Mid-market insurance

How much tech PI and cyber cover does a mid-sized IT company need?

Reviewed by the Apex broking team · Last reviewed 2026-11-04

The right tech PI and cyber limit is the sum that would pay your largest realistic claim and its defence costs, after allowing for contract caps and aggregation. Turnover alone is a poor guide, and a limit that is too low usually shows up when a claim arrives.

Part of: IT and technology business insurance

In short

There is no standard limit for an IT company at £10m to £50m turnover. Limits are usually set by five inputs: the liability caps and super-caps in your largest contracts, the worst credible single incident, how many clients one fault could affect, whether the limit is each and every claim or in the aggregate, and whether tech PI and cyber share a limit. Larger limits are often built from a primary policy and excess layers, and the figure should come from the contracts and scenarios, not a rule of thumb.

The short answer

Start from your contracts and your worst day, not from turnover. A limit is adequate if it would pay the largest claim you can realistically face, including defence costs where they erode the limit, and still leave cover for other claims in the same policy year.

For many IT services and software businesses in this band, enterprise and public sector contracts push tech PI and cyber limits to £5m, £10m or more. Some contracts also carve data protection or confidentiality out of the general cap, which can set the real minimum. The general comparison of £1m vs £2m vs £5m PI limits is a useful starting point; this page deals with the larger figures.

The five inputs that set the limit

Input	What to gather	How it moves the limit
Contract caps	General liability caps in your ten largest contracts, usually expressed as a fixed sum or a multiple of fees	The highest realistic cap is a floor for tech PI, though you can still be liable above it where caps fail or are uncapped
Super-caps and uncapped heads	Separate caps for data protection, confidentiality, IP or security breaches	Often the largest single figure. Government Mid-Tier Contract guidance suggests a data protection cap between £10m and £20m
Worst credible incident	A realistic scenario: platform outage, failed migration, ransomware spreading to clients	Sets the cyber limit for your own losses and the third-party exposure
Aggregation	How many clients share a platform, tool or code base	One-to-many risk can turn one fault into many claims under one limit
Limit basis and sharing	Aggregate or each and every claim; combined or separate tech PI and cyber; costs inclusive or in addition	An aggregate or shared limit usually needs to be higher to give the same protection

For the data protection side, remember that under UK GDPR Article 82 a processor can be liable to individuals where it has breached its processor obligations or acted outside the controller's lawful instructions, and where several parties are responsible each can be held liable for the entire damage. Under Article 28 a processor also remains fully liable to the controller for a sub-processor's failures, which matters if you rely on hosting or platform providers.

Each and every, aggregate, shared and separate

Two policies with the same headline figure can give very different protection.

Aggregate limit: the most the insurer pays in the policy year for all claims. Common on tech PI and cyber. One large claim can leave little for the rest of the year.
Each and every claim: the limit applies to each claim separately, sometimes with an overall cap. Less common for technology risks and usually priced accordingly. See aggregate vs each and every claim limits.
Shared limit: a combined tech PI and cyber policy may give one limit for both. A ransomware event that also triggers client claims can draw on the same pot from both sides.
Separate limits: separate tech PI and cyber limits, or a shared primary with separate excess, keep one type of loss from consuming the other.
Costs inclusive: where defence costs sit inside the limit, a long dispute erodes the cover available for damages.

Building higher limits with excess layers

Above a certain point, limits are usually bought as a primary policy plus one or more excess layers, each sitting above the one below. This spreads the risk across insurers and can make larger limits available. Points to understand:

Excess layers commonly follow the form of the primary wording, so gaps in the primary carry upwards.
Check whether an excess layer drops down if a lower layer is exhausted by aggregate claims.
Contracts asking for £10m do not usually care how the limit is built, but some ask for certificates for each layer.

See PI excess layer programmes and building a tech PI and cyber tower.

Illustrative examples

These are illustrative, not recommendations or real clients. Your figures depend on your contracts and the policy terms.

Illustrative example 1: software house at £15m turnover

Largest contract cap is 150% of annual fees, around £3m. A bank client has a £10m data protection super-cap. The business has few clients on shared infrastructure. A reasonable discussion might start at £5m tech PI with cyber at a level that covers the bank super-cap, possibly through a separate cyber limit.

Illustrative example 2: MSP at £30m turnover

Several hundred clients share the same remote management tool. General caps are low, but one compromised tool could reach every client at once. Aggregation and the aggregate limit drive the decision more than any single contract, and an excess layer above a combined primary is a common structure to consider. See one-to-many aggregation risk.

Illustrative example 3: consultancy at £12m turnover

Project-based work with caps set at fees on each project. No large data processing. A lower tech PI limit may be adequate, but one public sector call-off asking for £5m may justify a project-specific or excess arrangement rather than raising the whole programme.

Common mistakes

Setting the limit by turnover or by what a peer buys.
Matching the general cap but ignoring super-caps and uncapped indemnities. See liability caps vs PI limits.
Treating a combined £5m tech PI and cyber limit as if it were £5m of each.
Forgetting that defence costs may erode the limit.
Not reviewing limits when a large new contract is signed mid-term.

What to check with your broker

Share a schedule of your largest contracts, their caps, super-caps and insurance clauses.
Agree two or three worst credible scenarios and estimate the loss in each.
Confirm whether each limit is aggregate or each and every claim, costs inclusive or in addition, shared or separate.
Ask how excess layers would follow the primary and whether they drop down.
Review the limit against the wider programme in insurance for mid-sized IT companies.

Apex arranges tech PI, cyber and excess layers for IT companies; a broker reads every enquiry.

Sources

Frequently asked

Is £5m of tech PI enough for a £20m IT company?

It may be, but turnover does not decide it. The answer depends on the caps in your largest contracts, any data protection super-caps, how many clients one fault could affect, and whether the limit is aggregate and shared with cyber. A company with bank or public sector contracts may need more; a project consultancy may need less.

Do I need the same limit for cyber and tech PI?

Not necessarily. Tech PI limits are usually set by client contract liability. Cyber limits are usually set by your own breach costs, business interruption and third-party privacy exposure. Some contracts ask for both at the same figure, which can be met by separate limits or a combined policy with a high enough shared limit.

What is a data protection super-cap?

A separate, higher cap in a contract for liability arising from data protection breaches, sitting outside the general liability cap. Government Mid-Tier Contract guidance suggests a range of £10m to £20m for that cap. Super-caps often set the real minimum limit an IT supplier needs, subject to how its policies treat contractual liability.

Is it cheaper to buy higher limits through excess layers?

Excess layers are usually priced lower per pound of cover than the primary, because they only pay once the lower layers are used up. Whether the overall cost is lower depends on the market and your risk. The main benefit is that larger limits become available by spreading the risk across insurers.

How often should we review our limits?

At least at each renewal, and whenever you sign a contract with a higher cap, super-cap or insurance requirement than before. Large new clients, acquisitions and new platforms shared by many clients are the usual triggers for a mid-term review.

Mid-sized business? Have your programme reviewed

Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.

Book a programme review Get a quote

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.