Can You Add an Additional Insured to a Cyber Insurance Policy?
Your client’s contract asks for additional insured cyber insurance and Tech E&O. Here’s what that request really asks for, what insurers will usually agree to, and how to negotiate the clause without losing the deal.
Your client’s legal team sends back the master services agreement with one open item: “Vendor shall name Client as an additional insured on all required policies, including Cyber Liability and Technology Errors & Omissions.” Your general liability insurer added them in a day. Your cyber insurer is asking questions. The contract is supposed to be signed this week.
Additional insured cyber insurance coverage is possible, but not in the way most contracts assume. Many cyber and Technology E&O insurers will add a client as an additional insured only for claims made against the client because of your work, often called vicarious liability. They usually won’t cover the client’s own breach costs or claims the client brings against you. Often the better fix is to ask what the client actually needs: proof you carry the right limits, an indemnity backed by your policy, or a narrower additional insured endorsement that the insurer will issue.
What “additional insured” means
An additional insured is a person or company that gets some protection under your policy even though they didn’t buy it (see IRMI’s definition). The idea comes from general liability insurance. If a visitor trips over your equipment at a client’s office and sues the client, your general liability policy can defend the client as an additional insured. Adding a client this way is routine, so contract templates ask for it on every policy by habit.
Cyber and Technology E&O policies work differently. They’re written around your data, your systems, and your professional services, and many standard forms don’t mention additional insureds at all. When the request reaches a cyber or Tech E&O insurer, it usually needs an endorsement, and the insurer will decide how far that endorsement goes. That endorsement is what a contract is really asking for when it requires additional insured cyber insurance.
Why additional insured cyber insurance is harder to get
- The likely claim is your client suing you. If your software fails or your systems leak your client’s data, the claim usually comes from the client. Making the client an insured doesn’t help with that claim. Some policy wording can even make it harder, so your broker should check that adding the client won’t trigger an “insured versus insured” exclusion against their claim on you.
- First-party costs belong to you. Forensics, breach notification, data restoration and business interruption cover the named insured’s own losses. An additional insured endorsement typically doesn’t give your client their own breach response coverage.
- The client shares your limit. Anything paid to defend an additional insured comes out of the same limit that protects you. A $2M policy with a client attached is still a $2M policy.
- Every client wants the same thing. An insurer that agrees for one client is agreeing for dozens. That’s why many insurers offer a blanket endorsement with narrow wording rather than custom language for each contract.
What insurers will usually agree to
Terms vary by insurer and by your risk, but these are the most common additional insured cyber insurance terms you’ll see in contracts, and what insurers will usually issue:
| What the contract asks | What it means | What’s often available on cyber / Tech E&O |
|---|---|---|
| Additional insured | Your policy protects the client too. | Often available by endorsement, limited to claims against the client that arise from your acts or errors (vicarious liability). |
| Blanket additional insured | Anyone you’re required by written contract to add is added automatically. | Offered by some insurers; saves a new endorsement for every client. Check that it applies to both cyber and Tech E&O parts of the policy. |
| Primary and non-contributory | Your policy pays first and won’t ask the client’s insurer to share. | Often available alongside an additional insured endorsement, sometimes in the same wording. |
| Waiver of subrogation | Your insurer won’t sue the client to recover what it paid. | Often available “where required by written contract,” but read it carefully before agreeing to a broad version. |
| Notice of cancellation | The client is told if your policy is cancelled. | Usually available by endorsement, commonly 30 days (10 days for nonpayment). |
| Coverage for the client’s own breach | Your policy pays the client’s own breach response costs. | Rarely available. Address it through indemnity and limits instead. |
A certificate alone isn’t coverage
The standard certificate of insurance has an “additional insured” column. Checking that box doesn’t create coverage. The certificate only reports what the policy says, so the endorsement has to exist on the policy first. If a client asks for a certificate showing additional insured cyber insurance status, or the same on Tech E&O, make sure the endorsement is issued before the certificate goes out. A certificate that overstates your coverage can create problems for you and your broker if a claim comes in.
Three common situations
A health system wants to be added on your Tech E&O
The hospital’s real concern is a patient or regulator pulling them into a claim caused by your platform. A vicarious liability additional insured endorsement plus primary and non-contributory wording usually covers that concern. Their own breach costs are handled through your indemnity and the limits in the contract.
A bank client wants additional insured on “all policies”
Provide it on general liability, auto and umbrella, where it’s standard. On cyber and Tech E&O, offer a blanket endorsement for claims arising from your services, or propose clause language that requires additional insured status only “where commercially available.” For more on MSP coverage, see our MSP insurance guide.
The client also wants $5M and a waiver of subrogation
Additional insured requests often arrive with a limit you don’t carry. Solve both together. Raising your limit or adding an excess layer can change which endorsements are available, because every insurer in the tower has to agree to them. Our guide to $5M contract requirements and excess cyber insurance explain how.
How to negotiate the clause
Before you accept additional insured cyber insurance wording, ask what the client is trying to protect. Most clients aren’t attached to the words “additional insured.” They want to know a claim caused by your work won’t land on them. You can often meet that goal with language your insurer can support:
- Limit the additional insured requirement to general liability, auto and umbrella, and require cyber and Tech E&O “with limits of not less than” the agreed amount.
- Add “to the extent commercially available” or “where permitted by the policy” to the cyber and Tech E&O requirement.
- Describe the scope: “for claims against Client arising out of Vendor’s services.”
- Pair a strong indemnity with insurance that responds to it, so the client is protected without becoming an insured.
- Agree on the evidence: a certificate plus a copy of the endorsement, rather than a box checked on the certificate alone.
Bring your broker in before you send redlines. It’s easier to agree on wording when you already know what your insurer will issue. Our contractual insurance requirements team reviews these clauses every week.
What to send your broker
- The insurance section of the contract, plus the indemnity clause.
- The client’s exact legal name and the date the certificate is due.
- Which policies the client wants to be added to.
- Any related requests: primary and non-contributory, waiver of subrogation, notice of cancellation, higher limits.
- How many other clients ask for the same thing, so your broker can ask about a blanket endorsement.
Check your contract in minutes
Cyber Insurance Contract Checker
Paste the contract’s insurance section and see which requirements your current coverage meets, including additional insured and waiver of subrogation.
Check your contract →Cyber Insurance Limit Calculator
If the contract also asks for a higher limit, estimate the limit your business actually needs.
Estimate your limit →Frequently asked questions
Can my client be an additional insured on my Technology E&O policy?
Often, yes, but usually only for claims made against the client because of your services. It typically doesn’t cover claims the client brings against you or the client’s own losses.
Does a certificate of insurance make my client an additional insured?
No. A certificate only reports what your policy says. The policy needs an additional insured endorsement first, and the certificate should match it.
Does additional insured cyber insurance cost more?
It depends on the insurer. Some include a blanket endorsement at no extra cost, others charge or decline. Your broker can ask before your client’s deadline.
What’s the difference between a certificate holder and an additional insured?
A certificate holder receives proof of your coverage. An additional insured gets some protection under your policy. Many contracts only need the first.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Contract asking for something your policy can’t show?
Send us the insurance section. We’ll tell you what your insurer can issue, suggest clause language, and quote higher limits if you need them.
Request a Contract Review Use the Contract CheckerThis article is general information, not legal advice or a statement of coverage. Coverage depends on each policy’s terms, conditions and endorsements. Have your attorney review contract language.