Insurance for Penetration Testers
Professional liability insurance is essential protection for penetration testers. This guide covers the types of coverage you need, how to choose a policy, and what to look for in your coverage.
Not Optional
Why You Need Insurance
Without Insurance
- ❌ Personal assets at risk (home, savings, etc.)
- ❌ Legal defense costs out of pocket ($50K-$500K+)
- ❌ Damages paid personally
- ❌ Business closure risk
- ❌ Reputation damage with no recovery support
With Insurance
- ✅ Personal assets protected
- ✅ Legal defense covered
- ✅ Damages paid by insurer (up to limits)
- ✅ Business continuity supported
- ✅ Crisis management assistance
Real Cost Examples
Types of Insurance Coverage
Professional Liability / E&O Insurance
Errors & OmissionsProtects against claims arising from your professional services, including mistakes, negligence, and failure to deliver promised results.
Covers:
- ✅ Missing a vulnerability that gets exploited
- ✅ Accidental disclosure of findings
- ✅ Failure to meet contractual obligations
- ✅ Claims of professional negligence
- ✅ Legal defense costs
Typical Coverage:
- 📊 Limits: $1M - $5M per occurrence
- 📊 Aggregate: $1M - $10M annual
- 📊 Deductible: $1K - $10K
- 📊 Premium: $1,500 - $5,000/year
Cyber Liability Insurance
Technology E&O + Data BreachSpecifically designed for technology professionals. Covers data breaches, cyber incidents, and technology-specific risks.
Covers:
- ✅ Accidental system damage during testing
- ✅ Data breach during engagement
- ✅ Regulatory fines and penalties
- ✅ Notification costs
- ✅ Crisis management / PR support
First-Party vs Third-Party:
- First-Party: Your own losses
- • Business interruption
- • Data recovery costs
- Third-Party: Claims against you
- • Client damages
- • Legal defense
General Liability Insurance
Commercial General Liability (CGL)Covers bodily injury, property damage, and personal injury claims. Important for physical security testing and on-site work.
Covers:
- ✅ Slip and fall at client site
- ✅ Property damage (equipment, etc.)
- ✅ Personal injury claims
- ✅ Advertising injury
Especially Important For:
- 🔑 Physical penetration testing
- 🔑 Social engineering (on-site)
- 🔑 Red team operations
- 🔑 Any work at client facilities
Crime / Fidelity Insurance
Employee Dishonesty BondProtects against employee theft, fraud, and dishonesty. Important if you have staff or contractors with access to client systems.
How Much Coverage Do You Need?
| Business Size | Revenue | Recommended E&O | Recommended Cyber |
|---|---|---|---|
| Solo Consultant | < $250K | $1M / $1M | $1M |
| Small Firm (2-10) | $250K - $1M | $2M / $2M | $2M |
| Mid-Size (10-50) | $1M - $5M | $5M / $5M | $5M |
| Large Enterprise | > $5M | $10M+ | $10M+ |
Client Requirements
What to Look for in a Policy
✅ Must Have
- ✓ Penetration testing explicitly covered - Some policies exclude "hacking" activities
- ✓ Defense costs outside limits - Legal fees shouldn't eat into your coverage
- ✓ Prior acts coverage - Covers work done before policy start
- ✓ Worldwide coverage - If you work with international clients
⚠️ Watch Out For
- ✗ Hacking/testing exclusions - Read the exclusions carefully
- ✗ Intentional acts exclusion - Pentest activities might be interpreted as "intentional"
- ✗ Claims-made vs occurrence - Understand when coverage applies
- ✗ Subcontractor exclusions - If you use contractors
Insurance Providers for Security Professionals
Disclaimer
Tech E&O Specialists
- • Hiscox (tech professional policies)
- • Coalition (cyber-focused)
- • Embroker (startup-friendly)
- • Founder Shield (tech specialists)
- • Vouch (digital-first)
Traditional Carriers
- • CNA (large accounts)
- • Travelers
- • Hartford
- • Chubb (high limits)
- • Beazley (cyber specialty)
💡 Pro Tip: Use a Broker
Work with an insurance broker who specializes in technology/cyber insurance. They can help you find policies that explicitly cover penetration testing and negotiate better terms. Look for brokers with experience in InfoSec or cybersecurity industries.
Certificate of Insurance (COI)
Clients often require a Certificate of Insurance before engagement. Here's what to know:
COI Contains:
- • Policy number and effective dates
- • Types of coverage
- • Coverage limits
- • Insurance company information
- • Named insured (your company)
- • Certificate holder (client)
Additional Insured Endorsement:
Some clients require being added as an "Additional Insured" on your policy. This extends coverage to protect them if they're named in a lawsuit arising from your work.
⚠️ This may incur additional premium costs.
Insurance Checklist
Before You Buy:
- List all services you provide
- Review client contract requirements
- Get quotes from 3+ providers
- Read exclusions carefully
- Verify pentest activities are covered
Ongoing:
- Review coverage annually
- Update as services expand
- Keep COI copies readily available
- Know your claims process
- Notify insurer of new service lines