$3M Professional Liability (E&O) Insurance for Security Consultants

For security consultants whose client contract asks for $3M: it is a high limit, usually met with one $3M policy or a smaller policy with a second policy stacked on top.

What does a $3M requirement mean for security consultants?

Professional Liability (E&O, short for Errors and Omissions) covers claims that your advice, plans or reports caused a client a financial loss. A $3M clause might read like this:

• Each claim and aggregate: the most paid for one claim, and for all claims in a year.
• Claims-made: Professional Liability almost always covers claims made and reported while the policy is active, for work done on or after the retroactive date (the earliest date of work the policy covers).
• Three years after: keep every layer renewed, with the same retroactive date, or buy an extended reporting period (extra time to report claims) if a layer ends.
• Primary plus excess: the last sentence allows stacked policies. If yours is silent, confirm with the client that primary plus follow-form excess meets the clause.

Who asks security consultants for $3M?

A $3M request is less common than $1M or $2M. It usually means the client sees a large possible loss:

• Energy and utility companies hiring assessments for plants, substations or pipelines.
• Large manufacturers protecting high-value inventory.
• Government agencies and public authorities, where the limit is often set in the bid.
• Some insurers or risk-management firms, occasionally, for site security surveys.

Hypothetical example: your survey rates a warehouse as low risk, the client relies on it, and a large theft follows. That is a financial loss, the kind of claim Professional Liability is built for.

Bodily injury or property damage is different. Professional Liability generally excludes it. General Liability (the policy for bodily injury and property damage claims) often excludes harm from professional services too, so a gap can exist. See Professional Liability vs. General Liability.

How is $3M built?

A primary policy pays first. An excess layer is a separate policy that pays only after the primary limit is used up. "$1M xs $2M" means a $1M layer above the first $2M.

The excess should follow form, meaning it uses the same terms as the primary. If it adds its own exclusions, you could have $3M on paper but less for a claim. Every layer should share the same retroactive date and policy period.

Compared with $2M, a $3M requirement often pushes you from a single policy to a primary plus excess setup. For more than $3M, see $5M for security consultants.

If you buy a combined package, check that the excess sits above the Professional Liability part. A commercial umbrella almost never covers Professional Liability (see why umbrellas fall short).

Do you offer penetration testing or other cyber work? That is usually covered under Technology E&O (coverage for errors in tech services), often paired with Cyber (coverage for data breaches and system attacks).

What will underwriters ask for?

An underwriter decides whether an insurer offers coverage and on what terms. Expect questions like these:

• Your service mix by revenue: risk assessments, security design, threat assessment, training or litigation support.
• Whether you supply guards or investigations, or only give advice.
• Whether you sell or earn fees on security products you recommend.
• The contract requiring $3M and any limitation of liability clause (a cap on what you owe a client).
• Loss runs (a report of past claims) for three to five years, and your current policy.

What affects the cost?

• Type of work. Assessments for critical sites often cost more to insure than training, and guards or investigations add risk.
• Structure. A single $3M policy and a primary plus excess setup are priced separately, so compare both.
• Revenue and claims history. Larger contracts and past claims can raise it.
• Retention and defense terms. The retention works like a deductible; a higher one usually lowers premium. Many policies pay defense costs inside the limit, which leaves less to settle a claim.

Frequently asked questions

Do I need $3M Professional Liability as a security consultant?

Only if your contract or client requires it. $3M is on the high end. It usually comes up with critical infrastructure or public bids.

Is a $2M policy plus $1M excess enough if my contract says $3M?

In many cases, yes, if the excess follows form and the client accepts more than one policy. Confirm this with the client first.

Can my client be added as an additional insured (listed on your policy as a protected party)?

Usually not, and it is never automatic. Professional Liability is written to cover claims that arise from your own services. Some carriers may add a client for liability that arises from your services, and others will not. If your contract asks for it, send Morrow the wording to review. Some clients accept a certificate of insurance (a one-page proof of coverage) instead, but that is up to the client.

This article is general information, not legal advice or a coverage determination. Coverage depends on the actual policy wording, carrier underwriting and your contract terms.