$2M Professional Liability (E&O) Insurance for Security Consultants

For security consultants whose client contract asks for $2M, Professional Liability must pay up to $2M per claim, so a $1M/$2M policy usually does not meet the clause.

What does a $2M requirement mean for security consultants?

Professional Liability (E&O, short for Errors and Omissions) covers claims that your advice, plans or reports caused a client a financial loss. A $2M clause might read like this:

• Per claim: the most the policy pays for one claim. Here, $2M.
• Aggregate: the most the policy pays for all claims in one policy year. Here, also $2M. See Professional Liability limits explained.
• Claims-made: Professional Liability almost always covers claims made and reported while the policy is active, for work done on or after the retroactive date (the earliest date of work the policy covers).

Who asks security consultants for $2M?

It tends to show up when the client has a lot to lose if your advice falls short:

• Energy and utility companies hiring site assessments.
• Manufacturers with high-value plants or warehouses.
• Insurers that hire outside consultants for security surveys.
• Law firms that need an outside security opinion for a lawsuit.
• Construction companies with large project sites.
• Government agencies, where the limit is often set in the bid or request for proposal (the agency's written call for offers).

Hypothetical examples: an assessment misses a gap in a fence line and a costly theft follows, or a design spec has an error and the client pays to redo the install. Critical infrastructure or very large sites may ask for more than $2M. See $3M for security consultants.

How is $2M built?

At $2M, the limit is usually one primary policy (the policy that pays first). Security advisory firms usually buy a general consulting form of Professional Liability. If you also test networks (penetration testing), you usually need Technology E&O, which covers tech services, instead. Firms that supply guards or do investigations may need a different form.

A commercial umbrella (extra liability coverage above other policies) almost never covers Professional Liability, so it usually cannot fill the gap from $1M to $2M. Clients usually cannot be added as an additional insured (a party listed on your policy so it can claim coverage directly) on Professional Liability. A certificate of insurance (a one-page proof of your coverage) is the usual substitute.

What will underwriters ask for?

An underwriter is the person at the insurer who decides whether to offer coverage and on what terms. For security consultants, expect questions like these:

• Your service mix (assessments, design, training, threat assessment or litigation support) and the share of revenue for each.
• Whether you provide guards, armed staff, investigations or on-site response, or only give advice.
• Whether you do any cybersecurity work, such as penetration testing.
• Whether you sell, install or earn fees from security products you recommend.
• Your client types, such as schools, hospitals, energy sites, public utilities and government.
• Revenue, largest contracts, licenses held, prior claims and your current retroactive date.

What affects the cost?

• Type of work. Threat assessment and plans for crowded or critical sites usually cost more than training or policy writing.
• Hands-on services. Guards, armed staff or investigations add risk and can change which form you need.
• Revenue and contract size. Bigger sites and bigger contracts mean bigger possible losses.
• Limit structure. Higher per-claim limits usually cost more. A higher retention (the amount you pay on each claim before the policy pays, like a deductible) usually lowers the premium.
• Claims history and retroactive date. Keeping an early retroactive date may cost more but protects older work.

Frequently asked questions

I carry $1M today as a security consultant. How do I get $2M?

Request new quotes for a $2M policy through Morrow. Morrow can ask carriers to keep your retroactive date and prior acts coverage (coverage for work done before the new policy began) where the market allows. Keeping your current policy in force until the new one starts may help avoid a gap in coverage. Report anything that could become a claim to your current carrier before that policy ends.

Is $2M normal for a security consultant?

$2M is higher than many small firms start with. Many start at $1M (see $1M for security consultants). Some clients go higher (see $3M for security consultants).

Will my Professional Liability cover a break-in at a site I assessed?

It may cover a claim that your assessment or advice was negligent and caused a financial loss. Professional Liability generally excludes bodily injury and property damage. General Liability (coverage for bodily injury and property damage claims) may also exclude injury or damage that comes from professional advice, so a claim can fall between the two policies. Check both policies for professional services exclusions. See Professional Liability vs. General Liability. The exact answer depends on the policy wording.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.