Professional Liability (E&O) vs Cyber Insurance: What Each Covers

If a client contract asks for Professional Liability (E&O) and Cyber, they cover different risks: E&O covers claims that your work caused a loss, Cyber covers data breaches and attacks.

What does a Professional Liability (E&O) and Cyber requirement mean?

Many vendor contracts list both.

• Part (a) is Professional Liability. Did your work or advice fall short and cause a loss?
• Part (b) is Cyber. Did data get exposed, or did a system you run get attacked?
• Per claim is the most a policy pays for one claim. Aggregate is the most it pays for all claims in a policy year. On many of these policies, defense costs are paid inside the limits and reduce them.
• Both coverages are usually claims-made. The claim must be made and reported while the policy is active. The retroactive date is the earliest date of work that is covered. Cyber's own-cost coverage usually needs the incident reported during the policy. See claims-made vs occurrence.

Who asks for Professional Liability and Cyber?

Clients usually ask for both when you handle their data or run systems they use.

• Software, SaaS and IT service firms
• Marketing and analytics agencies, where a leaked mailing list is a privacy claim and a bad campaign is a service claim
• Consultants with access to client networks or financial records
• Vendors to healthcare organizations handling patient information
• Payroll and billing providers that hold bank and tax details

How do Professional Liability and Cyber insurance fit together?

What Professional Liability covers

Professional Liability usually pays to defend you and settle covered claims when a client says your service caused them a financial loss. It is third-party coverage, meaning it pays claims brought by others, not your own costs.

What Cyber covers

Cyber usually has two halves.

First-party coverage pays your own costs after a breach or attack. That can include the cost of tracing what happened (forensics), legal advice, notifying people and restoring data. Many also cover lost income.

Third-party coverage pays claims from others. For example, someone's data was exposed, or malware spread from your system to a client's.

Where they overlap and where gaps hide

• Overlap: say, hypothetically, your team's configuration error exposes client data. The client may allege both a service error and a security failure, so both policies could respond.
• Gap one: many Professional Liability policies exclude breach response costs and data claims. Without Cyber, you may pay for notification and forensics yourself.
• Gap two: many Cyber policies exclude claims that your services were done poorly, unless the failure was a security failure.
• Gap three: wire fraud from fake payment instructions, often called social engineering, may be a small sublimit (a lower cap inside the policy) or may need a separate crime policy (coverage for money stolen by fraud).

This is why tech firms usually buy Technology E&O, a form built for software and IT services, often combined with Cyber on one policy. Other service firms usually buy Miscellaneous Professional Liability (a general form for consultants and other service firms) and add Cyber. See Technology E&O vs Miscellaneous E&O.

Already have a policy? Request new quotes through Morrow for the combined or separate structure you need, keeping your retroactive date and prior acts coverage (coverage for earlier work) where the market allows. Report any known incidents to your current carrier before switching.

What will underwriters ask for?

• An application describing your services and data
• Revenue and your largest clients
• Security controls, such as a second step at login (multifactor), regular backups and software updates
• How many records you store, and whether they include health, payment or personal data
• Loss runs, which are reports showing your past claims and incidents
• The contract requirement and your current policies

What affects the cost?

• Your services, revenue and the data you hold
• Your security controls
• The limits, and whether they are shared or separate
• Your claims and incident history
• Your retention, the amount you pay on a claim before the policy pays, similar to a deductible

Frequently asked questions

Does Professional Liability cover a data breach?

Often only in part. It may respond if a client says your error caused a breach, but your own response costs usually fall under Cyber.

Does Cyber cover a claim that my work was wrong?

Usually not. A claim that your service fell short generally belongs to Professional Liability.

Is one combined Technology E&O and Cyber policy enough for a contract that lists both?

Often yes, if the limits and coverage parts match the clause. Check whether the contract wants separate limits, and confirm with the client that the policy meets the clause.

Can my client be added as additional insured on these policies?

Usually not on Professional Liability. Standard forms generally have no additional insured status, though some carriers may add a client for liability arising from your services. Cyber varies by policy, so check the wording. A certificate of insurance shows your limits, but it does not add anyone to the policy. If your contract requires it, tell Morrow so quote requests can ask for it.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.