Following the market move to affirmative cyber, most professional indemnity policies now carry an express cyber exclusion. The purpose is to make clear that first-party cyber loss and pure data-security liability belong in a cyber policy, not in the PI policy, so that neither the firm nor the insurer is relying on silence. The exclusion is not, in itself, a reduction in real cover if a cyber policy picks up what it removes.
Underwriters commonly attach standardised clauses published by the Lloyd's Market Association, such as the LMA5400 and LMA5401 cyber exclusion series, sometimes with a write-back. The breadth of these clauses varies. A tightly drafted exclusion removes only losses arising from a cyber act or cyber incident. A broad one can extend to any loss "arising from or in connection with" the use of computer systems - which, read literally, could touch almost any modern professional service.
For professional firms the critical feature is a write-back preserving cover for professional negligence even where technology is involved. Without it, a broad exclusion could defeat a genuine negligence claim simply because a computer was used to deliver the advice. An architect whose defective design was produced in CAD software, or an IT consultant whose negligent configuration caused loss, needs the wording to catch the negligence and exclude only the cyber-security exposure.
The right questions to ask of any cyber exclusion are: does it define "cyber act" and "cyber incident" narrowly; does it carve back professional services; and does it align with the insuring clause of the firm's cyber policy so nothing falls between the two? A firm can hold two policies that each assume the other responds, and discover the gap only at claim.
Comparing exclusion wordings across insurers, and checking each against the matching cyber policy, is detailed work that rewards a careful read. Apex reviews the cyber exclusion and any write-back in a PI wording against the firm's cyber cover so the boundary is deliberate rather than accidental.
Because there is no single mandated form, cyber exclusions vary noticeably between insurers even where they start from the same LMA base clause. One insurer may attach a narrow exclusion with a full professional-services write-back; another may use a broad "arising from or in connection with" formulation with no carve-back at all. Two policies offering apparently similar cover at a similar price can therefore behave very differently when a technology-related claim arrives.
This is precisely the kind of difference that is easy to miss on a summary and expensive to discover at claim. Reading the actual clause, not the marketing summary, is the only reliable way to know how a wording treats a cyber-adjacent negligence claim. Apex compares the exclusion language across the insurers it approaches for a professional firm, and sets out in plain terms how each would treat the claims the firm is most likely to face.
Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Firm reference number 724952. This entry is general information, not advice on any particular policy.
A guideline range built from the premiums insurers have actually quoted on risks we handle. Pick your profession and enter a few details — it updates instantly.
Choose your profession and enter your fee income to see a guideline range.
This guide is built from Apex's own market data: the premiums insurers have actually quoted and charged on professional indemnity risks we have handled. Each night that data is aggregated into anonymised rate bands by profession, fee income and limit of indemnity. No client information is published — a band only appears where it contains at least five separate records, and unusually high premiums are excluded so a single atypical risk cannot distort the guide.
The range shown spans the typical spread of recent market outcomes for similar risks. Individual quotes can fall outside it in either direction. Figures exclude insurance premium tax at 12%.
This calculator is not a quote and is not an offer of insurance or advice. Your actual premium depends on full underwriting of your business, including your activities, claims record and insurer appetite at the time.