Contents
Short answer
In simple terms: IT professional liability typically applies when you make a mistake while working for clients and the client suffers a financial loss as a result. Cyber insurance typically applies when your own business is hit by a cyber or data protection incident – and in part for resulting third-party claims. Both can complement and overlap each other; the exact boundary is set only by the respective conditions.
The two policies at a glance
IT professional liability
Typically professional breaches of duty and the resulting financial losses of third parties, for example from programming errors, wrong advice or project delays.
Cyber insurance
Typically the consequences of a cyber or data protection event in your own business: forensics, data recovery, business interruption – and, depending on the contract, third-party liability claims arising from that event.
Why the simplification isn’t enough
“IT liability = third-party losses, cyber = own losses” is a rough guide. Cyber policies often include a liability part, and some IT liability contracts have cyber add-ons. So cover can overlap, or gaps can arise.
Comparison by loss scenario
| Scenario | Typically IT liability | Typically cyber insurance | Overlap possible? | Check in the contract |
|---|---|---|---|---|
| Programming error causes client loss | Yes | Rather not | Rarely | Financial losses from your work, sum insured |
| Misconfiguration at the client | Yes | Rather not | Possible if a security incident follows | Description of activities, exclusions |
| Your own business is hacked | No | Yes | Rarely | Insured events, obligations |
| Your systems need forensic investigation | No | Yes | Rarely | Assistance, choice of provider, consent |
| Your own data must be restored | No | Yes | Rarely | Own-loss module, sub-limits |
| Cyber attack causes business interruption | No | Yes, if agreed | Rarely | BI module, indemnity period, time excess |
| Your compromised system harms a client | Possible | Possible (cyber liability) | Yes | Priority and subsidiarity clauses in both contracts |
| Data protection breach leads to third-party claims | Possible | Possible | Yes | Data protection liability, GDPR claims, exclusions |
Step by step
- 01
Describe your work
Note which services you provide to clients. That determines which breaches of duty an IT liability policy would need to cover.
- 02
Check your own IT dependency
How much does your business rely on its own systems, email and client data? That concerns the cyber part.
- 03
Read existing contracts
Check whether your liability policy already contains cyber add-ons or your cyber policy liability parts.
- 04
Clarify overlaps
Look for priority or subsidiarity clauses: which contract pays first if both could apply?
- 05
Close gaps
Discuss scenarios that neither contract covers with your broker or insurer.
Checklist
- My professional activities are described correctly in the liability contract.
- I know whether my cyber policy includes a liability part.
- Priority and subsidiarity clauses are checked.
- Business interruption is consciously chosen or declined.
- Scenarios where my compromised system harms a client are clarified.
Common mistakes
- Assuming IT liability also covers an attack on your own IT.
- Assuming cyber insurance covers every mistake in client projects.
- Treating the “third-party vs own loss” simplification as a cover decision.
- Not checking overlaps and priority clauses.
Frequently asked questions
Is IT liability enough for an IT service provider?
It typically covers mistakes in your work for clients. Consequences of an attack on your own business are usually not included. Whether you need both depends on your work and your contracts.
Can one incident affect both policies?
Yes, for example if your compromised system causes losses at clients. The conditions then set which contract pays first.
What happens with losses at the client?
If they result from a professional mistake, IT liability is typically relevant. If they stem from a cyber attack on you, the liability part of a cyber policy can be relevant.
Are there combined products?
Yes, some providers offer cyber as an add-on to liability cover. Even then, the conditions determine the scope.
Sources
- Anbieterquelle: Hiscox – Unterschied IT-Berufshaftpflicht & Cyber-Versicherung (aktualisiert 17.09.2026)
- GDV – Das leistet eine Cyberversicherung (aktualisiert 21.04.2026)
- GDV – Unverbindliche Musterbedingungen AVB Cyber (Stand 02/2024)
Checked on 7 October 2026.
This content is for general guidance only and does not replace individual insurance advice, legal advice or a technical security review. What counts are the relevant policy conditions, the policy schedule and the specific case.