Who We Insure

Insurance for Penetration Testing Firms

A penetration testing firm is paid to attack. Clients hire you to find the weaknesses before a real adversary does, which means your normal working day involves probing production systems, escalating privileges, and behaving — by design — like an intruder. That business model puts two questions at the center of every engagement: did you stay inside the authorized scope, and did your testing knock something over that the client depended on. Both are where the claims come from.

Why penetration testing firms carry specialized insurance

The exposures are specific to the work. A test that drifts beyond the systems named in the rules of engagement can look like unauthorized access. A load-generating scan can crash a fragile production application and take a revenue system offline for hours. And after the report ships, a client that later suffers a breach may point at the vulnerability your team allegedly should have found — turning a professional deliverable into an errors-and-omissions dispute. Because testers hold temporary but real privileged access, a compromise of your own tooling or your handling of client findings can become a third-party cyber event on the client's side. Insurance requirements arrive the moment the work becomes contractual. Master service agreements, statements of work, and the authorization letters that make testing legal all carry insurance exhibits — Tech E&O and cyber limits, additional-insured status, and certificates demanded before a single packet is sent. A OnePark Risk advisor structures the program around the two failure modes that define this vertical: the scope-and-outage question during testing, and the missed-finding question after the report, making sure one carrier stands behind both.

The risk profile of a penetration testing firm

Pen-test risk is concentrated in the gap between authorized and actual: what the rules of engagement permitted, what the testers did, and what broke or was later blamed on the assessment. Key exposures: Testing that exceeds the authorized scope or touches systems outside the rules of engagement; Accidental outages, data corruption, or degraded performance in client production environments; Missed vulnerabilities alleged after a later breach the client says the test should have caught; Exposure or mishandling of the findings report, which is effectively a roadmap to client weaknesses; Compromise of testing infrastructure, credentials, or exfiltrated client data held during an engagement; Subcontracted or 1099 testers performing work under the firm's contract and authorization; Deliverable and scope disputes over retests, remediation validation, and what the engagement promised.

Technology E&O + Cyber (combined form) for penetration testing firms

For a pen-test firm these are one exposure wearing two hats. An outage you caused, a report that missed something, or an accusation that you exceeded scope is a professional-services claim; a compromise of your tooling or the client data you held during testing is a cyber claim — and a single incident often triggers both. A combined form puts one carrier behind the whole engagement, including the third-party liability when a client says your work contributed to a loss on their side. The scope-of-work and negligent-testing wording deserves line-by-line review. Typically responds to: client claims for outages, data corruption, or degraded systems caused during testing; allegations that a report missed a vulnerability later exploited; your own breach response if testing infrastructure or client findings are compromised; liability for security incidents alleged to arise from your assessment work.

Cyber Liability for penetration testing firms

A pen-test firm accumulates something dangerous: detailed maps of other companies' weaknesses. A breach of your own environment — where reports, credentials, and exfiltrated proof-of-concept data live — is a first-party event with third-party consequences for every client whose findings leak. The cyber side funds forensics, notification, and extortion response, and underwriters will press hard on how you segment, encrypt, and destroy engagement data. Typically responds to: forensics, notification, and extortion response for a breach of your own systems; third-party liability when leaked findings expose client vulnerabilities; handling and secure destruction expectations for engagement data.

General Liability for penetration testing firms

On-site engagements — physical social-engineering tests, badge cloning, walkthroughs, hardware drops — put testers on client premises where ordinary property damage and bodily-injury exposure applies. Most MSAs require a general liability certificate, commonly $1 million per occurrence, before your team is allowed through the door.

Crime / Employee Dishonesty for penetration testing firms

Testers are handed the keys — credentials, access, and knowledge of exactly where the valuables sit — which is precisely the trust concentration clients ask about in security questionnaires. Crime coverage, including third-party endorsements for theft of client property, answers those questions and responds if that access is abused.

Workers' Compensation for penetration testing firms

Required in the states where you employ anyone, and expected in client contracts alongside general liability. It funds medical care and lost wages for employees, including those traveling to client sites for physical assessments.

Employment Practices Liability (EPLI) for penetration testing firms

A specialized, hard-to-hire talent pool and high mobility generate the usual employment disputes — hiring, termination, and wage-and-hour claims — that cost money to defend regardless of merit. EPLI keeps those off the operating budget.

Contract and certificate requirements

Certificate requests are constant for a pen-test firm, and they arrive bundled with the authorization the work legally requires. A typical MSA and statement of work will ask for Technology E&O and cyber at $1 million to $5 million depending on the client's size and sector, general liability at $1 million per occurrence for any on-site component, statutory workers' compensation, additional-insured status, and waiver of subrogation. Financial-services and healthcare clients — and any prime contractor flowing requirements down to you on a larger security program — routinely push limits higher and add specific notice and data-handling terms. The subtle trap is the authorization document itself. The rules of engagement, the get-out-of-jail letter, and the indemnity clause in the SOW define what you are permitted to break and who owns the consequences if something outside scope goes wrong. A OnePark Risk advisor reads the insurance exhibit, the authorization scope, and the indemnification language together, so what the contract lets you promise stays aligned with what your policies will actually fund — and so subcontracted testers are covered under the same terms.

