Subrogation: The real threat to your MSP

A lot of agents love to talk about claims being denied, which is a very rare occurrence in reality. What should actually keep MSP owners up at night is almost as bad: subrogation from a client’s insurance carrier.

Subrogation is your insurance nerd term of the week - the carrier’s right to try and recover costs from your MSP after paying a claim for one of your clients.

In 2025 we saw a rapid uptick of a specific question being asked by the insurance lawyers during a claim:

Does your company use an MSP?

Followed by:

Can you please provide a copy of the contract?

Next, they are looking for every hole in the contract they can leverage to claw back some of their costs.

How can your MSP protect itself?

There are two key defenses against subrogation:

Solid contracts: don’t just hire any lawyer off the street. Ideally, find an MSP savvy one (we keep a list here) but at least avoid generalists. There are nuances to technology contracts they may not be familiar with. The most important parts of the contract are limitations of liability with financial caps, and proper indemnification.

  • Typically MSPs will limit damages to the previous 6 to 12 months of spend. Make sure and scope that specifically around the services delivered under the agreement. For example, you do not want a giant order of computers to temporarily increase your liability.

  • One tip for indemnification is to include your client’s employee actions. Our MSProtect policy recently paid out a claim where we provided legal defense to an MSP due to a client’s employee suing for wrongful termination.

Document, document, document - in writing

We’re not going to advise on the right way to get a client to sign/approve/etc., talk to your attorney. Just make sure you have a detailed level of documentation, both for client approvals/denials, but also what actions were performed. A lack of logging and approvals can give the appearance of a coverup by your MSP, or something worse. On the other side, well documented steps can prove that the right processes were followed and protect your MSP from claims for subrogation.

Next
Next

Should you include crime/funds transfer fraud on your cyber policy?