Mid-market insurance

Insurance for mid-sized IT companies (£10m to £50m turnover)

Reviewed by the Apex broking team · Last reviewed 2026-11-04

Insurance for a mid-sized IT company is a coordinated programme of technology PI, cyber, management liability, crime and core commercial covers, with limits set by contracts rather than habit. At £10m to £50m turnover, gaps between policies cost more than premium.

Part of: IT and technology business insurance

In short

A UK IT services, software or managed services business turning over £10m to £50m usually needs technology professional indemnity (tech E&O), cyber, D&O or management liability, crime, employers' and public liability, and property and business interruption. What changes from small-firm cover is scale: limits are driven by enterprise contracts, one fault can reach many clients at once, excess layers become normal, and boards and investors expect evidence of cover. The aim is one programme where the policies fit together, the limits match the contracts and nothing important sits between two wordings.

What the programme usually includes

Most IT companies in this band buy the same core covers. The difference from a 20-person firm is how they are structured and how high the limits go. A typical programme, subject to the policy terms in each case, looks like this:

Cover	What it usually responds to	What drives the limit
Technology PI / tech E&O	Client claims for negligent services, defective software, failed implementations, missed SLAs causing loss, and often IP infringement	Contract liability caps, largest client exposure, aggregation
Cyber	Your own breach response, ransomware, business interruption from a network event, and third-party privacy and network security claims	Data volumes, dependency on your own systems, client contract demands
D&O or management liability	Claims and investigations against directors and officers, often with employment practices and corporate legal liability sections	Board structure, investors, insolvency and regulatory exposure
Crime	Employee dishonesty, third-party fraud and, where included, social engineering losses	Payment flows, access to client funds or systems
Employers' liability	Injury or illness claims by employees	Compulsory minimum of £5 million for any one occurrence; most insurers provide more
Public and products liability	Third-party injury or property damage, including at client sites and from hardware you supply	Client contract requirements and site work
Property and business interruption	Offices, equipment and lost gross profit after physical damage	Reinstatement values and realistic recovery period

Tech PI and cyber can be bought on one combined technology policy or separately. Both routes work; the choice depends on your limits, contracts and how much you want the two covers to share. The IT and technology business insurance hub covers each policy in more depth.

What changes from small-firm cover

The covers have the same names as at smaller firms, but the risk and the buying process change in several ways.

Contracts set the limits. Banks, NHS bodies, government departments and large corporates commonly ask for £5m or £10m of PI and cyber, specific wordings and evidence. See enterprise client insurance requirements.
Excess layers appear. Higher limits are often built as a primary policy with one or more excess layers above it. The way the layers follow the primary wording matters; see excess layers for tech PI and cyber.
One fault can reach many clients. A managed service provider pushing a faulty update, or a SaaS platform going down, can generate claims from dozens of clients at once. How the policy aggregates related claims and whether the limit is any one claim or in the aggregate become central questions.
Super-caps and uncapped liabilities. Data protection, confidentiality and IP liabilities are often carved out of the general cap. Those need to be checked against the insurance; see data protection super-caps.
Board and investor expectations. Investors commonly expect D&O for tech companies with a sensible limit and clear Side A protection. UK companies may buy that insurance for directors under section 233 of the Companies Act 2006.
US and overseas exposure. US clients, US subsidiaries or US-governed contracts change jurisdiction clauses and underwriting, and can affect price and capacity.
Fair presentation gets harder. Under section 3 of the Insurance Act 2015 the business must disclose every material circumstance it knows or ought to know. With several entities, product lines and a security team, that takes a structured process rather than a form.

Illustrative examples

These are illustrative scenarios, not real clients or claims. Whether any policy responds depends on its terms.

Illustrative example 1: a managed service provider at £25m turnover

An MSP supports around 300 SME and mid-market clients through remote monitoring tools. A compromised update spreads to many client networks. The MSP faces its own incident response costs (cyber), client claims for lost revenue and recovery (tech PI or third-party cyber, depending on the wordings), and possibly questions to directors from the board. Whether the claims are treated as one claim or many affects how much limit is available. See managed service providers insurance and MSP liability when a client is breached.

Illustrative example 2: a SaaS business with US customers

A UK software company earns a third of its revenue from US customers under contracts governed by New York law. Its tech PI needs worldwide jurisdiction including the US, and underwriters will usually ask about US revenue, contract terms and claims history before quoting.

Illustrative example 3: a consultancy moving into the public sector

An IT consultancy wins a place on a framework. The call-off contract asks for £5m PI and a data protection cap far above the general cap. The existing £2m policy needs to be raised, possibly through an excess layer, before the contract starts.

Common mistakes at this size

Buying policies one at a time. Tech PI, cyber and crime renewed at different dates with different insurers often leave gaps, for example around social engineering or a client's data on your systems.
Assuming the limit is per claim. Many tech PI and cyber limits are in the aggregate. One bad year can use the whole limit. See aggregate vs each and every claim.
Signing contracts that the insurance does not match. Indemnities, uncapped liabilities and service credits commonly fall outside cover unless the policy says otherwise.
Underinsuring business interruption. A recovery period that suited a smaller office often looks short once the business depends on a data centre, a hosting provider or key staff.
Leaving D&O as an add-on. A management liability package bought at start-up may have a shared limit that is too low for a business with investors and 200 staff.

What to check with your broker

List your ten largest contracts with their liability caps, super-caps, indemnities and insurance clauses.
Map revenue by service line: software, managed services, hardware resale, consultancy, and by territory.
Decide whether tech PI and cyber should share a limit or sit separately, and whether excess layers are needed. See how much tech PI and cyber cover you need.
Prepare a security summary covering MFA, backups, patching, privileged access and incident response, because cyber and tech PI underwriters will ask. The NCSC supplier assurance questions give a sense of what large clients also ask.
Align renewal dates where practical, and review the programme as a whole at least once a year.

Apex arranges insurance programmes for mid-sized IT and technology companies; a broker reads every enquiry.

Sources

Frequently asked

What insurance does a mid-sized IT company need in the UK?

Usually technology PI, cyber, D&O or management liability, crime, employers' liability, public and products liability, and property with business interruption. Employers' liability is compulsory for most employers. The others are commonly required by contracts, investors or lenders, and the limits are normally set by the largest client contracts rather than by turnover alone.

Should tech PI and cyber be on one policy?

Either approach can work. A combined policy can reduce gaps between the two covers and simplify claims, but a shared limit means one large incident can use cover needed for other claims. Larger IT companies often buy separate limits or a shared primary with separate excess layers. The right answer depends on your contracts and exposures.

Is employers' liability insurance compulsory for IT companies?

Most UK employers must hold employers' liability insurance with cover of at least £5 million for any one occurrence under the Employers' Liability (Compulsory Insurance) Regulations 1998, subject to limited exemptions. In practice most policies provide a higher limit, commonly £10 million.

Do investors expect D&O insurance?

Commonly, yes. Private equity and venture investors often require D&O cover as a condition of investment, and non-executive directors usually ask about it before joining a board. They will typically want a limit that is not shared with other covers and clear protection for individual directors.

What changes when an IT company passes £10m turnover?

Mostly the contracts and the buyers. Larger clients ask for higher limits and evidence of cover, one incident can affect many clients, and limits are often built with excess layers. Underwriters also ask more about revenue mix, US exposure and security controls.

Mid-sized business? Have your programme reviewed

Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.

Book a programme review Get a quote

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.