Protecting the people who protect the digital world.
Information security businesses operate at the frontline of digital risk.
From penetration testing and incident response to managed security, threat intelligence and security architecture, these firms are trusted with access to their clients’ most critical systems and data.
Elmore provides specialist insurance designed around the professional, technology and cyber risks of the information security industry.
Cyber security creates a different kind of professional risk.
A penetration tester is authorised to attack a client’s systems. An incident response team makes critical decisions while a cyberattack is underway. A managed security provider continuously monitors its customers’ networks. A security consultant’s recommendations may determine how an organisation protects critical infrastructure.
When something goes wrong, the financial consequences can be significant.
Elmore combines Technology Errors & Omissions, Professional Indemnity and Cyber Insurance with other specialist covers to build protection around the services an information security business actually provides.
Insurance across the information security community.
Penetration Testing
Protection for authorised offensive testing, including potential service disruption, data compromise, client system impact and third-party liability.
Vulnerability Assessment
Insurance for exposures arising from vulnerability identification, reporting and client reliance upon findings.
Incident Response
Protection around forensic investigation, containment, remediation and decisions made during active cyber incidents.
Managed Security & SOC
Insurance for managed security, detection and response businesses providing continuous monitoring and threat-management services.
Security Architecture
Protection for consultants designing security architecture, controls and security strategies.
Cyber Threat Intelligence
Insurance around intelligence gathering, analysis, reporting and client reliance upon threat intelligence.
Red Team & Threat-Led Testing
Protection for sophisticated simulated attacks, intelligence-led testing and offensive security engagements.
Incident Exercising
Insurance for organisations providing cyber exercises, crisis simulation, scenario development and response planning.
Cyber Security Consultants
Broader protection for security advisers, technology businesses and specialist cyber-security service providers.
Professional error
A vulnerability is missed. Advice is incorrect. An assessment or report is relied upon by the client.
Potential impact: professional negligence claims, defence costs and damages.
Client system impact
Testing, remediation or security activity inadvertently disrupts a client's systems, network or services.
Potential impact: business interruption, restoration costs and third-party claims.
Cyber and data
Access to sensitive client environments can create exposure to network security failures, privacy breaches and data compromise.
Potential impact: incident response, liability, regulatory action and reputational damage.
Failure to protect
A threat is not detected, an alert is not escalated or an incident response fails to contain an attack.
Potential impact: increased client losses and potentially substantial liability claims.
Professional Indemnity
Cyber Insurance
Crime Insurance
Directors & Officers
Digital Asset & Custody
Regulatory Insurance
Professional indemnity and cyber are not the same thing.
Professional/technology liability
The service you provide
Errors and omissions
Professional negligence
Technology services
Security advice
Testing and assessment
Client reliance
Failure to perform
+ Cyber insurance
The cyber event
Network security
Privacy and data
Incident response
Cyber extortion
Business interruption
Cyber-related liability
= Infosec Insurance
Protection designed around the business providing cyber-security services.
Cyber-related liabilities were historically more commonly incorporated within Professional Indemnity and Technology E&O policies. The insurance market has evolved, with cyber exclusions and limitations increasingly separating these exposures.
For information security businesses, it is therefore important to understand how Professional Indemnity, Technology E&O and Cyber policies interact – and whether gaps exist between them.