Cyber insurance used to be straightforward to buy. You answered a short questionnaire, paid a modest premium and moved on. That market is gone.
After several years of loss ratios that made the product unprofitable, carriers rewrote their approach. Applications went from one page to fifteen. Underwriters started scanning applicants’ external infrastructure before quoting. And critically, they began denying claims where the insured had attested to controls that turned out not to be in place.
If your renewal is coming up, here is what you are going to be asked and what to do about it.
The five controls that decide whether you get quoted
Multi factor authentication
This is the first question on nearly every application, and for many carriers a “no” ends the conversation.
They want it on email, on remote access and VPN, and on privileged administrative accounts. Those are the three paths that account for most claims. Note the specificity: having MFA enabled for some users, or having it available but not enforced, is not the same as having it deployed, and an underwriter reviewing a claim will look at the actual configuration rather than your intent.
Watch for the gaps that quietly bypass it. Legacy authentication protocols in Microsoft 365 will happily accept a username and password with no second factor unless you explicitly disable them. Application passwords do the same thing.
Endpoint detection and response
Traditional signature based antivirus no longer satisfies most carriers. They ask specifically for endpoint detection and response, meaning software that monitors process behavior and can isolate a machine automatically, and increasingly they ask whether it is monitored around the clock by humans.
The distinction matters because the ransomware that generates claims is usually not a known file. It is a legitimate administrative tool being used maliciously, or code that only ever exists in memory. Signature matching does not see it.
Offline or immutable backups
Carriers learned that backups on the network get destroyed before encryption begins, because that is precisely what forces payment. Modern attackers hunt backup infrastructure first.
The application will ask whether backups are offline, air gapped or immutable, and whether restores have been tested. Answer honestly. An external drive plugged into the server it protects is none of those things.
Email security
Business email compromise generates more claims than ransomware in many carriers’ books, and the losses are frequently uninsured because the policy did not include social engineering coverage.
Expect questions about filtering, about whether you have SPF, DKIM and DMARC configured, and about your process for verifying changes to payment details. That last one is not technical at all: it is asking whether somebody picks up the phone and calls a known number before wiring money to new instructions.
Security awareness training
Carriers want to see a documented, recurring program with simulated phishing rather than a one time session at onboarding. They may ask for click rate data.
What underwriters check without asking
A growing number of carriers scan your external footprint before quoting. They are looking for exposed remote desktop, unsupported software versions visible in service banners, missing email authentication records and credentials from your domain appearing in breach dumps.
You can look at most of this yourself. If something is visible to an underwriter it is visible to an attacker, and the attacker got there first.
The warranty problem
This is the part that gets overlooked and matters most.
Insurance applications are warranties. When you sign one, you are making representations that the policy is priced on. If a claim arises and the carrier discovers that a control you attested to was not actually in place, they have grounds to deny the claim or rescind the policy entirely.
There are litigated cases on this point. The pattern is consistent and unhappy: a business suffers a ransomware event, files a claim, and the carrier’s forensic review finds that multi factor authentication was not enforced on the account that was compromised, despite the application saying it was. Nobody lied deliberately. Somebody assumed, or the answer was accurate when given and drifted afterward.
Before you sign a renewal, verify each answer rather than remembering it. If your IT provider fills out the technical sections, have them confirm in writing that they have checked rather than recalled.
A sensible order of operations
If you are looking at an application and finding gaps, this is roughly the sequence that gives you the most coverage for the least money and disruption:
- Enforce MFA on email, VPN and admin accounts, and disable legacy authentication. Usually days of work, mostly free if you already have Microsoft 365.
- Deploy endpoint detection and response across every device. Modest per device cost, quick to roll out.
- Get one backup copy immutable, verified with an actual test restore. This is often a configuration change rather than a purchase.
- Configure SPF, DKIM and DMARC properly. Free, and it stops your domain being spoofed.
- Start a training program. Inexpensive per user and gives you documentation immediately.
None of these are exotic. They are the baseline, and the reason carriers ask about them is that the claims data shows they work.
Where we come in
We go through insurance applications with clients regularly, line by line, and it is genuinely one of the more useful things we do. The application turns out to be a decent security checklist written by people with financial incentive to identify what actually causes losses.
If your renewal is coming and you are looking at questions you cannot confidently answer, we will review your environment against the application, tell you where you actually stand and quote the gaps. Our cybersecurity services cover the controls themselves, and our backup and disaster recovery work covers the immutability requirement.
The report is yours regardless of whether you hire us to fix anything.