecurity consultants facing a $3M client requirement usually meet it with one $3M Professional Liability (E&O) policy, or a smaller primary policy plus excess.

What does a $3M requirement mean for cybersecurity consultants?

Professional Liability (E&O, short for Errors and Omissions) can help when a client says your work cost them money. For security firms, the form is usually called Technology E&O. A $3M clause often reads like this:

• Per claim and aggregate: both numbers must reach $3M.
• Claims-made: the policy covers claims made and reported while it is active. The retroactive date is the earliest work date it covers.
• Primary plus excess: if the clause does not say layers are allowed, confirm with the client that primary plus excess meets it.

Who asks cybersecurity consultants for $3M?

$3M tends to appear when the client is large and your work touches its systems:

• Enterprise master service agreements (MSAs) that set one insurance schedule for all vendors
• Banks, insurers and fintechs hiring penetration testers (people paid to try to break into their systems) or compliance assessors
• Healthcare systems that need security risk assessments
• Prime contractors passing their own requirements down to subcontractors

For example (hypothetical), a client might say a penetration test missed a weakness that was later used against it, and then ask your firm to cover its losses.

Many security firms start at $2M, so $3M usually means a larger client or deeper system access. Some deals go higher, such as $5M.

How is $3M built?

A primary policy pays first. An excess policy pays only after the layer below is used up. "$2M xs $1M" means a $2M layer above the first $1M.

Layers should follow form (use the same terms as the primary) and share the same retroactive date, policy period and named insured (the business the policy covers). Many policies pay defense costs inside the limit, so confirm each layer treats defense the same way. A commercial umbrella almost never covers Professional Liability, so it cannot fill the gap (see umbrella and Professional Liability). $3M usually needs a broker. Morrow can help you find it.

What will underwriters ask for?

An underwriter is the insurer's decision maker on whether to offer coverage and on what terms. For security work, they often ask for:

• Your services and share of revenue from each: penetration testing, advisory, incident response, compliance assessments or managed security
• Whether you get signed scopes of work and testing authorization before touching client systems
• Whether any contract guarantees a result or promises a client will not be breached
• How you handle client credentials, and whether subcontractors work for you
• The contract requiring $3M, your standard agreement with its limitation of liability clause (a cap on what you owe a client), loss runs (a report of past claims) and your retroactive date

What affects the cost?

• Your services. Ongoing managed monitoring usually carries more risk than one-time advice.
• Revenue and client size. Larger clients mean larger losses.
• Contract terms. Guarantees, broad indemnity (a promise to cover the client's losses) and uncapped liability can narrow options.
• Structure and retention. A single primary and a primary plus excess are priced differently. A higher retention (like a deductible) usually lowers premium.
• Claims history and defense terms. Past claims can limit options.

Frequently asked questions

Can a small cybersecurity firm get $3M Professional Liability?

Sometimes, but it depends on underwriting. Underwriters usually look at revenue and services when they set the top limit, so a small firm may be offered less than $3M, or $3M only as a primary plus excess.

Does Cyber insurance meet a $3M Technology E&O requirement?

Usually not. Cyber generally covers data and network security events, not a claim that your professional service failed, and contracts that name Technology E&O want that coverage.

Can my client be added as an additional insured on my Professional Liability?

Not automatically. A certificate of insurance (a one-page summary of your coverage) shows that you have coverage, but it does not add anyone to your policy. Some policies may allow it when a written contract requires it, usually only for the client's liability for your work. Check what your contract asks for.

My policy is $1M and my MSA asks for $3M. What do I do?

Request new quotes through Morrow for a $3M primary, or a primary plus excess. Morrow can ask for quotes that keep your retroactive date and prior acts coverage (coverage for work done before the new policy starts) where the market allows. Keep your current policy in force until the new one starts, and report anything that could become a claim to your current carrier before it ends.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.