FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
One-to-many aggregation risk is the chance that a single error, update or breach at an IT provider causes losses for many clients at the same time. It matters because how the policy groups those claims decides whether you have one limit and one excess, or many.
Part of: IT and technology business insurance
In short
When an IT service provider pushes a faulty change or suffers a breach of a shared platform, dozens of clients can be hit by the same event. Tech PI and cyber policies usually contain aggregation or related-claims clauses that decide whether those claims count as one claim or many. One claim means one excess but one limit, which may be too small. Many claims means many excesses but potentially more cover, subject to any aggregate limit. Finance directors should test their limits against a credible systemic scenario, read the aggregation wording, and check for widespread event exclusions.
Most IT providers buy limits by looking at their largest single contract. That is a sensible start, but it misses the risk that matters most for managed service providers, SaaS platforms and anyone with privileged access across a client base: a single cause producing many claims at once.
Typical one-to-many events include:
Whether your technology professional indemnity and cyber cover can absorb that depends on three things: how the policy aggregates related claims, how the limit is structured, and whether any systemic or widespread event exclusion applies.
An aggregation clause tells the insurer and the insured when several claims are treated as a single claim. Common wording patterns in tech PI include claims "arising from the same originating cause", claims "arising from the same act, error or omission", and claims arising from "related" acts or a "series" of related matters. The broader the wording, the more claims are pulled together into one.
The UK courts look closely at the precise words. In AIG Europe Ltd v Woodman [2017] UKSC 18, the Supreme Court held that a clause aggregating "similar acts or omissions in a series of related matters or transactions" required some interconnection between the transactions, judged objectively and on the facts. That case concerned solicitors' minimum terms, but the reasoning is commonly applied when reading similar wording in other PI policies. Our guide to aggregation and series clauses sets out the main formulations.
| Outcome | Excess | Limit | Who it tends to suit |
|---|---|---|---|
| All claims aggregated as one | One excess | One each and every claim limit, which may be exhausted | Insured if limits are large; insurer if limits are small |
| Claims treated separately | An excess per claim | A limit per claim, subject to any annual aggregate | Insured if limits are small but excesses manageable |
| Aggregate limit policy | Per policy terms | One pot for the whole year, regardless of aggregation | Depends on whether the pot covers a systemic year |
The interaction is explained further in how aggregation affects your PI limit and excess and aggregate vs each and every claim limits.
Cyber policies carry their own aggregation logic. Many now include exclusions or sub-limits for widespread or systemic events, and for state backed attacks. At Lloyd's, Market Bulletin Y5381 (16 August 2022) required standalone cyber-attack policies to include a state backed cyber-attack exclusion from 31 March 2023, at inception or renewal. Wordings differ between insurers, as covered in how UK cyber insurers differ on war exclusions.
For an IT provider, the key distinction is between your own first-party losses (incident response, restoration, business interruption) and your liability to clients. The first usually sits in cyber; the second usually sits in tech PI, though combined wordings blur the line. If you buy a combined tech PI and cyber policy with a shared limit, a systemic event can drain the same limit from both directions.
Data protection law adds a further multiplier. Under Article 33 UK GDPR, a processor must notify the controller without undue delay after becoming aware of a personal data breach. A provider that processes data for many clients may therefore be notifying many controllers about the same incident, each with its own potential claim. The emerging picture is discussed in cyber data breach aggregation.
These examples are illustrative only. How any real claim is handled depends on the facts and the policy terms.
On 19 July 2024 the National Cyber Security Centre reported a widespread IT outage following a CrowdStrike security update, and assessed that it was not the result of a security incident or malicious cyber activity. The event was debated in the House of Commons on 22 July 2024. It is a public illustration of how one change can affect many organisations at once, and why non-malicious system failure cover and aggregation wording both matter.
A managed service provider with 120 clients pushes a firewall rule change through its management platform. Forty clients lose connectivity for a trading day. Each client's loss is modest, but together they exceed the provider's each and every claim limit if the policy treats them as one claim arising from the same act. If they are treated separately, forty excesses apply instead.
An attacker obtains an engineer's privileged credentials and reaches several client tenants. The provider has cyber costs of its own, client claims under its tech PI, and notification duties to each controller. See MSP liability when a client is breached for how that liability usually arises.
Apex arranges tech PI and cyber for managed service providers and other IT and technology businesses; a broker reads every enquiry.
Usually, if the claims arise from a negligent act, error or omission in your professional services, subject to the policy terms. The bigger question is whether the claims are aggregated as one, sharing a single limit and excess, or treated separately. Check the aggregation wording and whether your limit is each and every claim or annual aggregate.
It is a clause that decides when several claims are treated as one claim for the limit and excess. Wordings commonly use phrases such as same originating cause, same act or omission, or a series of related matters. The precise words matter, and UK courts interpret them closely on the facts.
It depends on the wording. Some cyber policies cover system failure that is not caused by an attack, sometimes with a sub-limit, while others cover only malicious events. Liability to clients for an outage you caused is more commonly a tech PI matter, subject to the policy terms.
Often it is worth considering. A shared limit can be eroded by your own incident costs and client claims from the same event. Separate limits, or a shared limit with a dedicated excess layer, can give more headroom. The right structure depends on your contracts, client base and budget.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
