FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Insurance explained
Cyber insurance for professional services firms is cover for a firm's own losses, incident response costs and liabilities that follow a cyber attack on a solicitor, accountant, architect or consultancy. It matters because these firms hold confidential client data and handle payment instructions, and PI alone rarely covers the whole loss.
Part of: Commercial insurance
In short
Professional firms hold sensitive client data and often move or direct client money, so they face ransomware, data theft and payment diversion fraud. Cyber insurance usually covers incident response, data restoration, lost fee income and liability for data breaches. PI covers claims that your advice was negligent and may respond to some client claims after a breach, but rarely your own losses. Fraud losses are often covered only under a social engineering extension with a low sub-limit. Insurers commonly ask about multi-factor authentication, backups, training and call-back checks. The SRA expects law firms to report attacks and replace lost client money.
Professional services firms sell advice and expertise, and they hold a lot of other people's information to do it: client files, financial records, contracts, designs, identity documents and bank details. Many also move money on clients' behalf or tell clients where to pay. That combination makes them attractive targets for data theft, ransomware and payment diversion fraud.
A cyber policy for a professional firm usually has three parts:
For the incident side, see how cyber insurance incident response works, and for the wider market view our commercial cyber insurance broker guide. Breach trends are on our UK cyber breach statistics page.
Professional indemnity insurance protects against claims that your advice or service was negligent. Cyber protects against the consequences of a cyber event. They meet in the middle, and the line between them is drawn by the wording, not the label. Many PI policies now contain cyber exclusions or write back only limited cover; see cyber exclusions in PI wordings.
| Loss | PI usually | Cyber usually |
|---|---|---|
| Your own cost to restore systems and data | No | Yes |
| Lost fee income after an attack | No | Yes, after any waiting period |
| Forensics, breach coach, notification | No | Yes |
| Client claim for negligent advice | Yes | No |
| Client claim because their data leaked from your systems | Sometimes, subject to cyber exclusions | Usually, under liability section |
| Client claim after you paid their money to a fraudster | Sometimes | Sometimes, often sub-limited |
| Your own money stolen by deception | No | Only with a social engineering extension, or under crime cover |
The short version is that PI is mainly about third party claims, while cyber covers your own losses as well. Our comparison for IT consultants: PI versus cyber works through the same split, and combining cyber and PI for professions looks at buying both together.
Email interception is the attack that worries professional firms most. A fraudster gets into a mailbox, or spoofs one, and changes bank details on an invoice, completion statement or payment instruction. Money goes to the wrong account, sometimes the firm's, sometimes the client's.
The Solicitors Regulation Authority identifies email modification fraud as the most common cyber attack among the firms it visited. It says the SRA Accounts Rules require firms to replace money improperly withdrawn from client account immediately, and that firms should also report the loss to the SRA. It also advises telling clients that you would never change bank details by email. Its cybercrime guidance gives examples of firms confirming changes by phone to a known number. The SRA notes that a solicitor's PI minimum terms may cover client money lost to cybercrime, limited to the amount insured; see SRA minimum terms and cyber.
Under cyber policies, loss of your own funds through deception is commonly covered only by a social engineering or funds transfer fraud extension, with a sub-limit much lower than the main limit and conditions such as call-back verification. Crime insurance can also respond. See social engineering and fund transfer fraud and commercial crime insurance.
The examples below are illustrative only and are not real cases.
Most professional firms are data controllers for client personal data. Under Article 33 of the UK GDPR, a reportable personal data breach must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. Under Article 34, individuals must be told without undue delay if the risk to them is high. The Information Commission took over from the ICO on 30 September 2026, with its role and powers unchanged.
Professional regulators can add their own expectations. The SRA says it expects firms to report attacks even where there are no concerns about personal conduct or systems. Other bodies may also require reports, as the NCSC small business guide points out. A breach may also be a circumstance to notify under your PI policy; see cyber and PI notification obligations. If an incident happens, our page on the first 72 hours after a cyber breach sets out the steps.
The most common misunderstanding is that PI already covers cyber. It may cover some claims from clients, but it rarely pays your own recovery costs, lost fees or ransomware response, and cyber exclusions can narrow it further. The reverse also applies: a cyber policy will not usually defend a claim that your advice was wrong.
Insurers commonly ask professional firms about:
Before buying or renewing, check the social engineering sub-limit, whether lost fee income is covered and for how long, how the cyber and PI wordings interact, and whether panel and consent rules suit your IT provider. Apex arranges cyber and PI insurance for professional firms; a broker reads every enquiry.
See also: Office insurance for mid-sized professional firms
Only partly, and it depends on the wording. PI is designed for third party claims about your professional services, so it may respond if a client sues after their data leaks, subject to any cyber exclusion. It usually does not pay your own recovery costs, lost fees or incident response. Cyber insurance commonly covers those, subject to its terms.
It is not compulsory, but many firms buy it. The SRA notes that minimum terms PI may cover client money lost to cybercrime, limited to the amount insured, but PI is not designed to pay a firm's own incident response, data restoration or lost income. Cyber insurance is aimed at those costs.
Sometimes. Many cyber policies cover loss of your own funds through deception only under a social engineering or funds transfer fraud extension, often with a much lower sub-limit and conditions such as call-back checks. Crime insurance can also respond. Client claims after diverted payments may fall under PI or cyber liability.
Insurers commonly ask about multi-factor authentication, separate and tested backups, staff phishing training, call-back checks before changing payment details, patching and device encryption. Weak answers can lead to exclusions, higher excesses or declined cover, so it helps to put these controls in place before renewal.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
