FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
Insurance cost factors are the features of a business that underwriters use to judge the likelihood and size of claims and so set premium and terms. For an IT company they matter because several are within your control.
Part of: IT and technology business insurance
In short
For a UK IT company with £10m to £50m turnover, the main drivers of tech PI and cyber cost are usually: what you sell (software, managed services, consultancy or resale), who you sell to and what you have promised in contracts, how much revenue comes from the US, the strength of your security controls, your claims and incident history, the limits and excesses you choose, and wider market conditions. Insurance Premium Tax is added on top. A clear submission that explains the business well often matters as much as the raw numbers.
There is no standard rate card for mid-market IT risks. Each underwriter builds a view from the information in your submission, so two companies with the same turnover can see very different terms. The factors below are the ones that most often move the outcome for tech PI and cyber, which are usually the largest lines in an IT company's programme. For the cyber line specifically, see cyber insurance cost for technology companies; for the wider picture, see insurance for mid-sized IT companies.
| Factor | What underwriters look at | Usual direction |
|---|---|---|
| Revenue mix | Split between software licensing, SaaS, managed services, development, consultancy and hardware resale | Services that run client operations or hold client data tend to attract more scrutiny than resale |
| Client sectors | Financial services, healthcare, public sector, critical infrastructure | Regulated or critical sectors can increase potential loss size |
| Contract terms | Liability caps, uncapped liabilities, indemnities, service credits | High or uncapped liabilities usually increase cost or narrow cover |
| US exposure | US revenue, US-domiciled clients, contracts governed by US law | Commonly rated separately and may need specific jurisdiction cover |
| Security controls | MFA, endpoint detection, privileged access, backups, patching, certifications | Strong, evidenced controls usually improve cyber terms |
| Claims and incidents | Five-year history, near misses, how incidents were handled | A clean or well-managed record helps |
| Limits and excesses | Limit purchased, each and every claim or aggregate, excess level | Higher limits cost more; higher excesses may reduce premium |
| Aggregation exposure | Number of clients reliant on shared tooling or platforms | Concentrated one-to-many risk can affect terms |
The general mechanics of PI rating are explained in how PI premiums are calculated.
Underwriters want to know what share of turnover comes from activities where an error could stop a client trading. A business that is mostly hardware resale with a small managed service arm presents differently from a pure managed service provider, even at the same turnover. Breaking revenue down by service line, rather than giving a single figure, helps underwriters rate each activity appropriately.
Enterprise clients increasingly ask for higher liability caps, separate super-caps for data protection or confidentiality breaches, and broad indemnities. Each of these can increase the potential size of a claim, and liabilities that go beyond negligence may fall outside tech PI altogether under the contractual liability exclusion. Underwriters reviewing your largest contracts will look at how often you accept these terms and whether you have a standard negotiating position. See data protection super-caps in IT contracts.
US clients and contracts often bring higher potential damages and defence costs. Many policies restrict or separately rate US and Canadian jurisdiction. See US clients and tech E&O for UK IT companies.
Cyber underwriters commonly ask detailed questions about controls. Evidence such as the NCSC's Cyber Essentials certification, which covers five technical controls, or Cyber Essentials Plus, which adds independent technical testing, can support the submission, though insurers usually look beyond it. See what cyber underwriters ask.
The wider insurance market also plays a part. The number of insurers willing to write a class of risk, their recent claims experience and their appetite for particular activities all shift over time. These forces sit outside your control, which is why presenting the controllable factors well is worth the effort.
Insurance Premium Tax is charged on most general insurance premiums. The standard rate has been 12% since 1 June 2017, and it is added to the premium.
These examples are illustrative only and do not reflect any real client or premium.
Company A earns most of its revenue from hardware resale with light support contracts and caps its liability at fees paid. Company B is a managed service provider with privileged access to 150 client estates, several financial services clients and some uncapped data protection liabilities. Even at the same turnover, underwriters are likely to view Company B as the more complex risk.
A software house with gaps in MFA coverage and untested backups receives restrictive cyber terms. Over the following year it closes the gaps and documents a successful recovery test. At the next renewal, it can present evidence rather than promises, which often gives underwriters more confidence.
A business moves from a shared tech PI and cyber limit to separate limits with an excess layer on top. The total cost rises, but so does the headroom for a systemic event. See excess layers for tech PI and cyber and aggregation risk for IT service providers.
Apex arranges tech PI, cyber and wider cover for IT and technology businesses; a broker reads every enquiry.
The main factors are usually the services you provide, your client sectors, the liability you accept in contracts, US exposure, claims history, and the limit and excess you choose. A business that runs critical systems for regulated clients will typically be viewed differently from one focused on hardware resale, even at the same turnover.
Often, yes. US clients and contracts can bring higher potential damages and defence costs, so many insurers rate US and Canadian work separately or restrict cover for claims brought there. Disclosing US revenue and contract governing law clearly at renewal helps your broker find suitable terms.
They usually improve the terms available, and can affect premium, excess and the scope of cover. Underwriters commonly ask about MFA, endpoint detection, privileged access management, backups and recovery testing. Evidence such as Cyber Essentials Plus certification or a documented recovery test tends to carry more weight than self-declared answers.
Insurance Premium Tax applies to most general insurance premiums in the UK, and the standard rate has been 12% since 1 June 2017 according to HMRC's published rates. It is charged on top of the premium. Your broker's quotation should show IPT separately.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
