Technology insurance. One policy for the claim a client makes, and the day your systems stop.

Quick answerTechnology insurance is one contract holding three things: professional indemnity for the technology services you provide, public and products liability, and cover for your own losses after a cyber event, meaning incident response, business interruption, restoring your data, extortion response and cyber crime. A standalone professional indemnity or IT liability wording does not grant that last group in its base wording, and what your particular policy says about cyber is a question of its schedule and any endorsements on it.

The two parts most technology businesses already recognise. Professional indemnity answers the client who says your work, your advice or your code cost them money. Public and products liability answers injury to someone outside your business, or damage to their property. Both exist as policies in their own right, and what they cover, where their edges sit and how they are priced are set out on our professional indemnity insurance and public liability insurance pages. This page does not repeat any of it.

The part that defines the class. The third group is cover for your own losses, what the trade calls first party cover: the incident response and forensic work when something gets in, the cost of notifying the people whose data was exposed, your lost income while systems are down, restoring your own data, responding to extortion and ransomware, and fines from a privacy regulator where they are insurable. Those are the covers that fire in almost every real cyber claim, and they are the reason this product class exists at all. A combined policy of this kind is what brokers call a technology package.

An extension cannot manufacture a cover class. This is the point most owners miss when someone tells them their existing policy "can be extended for cyber". An insuring clause is the part of a policy that says "we will pay for this". An extension modifies an insuring clause the policy already has, and it cannot write in a promise to pay your own losses where the wording never made one. If the base wording contains nothing that pays your own losses, there is nothing for an extension to widen, and what you end up with is a broader liability cover rather than the cover that pays the forensic bill, the lost revenue and the data rebuild. That is a difference in class, not a difference in generosity.

Breaking a client contract is treated differently in this class. Standard professional indemnity wordings have traditionally reached liability you took on in a contract only by writing an exception back into an exclusion. Here, some wordings cover an unintentional breach of a client contract outright, as a section in its own right, and others make the contract exclusion simply inapplicable to the professional indemnity section. Cover written in as its own clause and cover reached only by an exception carved into an exclusion are not the same thing to read to a client. Two qualifiers do most of the work in that sentence. The first is unintentional: a deliberate or knowing breach sits outside the cover. The second is structural, because where that outright cover is built as a policy-wide exclusion with named sections written back in, a claim that lands outside those named sections is not covered. A separate exclusion for extended warranties can bite across the professional indemnity clause as well.

Your own unpaid fees are sometimes part of the deal, with a haircut. Several wordings in this market will pay fees you have not recovered, or have had to give up, to settle a dispute before it becomes a claim. The mechanics differ far more than the brochures do. Some strip nothing. Some cap the recovery at half the fee. Some strip the profit, the mark-up and the tax so that only your cost comes back, and at least one applies the same strip to fees you refund as to fees you recover, so a fee never comes back with margin on it in either direction. At least one pays only if you first obtain the client's written confirmation that they will not sue. None of that is visible from the name of the cover.

What a package is not. It is not a property policy wearing a different label. In one technology wording the cover that pays to reconstruct lost data requires a cyber event to have caused the loss, so records destroyed by a fire, or a box of files that goes missing, sit outside it. Property covers can be included in a package, but they are bought section by section like everything else in it, and often they are not bought at all.

And the schedule, not the wording, decides what you hold. Every product in this class is schedule driven. "The wording contains it" is never the same statement as "you have it", because the insuring clauses are purchased individually. The same rule settles the management liability question: some packages grant those covers, some have no grant at all, and at least one excludes the capacity outright, so the only honest answer is that the schedule decides. If that is the cover you are chasing, management liability insurance explains it properly.

Quick answerNo revenue figure answers this. The markers are structural: you hold client data, your income stops when your systems stop, clients now ask for evidence of cyber cover rather than a professional indemnity certificate alone, your contracts carry service credits or warranty obligations, or you hold administrative access to other businesses' systems.

You hold client data, and losing it is your problem before it is theirs. A liability wording answers what you owe someone else once they claim. It does nothing about the first two weeks: the forensic investigation, the legal advice on whether the breach is notifiable, the notifications themselves, the call centre, the credit monitoring, the regulator. Those costs land immediately, they land on you, and they land whether or not anybody ever sues.

Your income stops when your systems stop. For a business that sells its time, an outage is an inconvenience. For a business whose product is delivered through its own systems, an outage is the revenue. A standard liability wording has nothing to say about your own lost income, because that is not what it was built to do.