What coverage costs

As of 2026, pen-test firm pricing is driven by revenue, headcount, the sensitivity of the clients and environments you test, whether engagements touch production versus staging, the use of subcontracted testers, and your own security controls. A firm testing hospitals, banks, and critical infrastructure prices above one doing marketing-site assessments, because the outage and missed-finding severity is fundamentally different. Underwriters focus on how you contain your own risk: scoped rules of engagement, change-control and rollback procedures during testing, MFA and hardening on tooling, and encrypted, time-limited storage of findings. The severity math is why they ask — IBM's Cost of a Data Breach Report 2026 put the global average breach cost at $4.99 million, and a leaked set of findings hands an attacker a shortcut into that outcome across every client in the file. Rather than quote a single number, a OnePark Risk advisor benchmarks the firm across the carriers that actively want security-testing business — appetite in this class varies widely — and shows how limits, retentions, and control documentation move the premium before renewal.

AI exposure note

Pen-test firms increasingly lean on AI-assisted tooling — automated recon, AI-generated exploit code, and machine-triaged findings. Confirm how your Tech E&O form treats results produced or actions executed by automated systems: if an AI-driven scan causes an outage or an AI-triaged report misses a vulnerability, you want the claim analyzed as a covered professional-services failure, not disputed as an unapproved automated process. Ask the question at placement, and be ready for underwriters to ask how a human validates AI-generated findings before they reach the client.

Illustrative example: The production system that went down

During an authorized external assessment, an automated scan overwhelms a client's payment gateway that turns out to be far more fragile than the client disclosed. The gateway is offline for several hours during business hours, and the client claims lost transactions and emergency remediation costs. The combined Tech E&O/cyber form responds to the client's claim that the testing caused the outage, funding defense and any negotiated settlement reflecting the documented losses and the limitation-of-liability terms in the statement of work — the outage scenario this coverage exists for.

Illustrative example: The finding that wasn't in the report

A firm delivers a clean-enough report on a web application. Months later the client is breached through a vulnerability in a component the client argues fell within the tested scope, and demands the firm answer for the remediation and notification costs. This is a professional-services dispute over the adequacy of the assessment. Technology E&O assigns defense counsel and funds the response, with the scope and rules-of-engagement documentation central to the defense and any resolution.

Illustrative example: The leaked findings

An attacker compromises a tester's cloud storage and exfiltrates draft reports covering several clients — each a detailed inventory of exploitable weaknesses — then threatens to publish them. The cyber side funds forensics, extortion negotiation, and notification to the affected clients, and the third-party liability terms respond to claims from those clients whose vulnerabilities were exposed by the firm's data-handling failure.

How much does insurance cost for a penetration testing firm?

There is no flat rate. As of 2026, pricing is driven by revenue, headcount, the sensitivity of the clients and systems you test, whether you touch production environments, subcontractor use, and your own security controls. Many small firms structure Technology E&O and cyber at $1 million to $5 million to satisfy client contracts, with general liability added for on-site work; the right way to size premium is to benchmark the specific firm across several carriers rather than rely on a single quoted number.

Are we liable if our testing crashes a client's production system?

You can be, even with authorization — the rules of engagement define what you were permitted to do, not a guarantee that nothing breaks. Whether a claim succeeds depends on the scope, the client's disclosures about system fragility, and the limitation-of-liability terms, but defending it costs money regardless, and that defense is exactly what the Technology E&O policy funds.

What happens if a client is breached through something our test missed?

The client may allege the assessment should have caught it, turning your deliverable into an errors-and-omissions claim. The tested scope, methodology, and report language become central, and Technology E&O funds the defense and any settlement. This is one of the two dominant claim patterns in this vertical, alongside outages.

How do we protect the findings reports we hold?

Treat them as the crown jewels they are: encrypted storage, MFA on the tools that hold them, strict access controls, and time-limited retention with secure destruction after delivery. Underwriters ask about all of this, and your cyber coverage responds if a compromise of those reports exposes client weaknesses — but strong handling is what keeps the incident from happening.

Do subcontracted or 1099 testers change our coverage needs?

Yes. Confirm your policies cover work performed by subcontractors under your contract and authorization, collect certificates and additional-insured status from them, and make sure the client's MSA permits subcontracting the engagement at all. These gaps surface only after an incident, when every carrier is looking for someone else to pay.

What do clients typically require in our contracts?

Commonly Technology E&O and cyber at $1 million to $5 million, general liability at $1 million per occurrence for on-site work, statutory workers' compensation, additional-insured status, and waiver of subrogation. Regulated clients and prime contractors flowing requirements down to you push limits higher and add data-handling and notice terms.

Can OnePark Risk review the authorization and insurance language in our SOWs?

Yes. We review the insurance exhibits, the rules of engagement, and the indemnification clauses together against your actual policies, and flag mismatches — scope wording, limit floors, additional-insured terms — before a client's counsel finds them after an incident.

Frequently asked questions