What Cyber Insurers Now Require Before They'll Cover You

A few years ago, a cyber insurance application asked whether you had antivirus and a firewall, and the answer was worth a discount. This year's renewal packet asks whether MFA covers every remote access path including vendor connections, which endpoints lack EDR, when you last restored from an offline backup, and the date of your most recent incident-response tabletop. It wants attestations. Sometimes it wants evidence.

Business owners tend to read this as insurance companies being difficult. It's simpler than that: they got tired of losing money.

Why underwriting turned into an audit

The ransomware wave made cyber a money-losing line for a stretch, and carriers responded the way carriers do — by repricing risk and demanding the behaviors that reduce it. They now underwrite the way a fire insurer looks at sprinklers: no controls, no coverage. And the risk picture for smaller businesses is specifically what they're reading. Per the Verizon DBIR 2026, 88% of breach incidents at small and mid-sized businesses involved ransomware or extortion — more than double the share at large organizations. Per IBM's Cost of a Data Breach 2026 report, the average U.S. breach now runs $11.5 million, a record. Your claim won't look like that average, but your carrier's book of claims does.

The control checklist carriers now expect

Questionnaires differ, but the same core keeps appearing. Consider this the de facto minimum for decent terms in 2026:

• MFA everywhere that matters. Email, VPN and any remote access, administrator accounts, and — increasingly called out by name — the backup console. "Mostly deployed" is a real answer; say so precisely.
• EDR on every endpoint, with someone watching it. An EDR platform installed is table stakes; carriers now ask who monitors and responds, and whether that coverage is 24/7. This is where managed detection and response enters the conversation.
• Backups that would survive your attacker. Encrypted, with an offline or immutable copy, separated credentials, and documented restore tests. Backups the ransomware can also encrypt don't count — and underwriters know to ask.
• A written, exercised incident response plan. Not a binder — a plan with names, phone numbers, and a tabletop exercise on the calendar.
• Patch discipline and no end-of-life systems. Critical vulnerabilities remediated on a defined timeline; unsupported operating systems gone or isolated.
• Email security and user training. A filtering gateway, DMARC enforcement, and phishing-awareness training with some evidence it happens.
• Privileged access under control. Admin rights limited and logged, no shared admin accounts, vendors' remote access constrained.

How premiums and terms actually respond

Controls don't just get you covered — they set the shape of the coverage:

• Strong posture earns better premiums, lower retentions, higher limits, and a smoother renewal with fewer follow-up questions.
• Gaps get priced in: surcharges, ransomware sublimits and coinsurance (you pay a percentage of every ransomware loss), exclusions tied to the missing control, or a flat declination.
• Misstatements are the expensive ones. The application is a signed representation. Carriers have contested and denied claims — and moved to rescind policies — when the controls a business attested to weren't actually in place at claim time. A false "yes" on the MFA question can convert your premium into a donation.

The rule: answer precisely, never aspirationally. "Deployed for all staff except the warehouse kiosks, remediation scheduled Q3" is a strong answer. An unqualified checkbox you can't back with evidence is a time bomb.

Preparing for the questionnaire: the 90-day version

1. Get the current form early from your broker — carriers revise them, and last year's answers won't map cleanly.
2. Answer it as a gap assessment with your IT team or provider, months before it's due. Every "no" is now a project with a deadline instead of a premium penalty.
3. Close the big four first: MFA coverage, monitored EDR, backup isolation and restore tests, and the incident response plan with a tabletop on record. They carry the most underwriting weight.
4. Build an evidence file: MFA policy exports, monitoring agreements, restore-test logs, training completion reports, the IR plan's revision date. Renewal becomes paperwork instead of archaeology.
5. Have your IT partner co-complete the technical sections. Guessing is how misstatements happen. Ours sit on renewal calls with clients' brokers for exactly this reason.

Where a security partner fits

Most of what carriers demand is simply a competent security program — the questionnaire is just the first audience for it. A capable provider maps your controls to the application, closes the gaps (that's the heart of our managed cybersecurity service, and our cloud backup and disaster recovery work covers the restore-test evidence), and hands you documentation an underwriter respects. The controls also have to actually work, of course — the insurer is only the second-worst party to discover they don't.

Insurers stopped selling promises and started auditing controls. Walk into renewal with evidence, and the market starts working for you again.