Your clients have started asking a different question. The contracts that used to ask for a professional indemnity limit now ask for evidence of cyber cover, incident notification timeframes, and sometimes for specific covers by name. When your clients' procurement teams have moved on and your policy has not, the certificate you hold stops being the one you are being asked for.

Your contracts carry teeth. Service credits, delay penalties and warranty obligations turn an ordinary project overrun into a defined sum of money you owe. Whether any of that is insurable is a genuinely open question that depends on the wording in front of you, which is why it has its own answer further down this page.

You hold administrative access to other businesses' systems. That is a different risk shape from everything above, and it gets its own section below.

One caution, because it runs both ways. This class is not a superset of a standard wording, and nobody honest will tell you it is. Standard IT and ICT wordings in this market can carry defence costs in addition to the limit rather than inside it, long lists of automatic extensions, tiered discovery periods and a one-off reinstatement of the limit. Those are real advantages, and this class does not match them uniformly. Moving a business that is well served where it is, purely because a package sounds more complete, is an expensive way to change nothing. The judgement is which problem you are actually solving, and that is a conversation rather than a calculation.

If your business is content-led rather than systems-led, a production company, a publisher, an agency or an events business, the weighting you want sits somewhere else again. See media liability insurance. And if you are not in the technology sector at all but want cover for a data breach, cyber insurance is the standalone version of the cyber covers described on this page.

Quick answerA managed service provider holds administrative access to other businesses' systems, so one compromise runs through every client at once. Most of the resulting loss belongs to the clients, which makes it a liability exposure and not only a loss of your own, and an ordinary small business cyber policy is not written for it.

You hold the keys. In our experience managed service providers are one of the fastest growing groups in technology and one of the riskiest, for a reason that is not complicated: you hold the keys to all of your clients' information systems. Every efficiency that makes the model work, one management platform, one set of privileged credentials, one deployment tool that reaches every client at once, is the same thing that makes a single compromise expensive.

One event, many claims, all at the same time. Most cyber losses run in sequence: something gets in, you find it, you fix it, you count the cost. For a managed service provider the chain runs in parallel. A compromise of the management plane takes down every client's systems at once. Every client's staff sit idle at once. Every client stops trading at once, from a single event. And most of that loss is not yours. It belongs to your clients, and they will come looking for it. That is precisely why a cyber policy written to protect your own data does not answer this exposure. It answers your loss, not theirs.

Why an ordinary small business cyber policy is the wrong answer here. Standard small business cyber wordings are written for a business that uses IT, not for one that sells it. Read the liability section of a widely used Australian wording of that type and you find an exclusion for actions brought against you because information technology services you provide, maintain, service or manage for a third party for a fee have failed, which is close to a definition of managed services. Be precise about where that sits: the exclusions applying across the whole of a policy like that are the narrower ones, covering recall, redesign or rectification of what you supply and warranties you have given, while the broad exclusion sits in the liability section, which is exactly where a managed service provider would be relying on it. There is a structural tell as well. Products of that kind are drafted from the point of view of a business that has an IT contractor, down to cover for a cyber event inside your IT contractor's business. The insured they imagine is your client, not you.

You are on both sides of the dependency. You are the supplier whose outage interrupts your clients. You are also a dependent business, because your own cloud vendors, your remote monitoring platform and your backup provider can take you down without anyone touching your network. A wording that answers one direction and not the other leaves half of the real exposure outside the policy.

The packages answer the one-event-many-clients problem in three different ways. Some route widespread or systemic events into their own smaller caps. Some exclude systemic causes outright. At least one grants dependent business interruption, which is cover for an outage at a supplier you rely on, as an explicit clause. Which of the three your wording does is a wording question, and it is not answered in a brochure.

Expect harder questions, and answer them exactly. The proposal questions put to a managed service provider go further than most technology businesses see: patching, how a change of bank details gets verified, who is allowed to authorise a payment. Some products in this market go further again and make cover conditional on controls of that kind. Whether yours does is in the wording rather than the brochure, and an answer given loosely at proposal is the answer an insurer reads again after a loss.

There is no separate managed service provider policy in this market, and no page here pretending there is one. What a managed service provider buys is a technology package arranged around the concentration risk that comes with holding other people's systems, and whether the dependency is answered in both directions is one of the wording questions to settle before the policy is bound.