Cyber Insurance Won't Save You If Your Basics Aren't in Place: What Insurers Actually Check

Here's a number worth sitting with: of the tens of thousands of cyber insurance claims closed industry-wide in a recent year, fewer than one in four actually resulted in a payout. Not because insurers are looking for reasons to say no — but because most applicants never had the basics locked down in the first place, and the gap only surfaces after the breach, when it's far too late to fix.

Cyber insurance was never meant to be a substitute for security. It was meant to be the safety net underneath it. But too many organizations still treat the policy as the strategy — buy the coverage, file it away, move on. That mindset is becoming an expensive one.

The Market Has Changed - And So Has the Application

Cyber insurance applications used to be a short questionnaire: a handful of yes/no boxes, a signature, a premium quote. That era is over.

Underwriting today looks a lot closer to a technical audit than a form. Carriers now run external scans against your infrastructure, cross-check your answers against what they can actually observe, and increasingly reserve the right to dispute or rescind a claim if the controls you attested to weren't genuinely in place - or weren't maintained - at the time of the loss. Analysts are projecting another double-digit premium increase in the year ahead, driven largely by rising claim severity and a new wave of AI-assisted attacks. The market is rewarding organizations with strong, demonstrable defenses - and pricing everyone else out.

In other words: the policy isn't the hard part anymore. Qualifying for one that actually pays out is.

1. MFA: The Control That Kills the Most Applications

Multi-factor authentication (MFA) is the single most common reason applications get flagged, declined, or quietly downgraded on coverage.

But "we have MFA" doesn't mean much to an underwriter anymore. What they actually want to know is whether it's enforced everywhere it needs to be - not just on email logins, but on:

• Domain admin and Microsoft 365 global admin accounts
• VPN and remote access
• Backup administrator and firewall administrator accounts
• Hypervisor and infrastructure management consoles

A single unprotected admin account - the one everyone forgot about - is exactly the kind of gap that turns a routine renewal into a denied claim later. Increasingly, carriers are also pushing past basic MFA toward phishing-resistant MFA on privileged and remote access accounts, since SMS codes and push notifications are no longer considered strong enough on their own.

2. EDR/MDR: Why Antivirus Alone No Longer Counts

Traditional, signature-based antivirus stopped satisfying most carriers years ago. The baseline now is endpoint detection and response (EDR) - with behavioral analysis, isolation capability, and centralized visibility - deployed across every workstation, laptop, and server.

That last part trips up more organizations than anything else. EDR usually gets deployed thoroughly across employee laptops, but the file server sitting quietly in the back office is often left uncovered entirely - and that's precisely the machine an attacker wants.

Increasingly, having the tool installed isn't enough either. Carriers want to see it monitored around the clock, with alerts routed to a security operations function that can actually respond in minutes rather than during the next business day. An EDR agent silently generating alerts nobody reads overnight doesn't meet the bar anymore.

3. Backups: Immutable, Tested, and Provable

Ransomware made backups the third pillar of insurability, and the requirements have gotten a lot more specific. Insurers now generally expect backups that are:

• Immutable for a defined retention window, so they can't be encrypted or deleted by an attacker who's already inside your network
• Stored offsite and logically separated from production systems
• Actually restore-tested - not just running, but proven to work when you need them

A backup that hasn't been restore-tested in over a year is treated by many carriers the same way as no backup at all. It's not enough to know backups exist; you need a documented last-tested date you can hand over on request.

4. Incident Response: The Plan You've Actually Rehearsed

Every underwriting questionnaire now asks, directly, whether a documented incident response plan exists. Increasingly, they also ask when it was last tested.

A plan sitting in a shared drive that nobody has walked through since it was written isn't much better than no plan - and it shows during an actual incident, when the people who are supposed to execute it are improvising instead. Carriers are increasingly looking for evidence of tabletop exercises: a recorded date, a list of participants, a summary of what was learned and fixed afterward.

The Controls Insurers Check Beyond the Big Four

MFA, EDR, backups, and incident response form the core of most underwriting decisions, but the fuller checklist has expanded to include:

• Security awareness training and phishing simulations - tracked as a control associated with lower claim likelihood, not just a compliance formality
• Privileged access management (PAM) - vaulting, just-in-time elevation, or strict network restrictions for accounts that can't use MFA directly
• Centralized logging with defined retention periods, so an incident can actually be reconstructed after the fact
• Vendor and third-party risk management, including verification practices for vendor payment and change requests
• Patch management cadence, particularly for internet-facing systems
• Network segmentation, especially for manufacturers separating operational technology (OT) from corporate IT - a control that's increasingly earning direct underwriting credit
• Annual penetration testing, expected as a baseline for organizations carrying larger policy limits

Framework alignment matters too. Carriers increasingly want to see controls mapped to a recognized structure like the NIST Cybersecurity Framework or CIS Controls, rather than an ad hoc list of tools purchased over time.

The Real Shift: From "Do You Have It" to "Can You Prove It"

Here's the pattern underneath all of it: the controls themselves haven't changed all that much. MFA, endpoint monitoring, and tested backups have been security fundamentals for years. What's changed is that insurers no longer take your word for it.

Misrepresenting your controls - even by accident, even by checking a box for something you technically have but haven't properly configured - has become one of the leading causes of denied claims. And it cuts both ways: organizations that genuinely have strong controls in place sometimes lose coverage anyway, simply because they can't produce the evidence fast enough when it's requested.

That's the real lesson buried in "cyber insurance won't save you if your basics aren't in place." It's not just about having MFA, EDR, and backups. It's about being able to hand an underwriter - or a forensics team, mid-incident - proof that every one of those controls was actually running, enforced, and tested on the day something went wrong.

The organizations that treat their next renewal as a chance to close that evidence gap, well before the questionnaire lands in their inbox, are the ones who'll find out their policy actually works when they need it to. The ones who don't are the ones adding to next year's claim-denial statistics.