For cybersecurity consultants whose contract asks for $5M, that usually means $5M per claim and $5M total per year, met by one policy or a smaller policy plus extra limit.
The short answer
- A $5M requirement for cybersecurity consultants usually means $5M per claim / $5M aggregate (the most paid for one claim, and for all claims in a year).
- Security firms usually buy Technology E&O, often combined with Cyber. You may get one $5M primary policy (the policy that pays first), or a smaller primary plus an excess layer (extra limit on top) that follows form (uses the same terms as the primary policy).
- $5M is very rare online. You will almost always need a broker who can request quotes from specialty markets, including excess and surplus lines (E&S) markets, which cover risks standard insurers often decline. Morrow can help you find it.
What does a $5M requirement mean for cybersecurity consultants?
Professional Liability (E&O, for Errors & Omissions) insurance can help when a client says your work cost them money. Security consultants often buy it as Technology E&O. A $5M clause often reads like this:
Illustrative contract wording
Contractor shall maintain Technology Errors and Omissions insurance, including network security and privacy liability, with limits of not less than $5,000,000 each claim and $5,000,000 annual aggregate. If written on a claims-made basis, the retroactive date shall be no later than the effective date of this Agreement. Required limits may be met through any combination of primary and excess policies.
Illustrative example only. Actual contract wording varies.
- Per claim and aggregate: the clause sets both numbers.
- Cyber wording: Cyber insurance usually pays your own costs after a data incident. See Professional Liability vs Cyber.
- Claims-made: Professional Liability is almost always written this way. The policy covers claims made and reported while it is active. The retroactive date is the earliest date of work it covers.
- Primary plus excess: the last sentence lets you stack policies. If yours does not, confirm with the client that primary plus follow-form excess meets the clause.
Who asks cybersecurity consultants for $5M?
Many small security firms are asked for $1M or $2M, and $3M on larger jobs. Compared with $3M, a $5M clause usually shows up when the client holds regulated or production data. The step to $10M for cybersecurity consultants is covered separately. $5M usually comes from:
- Large enterprises whose master service agreements (MSAs) give you access to production systems or sensitive data.
- Banks, insurers and asset managers, where vendor risk teams may set one limit for all vendors
- Healthcare systems and health plans.
- Government agencies, where the limit is often written into the request for proposal (RFP).
Good to know
Hypothetical example. A firm's penetration test (an authorized simulated attack) finds no critical flaws in a client's payment system. Months later, an attacker uses a weakness the test did not cover. The client blames the report and asks the firm to pay its breach costs.
How is $5M built?
An excess policy pays only after the primary limit is used up. "$3M xs $2M" means a $3M layer above the first $2M.
Example A: one policy
Example B: two layers
Every layer should share the same retroactive date, policy period and named insured (the business the policy covers), so there is no gap. Many policies pay defense costs inside the limit, so confirm each layer treats defense the same way.
What will underwriters ask for?
An underwriter decides whether to offer coverage and on what terms. Expect questions like these:
- Your mix of services: penetration testing, incident response, virtual CISO (outsourced security leader) work or managed monitoring
- Whether you monitor client systems on an ongoing basis, hold client credentials or run tools in live production systems
- Whether you use written scopes and signed authorizations, and whether reports promise a system is "secure" or "compliant"
- How you protect client data and findings, including multi-factor authentication, encryption and subcontractors
- Your largest contracts and standard agreement, including any limitation of liability clause (a cap on what you owe a client)
- Three to five years of loss runs (a report listing past claims)
What affects the cost?
- Your services. Ongoing monitoring and incident response usually cost more to insure than one-time assessments or advisory work.
- Revenue and client size. Larger jobs for regulated clients raise exposure.
- How the $5M is built. The primary layer usually costs the most per $1M of limit. Excess is usually priced lower per $1M.
- Claims history and your own controls. Past claims and weak internal security can shrink the limit and raise the price.
- Retention and defense terms. Retention works like a deductible, and a higher one usually lowers premium. Defense outside the limit usually costs more.
Frequently asked questions
Can a small cybersecurity consulting firm get $5M Professional Liability?
Sometimes. It depends on revenue, services, client contracts and claims history. Smaller firms are often offered less than $5M, and primary plus follow-form excess is the usual route. That usually takes a broker. Morrow can help you find it. If your requirement is higher, see $10M for cybersecurity consultants.
Does my Cyber policy meet a $5M Technology E&O requirement?
Often not. Cyber policies often focus on your own data incidents. A claim that your advice or testing was wrong usually falls under Technology E&O.
Can my client be added as an additional insured on my cybersecurity consulting policy?
Usually not. Professional Liability protects you, not your client, so clients usually cannot be added as an additional insured (a party who gets some protection under your policy). A few policies may offer limited wording for a client, but carriers often refuse it. Ask for it when quotes are requested if your contract requires it. Many clients accept a certificate of insurance, a one-page proof of coverage that gives the holder no rights.
Can a commercial umbrella give me $5M as a security consultant?
Almost never. A commercial umbrella usually excludes professional services. You usually need a higher primary limit or follow-form excess. Read more on umbrellas.
Looking for $5M in Professional Liability? Morrow can help.
Send us the insurance requirement from your contract and your current policy. Morrow can review both and request quotes for a $5M primary policy or a primary and excess structure, keeping your retroactive date where the market allows.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.