FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
If an AI-assisted security test misses a vulnerability that is later exploited, the client may claim you were negligent in relying on the tool. Security consultants sell assurance, so a clean report invites reliance.
Part of: AI in IT consultants and developers
In short
Security consultants increasingly use AI to triage scan output, review source code and suggest attack paths. The risk is false negatives: a weakness the tool did not flag, a report that looks thorough, and a client who relies on it. When a breach later follows, the question is whether your method and scope met the standard of a competent tester. BCS clauses 2.1, 3.1 and 3.5 apply, and the AI Cyber Security Code expects proper testing. Technology PI usually responds to negligent testing claims, subject to the wording and the scope you agreed.
AI tools help testers sort large volumes of scanner findings, read unfamiliar code quickly, draft reports and suggest likely exploitation routes. Some firms run AI-assisted code review as a standalone service. Used as an assistant to an experienced tester, this can improve coverage. Used as a substitute, it can create gaps nobody notices, because the tool reports what it found rather than what it did not test.
BCS members are bound by the BCS Code of Conduct: 2.1 (only take on work within your competence), 3.1 (due care and diligence) and 3.5 (do not misrepresent performance information). Clause 3.5 is especially relevant to reports: describing an AI-assisted review as a full manual assessment, or implying coverage you did not achieve, could misrepresent the work.
Where the system under test includes AI, the AI Cyber Security Code of Practice (principle 9) expects security testing and evaluation before release, and the NCSC secure AI development guidelines cover secure deployment and operation. These help define what a reasonable test of an AI system looks like.
Illustrative scenario: a security consultancy is engaged to review a client's web application before launch. To meet a tight deadline it relies on an AI code review tool to cover most of the codebase, with manual testing limited to the login flow. The report finds only low-risk issues. Six months later attackers exploit an authorisation flaw in an area the AI tool reviewed but did not flag. The client, which had shown the clean report to its own customers, claims its breach costs from the consultancy.
The dispute will turn on what was promised, what was actually tested, and whether a competent tester would have found the flaw using the agreed method.
Technology PI is commonly written to cover negligent professional services, and a missed vulnerability is a familiar type of claim for security firms. Insurers will look closely at the scope letter, limitations stated in the report, and whether the use of AI tools was disclosed. Some wordings contain exclusions for guarantees or warranties, so promising that a system is "secure" can create a gap. Our pages on PI for cyber security consultants and liability when a client is breached cover the wider picture.
Much of a security consultant's protection sits in the engagement terms. A scope letter should list the systems, environments and dates covered, the testing approach, and anything excluded, such as third-party hosted components or areas only reviewed by automated tools. It should say that testing is a point-in-time exercise and cannot show that no vulnerabilities exist.
Reliance is the other issue. Clients often share reports with their own customers, insurers or investors. If those third parties rely on your findings, your exposure may widen beyond the client. Consider who the report is addressed to, whether it can be shared, and on what terms. A liability cap set at a level your PI limit supports, and agreed in writing before work starts, is a common and sensible control.
Apex arranges PI for security consultants and IT firms. A broker reviews your cover and how your policy treats testing that relies on AI tools. See also AI-generated code, advising on AI tools and the IT consultants AI hub.
Yes, provided the client agrees, the tool's data handling is acceptable and a competent tester oversees the work. The report should be clear about method and coverage so the client does not assume more testing was done than actually took place.
Not automatically. A breach does not prove negligence. Liability depends on whether the issue was within scope and whether a competent tester using the agreed method should have found it. Clear scope, documented coverage and accurate reporting are your best protection.
Technology PI commonly responds to claims that testing was negligent, subject to the wording, limits and exclusions such as those for guarantees. Disclose to insurers that you use AI tools if it is a material part of how you deliver testing.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
