MSP Insurance: When a Client Breach Traces Back to Your Remote Access Tools

What happens to an MSP when an attack spreads through its RMM tool to clients?

When an attack spreads through an MSP's RMM tool to its clients, the MSP typically faces two problems at once: its own cyber incident response costs, and claims from affected clients alleging the MSP failed to protect their systems. Clients often look to the MSP first for their recovery costs and lost revenue. These events move quickly, with every client calling at once. How your insurance is structured determines who pays for what, and how much is left after the first few claims.

Do tech E&O and cyber insurance both respond to a downstream client breach?

Technology errors and omissions (tech E&O) and cyber insurance usually both respond to a downstream client breach, with tech E&O covering claims that your services failed and cyber covering your own breach costs and network security liability. Many MSPs buy the two together on one combined form, which reduces gaps and arguments between carriers. In short, tech E&O answers claims by clients that your work or services caused their loss, while cyber pays your first-party costs, such as forensics, data restoration, extortion and business interruption, and covers liability for failing to prevent a network security breach. For a downstream event, you want both coverages triggered cleanly by the same incident.

Why do shared aggregate limits matter for MSPs?

Shared aggregate limits matter for MSPs because one compromised tool can generate claims from many clients, and all of those claims typically draw down the same policy aggregate limit. A $2 million aggregate can look generous for a single client dispute, but it can disappear quickly when twenty clients file claims from the same event. Many policies treat related claims arising from the same incident as a single claim. That can help, because you pay one retention instead of many, but it also means one limit covers all of them. Your own first-party costs may share that same aggregate, depending on how the policy is built.

• Model a scenario where your largest group of clients is hit at once.
• Ask whether first-party and liability coverages share one aggregate or have separate limits.
• Review how the policy defines related or interrelated claims.
• Consider excess tech E&O and cyber limits as your client base grows.

How do limitation of liability clauses in MSAs affect MSP insurance?

Limitation of liability clauses in master services agreements (MSAs) affect MSP insurance by capping what clients can recover, which protects your insurance limits and makes your risk easier to underwrite. A common approach caps damages at fees paid over a set period and excludes indirect or consequential damages, though whether a court enforces a cap depends on the contract and state law. Watch the other direction too. Tech E&O policies often exclude liability you assume under contract beyond what you would owe anyway, so a broad indemnity may not be insured. Clients increasingly ask to carve security breaches out of the cap, so check how that interacts with your limits before agreeing.

• Use a consistent MSA with a clear limitation of liability clause.
• Avoid uncapped indemnities for data breaches unless your limits support them.
• Document service scope so clients know what you do not manage.
• Have your broker review contract insurance clauses before signing.

What security controls do insurers require from MSPs?

Insurers commonly require MSPs to use multi-factor authentication on RMM tools and all remote access, privileged access management, endpoint detection and response, and immutable or offline backups, and weak controls can mean higher retentions, lower limits or a declined application. Underwriters now ask MSP-specific questions because they understand the downstream risk. Expect questions about client segmentation, patching speed and admin accounts.

• Multi-factor authentication on RMM, PSA and every remote access path.
• Privileged access management with separate, monitored admin accounts.
• Endpoint detection and response, often with 24/7 managed monitoring.
• Immutable or offline backups, tested regularly.
• Segmentation between client environments and prompt patching of your tools.

Can clients require an MSP to name them as additional insured?

Clients can ask an MSP to name them as additional insured, but additional insured status is common on general liability and much less commonly available on tech E&O or cyber policies. When a client requests it on professional coverage, the practical answer is often to provide a certificate showing the required limits, backed by contractual indemnity. Client contracts frequently specify tech E&O and cyber limits, commonly in the $1 million to $5 million range for mid-market clients, with higher requirements from regulated or enterprise clients. Track these requirements so no contract quietly exceeds what you carry.

Ready to review your MSP insurance program?

If you want to test your limits against a multi-client event or review your MSA insurance clauses, we are happy to work through it with you. Schedule a conversation at calendly.com/grandbayfinancial.