Managed service providers are one of the most targeted business types in cybersecurity — and one of the most underinsured. Attackers go after MSPs deliberately: compromise one MSP and you get a trusted backdoor into dozens or hundreds of client networks simultaneously. The 2021 Kaseya attack hit over 1,500 downstream businesses through a single MSP supply chain exploit.

Standard cyber policies weren't written with that blast radius in mind. Here's what MSP-specific cyber coverage needs to look like, and where most policies leave dangerous gaps.

The core problem: you're liable for your clients' breaches

When an MSP is compromised and that compromise spreads to clients, the clients typically have legal standing to sue. Your managed services agreement almost certainly has indemnification language — and even if it doesn't, negligence claims are common.

This means your cyber policy needs to cover not just your own incident costs, but the downstream damages your clients suffer because of something that happened on your watch. That's a fundamentally different exposure than a company that only manages its own data.

What a proper MSP cyber policy must include

These coverages are non-negotiable for an MSP. If a policy is missing any of them, keep shopping:

• Network security liability — third-party claims from clients harmed by a breach that originated in your environment or tools
• Technology errors & omissions (Tech E&O) — claims that your managed services failed to perform as contracted, causing client losses; this is distinct from cyber and must be explicitly included
• First-party breach response — forensic investigation, legal counsel, notification costs for your own incident
• Business interruption — lost revenue while your systems or tools are offline due to a cyber event
• Ransomware / extortion — negotiation, ransom payments if necessary, and recovery costs; MSPs are frequent ransomware targets
• Regulatory defense and fines — if client data is breached through your systems, you may face regulatory exposure under HIPAA, GDPR, or state breach laws
• Social engineering / funds transfer fraud — MSPs handle client billing and sometimes financial systems; fraudulent transfer coverage matters

The Tech E&O gap MSPs almost always have

Tech E&O covers claims that your service didn't work — not that you were hacked, but that you failed to deliver what you promised. For MSPs, this includes failing to catch a threat your monitoring was supposed to catch, missing a patch that led to an exploit, or a backup that turned out to be corrupted when a client needed it.

Many cyber policies exclude Tech E&O entirely, or bundle it with a sublimit far lower than the main cyber limit. Read your policy carefully: the word "technology" appearing in the policy name doesn't mean Tech E&O is actually included.

Ask your broker or carrier: is Tech E&O written on the same limit as my cyber coverage, or is it a separate sublimit? If it's a sublimit, what is it?

What underwriters look for in MSPs — and what gets you declined

MSPs face tougher underwriting scrutiny than almost any other tech segment. Carriers know the risk profile. The controls they'll ask about:

• MFA everywhere — on your RMM platform, PSA tool, Microsoft 365, and any client-facing portals; this is a hard requirement, not a preference
• RMM access controls — do you limit which technicians can push scripts or commands to client endpoints? Least-privilege access to remote tools is closely scrutinized
• Client network segmentation — can a compromise in one client's environment spread laterally to others through your tooling?
• EDR on your own endpoints — not just client endpoints; your internal machines are the attack surface
• Incident response plan — do you have a documented, tested plan that covers both your own incidents and client notification procedures?
• Vendor security assessments — do you vet the security posture of your own software vendors (RMM, PSA, backup)?

Missing MFA on your RMM or PSA will get you declined outright at most carriers. There's no workaround — fix it before you apply.

How much coverage does an MSP need?

The right limit depends heavily on your client base composition and contract terms, but here's a practical framework:

If you have clients in healthcare, legal, or financial services, assume their contracts have meaningful indemnification language even if you haven't read it closely. Those industries are litigation-prone and your limit should account for it.

The bottom line

A generic cyber policy bought for a mid-size retailer is not the same as a policy built for an MSP. The liability profile, the blast radius of a single incident, and the underwriting requirements are all materially different.

Shop for a policy that explicitly includes Tech E&O on a full limit — not a sublimit — and that doesn't carve out claims arising from client network compromises. If your broker can't explain how those two things work in your current policy, that's a sign you need a second opinion.