Introduction: Why this matters now
Here’s an uncomfortable truth we’re seeing play out with more and more business owners this year: having a cyber insurance policy is no longer the same as having cyber insurance cover.
For years, buying a policy was simple. You filled in a short questionnaire, ticked a few boxes "Do you have antivirus?", "Do you back up your data?" paid your premium, and filed the certificate away. If disaster struck, the assumption was that the insurer would step in.
That world has quietly ended. Insurers have paid out on too many ransomware and fraud claims where the business’s actual security didn’t match what was written on the form. In response, they have rebuilt underwriting from the ground up from a trust based questionnaire into an evidence based audit. Independent research now shows that as many as 41% of cyber insurance applications and claims are being declined or denied outright, and in a large share of those cases the reason traces back to security controls that were promised but not properly in place, particularly multi-factor authentication.
If you’re the Owner or Director of a 10 to 250 person business, this matters enormously. You’re the one who signed the application. You’re the one who will be relying on that payout if a ransomware gang locks your systems or a fraudster tricks your finance team into a money transfer. This month’s newsletter breaks down exactly what insurers now expect, why claims are being refused, and most importantly the practical checklist you can work through before your next renewal, so the policy you’re paying for actually pays out when you need it.
The Big Shift: From "Tick a Box" to "Prove It”
Up to around 2024, insurance applications asked simple yes/no questions. In 2026, questionnaires have grown from around ten questions to sixty or more, and many carriers now ask for supporting evidence screenshots of your security settings, exported configuration reports, or a copy of your written incident response plan before they will even quote. Some insurers now run their own external scans of your systems during underwriting to check that what you wrote matches reality.
The single biggest culprit behind denied claims is multi-factor authentication (MFA) not because businesses lack it entirely, but because it’s only partly switched on. A separate analysis puts MFA failures behind 37% of all denied claims. In other words: "we have MFA" on email is not the same as MFA everywhere it’s needed and insurers now know the difference.
The UK Legal Angle: Why "Fair Presentation" Matters More Than You Think
For UK businesses, there’s an added legal layer worth understanding. Under the Insurance Act 2015, a business taking out commercial insurance has a "duty of fair presentation" you must disclose every material fact about your risk accurately, including your actual security controls, not just what you believe or hope is true. If a claim comes in and the insurer discovers your presentation wasn’t accurate:
- If the inaccuracy was deliberate or reckless, the insurer can refuse to pay the claim entirely and keep your premium.
- If it was an innocent mistake, the insurer can still apply "proportionate remedies" scaling down your payout, adding new exclusions retroactively, or treating the policy as if it had different terms from the start.
This is precisely why the person who filled in your renewal questionnaire matters. If it was your IT provider or a well meaning office manager answering "yes" to "Do you have MFA?" without checking every system, your business not them carries the legal risk when a claim is assessed. There’s also a practical compliance link: if your incident involves personal data, UK GDPR requires you to notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. Insurers will expect to see that this process is documented and ready to go not worked out for the first time during a live incident.
The 2026 Insurer Checklist: What They Now Demand
Here is the core list of controls insurers expect before they will write or renew your policy:
1. Multi Factor Authentication (MFA) everywhere, not just email
What it means: A second login step (a code from an app, a hardware key, or a fingerprint) in addition to a password.
Why insurers demand it: Passwords alone are the number one way attackers get in. MFA blocks the vast majority of account takeover attempts.
How to action it: Confirm MFA is switched on for email, VPN/remote access, all cloud admin accounts (Microsoft 365, Google Workspace), and every account with administrator privileges not just the ones staff use daily. Use an authenticator app or hardware key rather than a text message code where possible, as SMS based codes are increasingly viewed by insurers as weaker and are being phased out by providers like Microsoft.
2. Endpoint Detection and Response (EDR) not just antivirus
What it means: Modern software that actively watches every laptop, PC and server for suspicious behaviour, rather than just matching known virus signatures.
Why insurers demand it: Antivirus alone misses new or targeted attacks; EDR can spot and stop an intrusion in progress.
How to action it: Ask your IT provider to confirm EDR (not legacy antivirus) is deployed on every device that touches your network, including servers, with alerts actually monitored ideally 24/7 by a managed service, since an EDR tool nobody watches is of limited value.
3. Tested, immutable backups
What it means: Backup copies of your data that an attacker cannot delete or encrypt, even if they get into your main systems, with recovery actually tested.
Why insurers demand it: Ransomware gangs specifically target backups first. Untested backups are treated by insurers as if they don’t exist.
How to action it: Follow the "3-2-1-1" approach three copies of your data, on two different types of storage, with one copy offsite, and one copy immutable or fully offline. Schedule an actual restore test at least once a year and keep a dated record of it.
4. A written, tested Incident Response (IR) plan
What it means: A short document naming who does what if you’re hit by a cyber incident who calls IT, who calls the insurer, who talks to customers, who decides whether to pay a ransom.
Why insurers demand it: Confusion in the first hours of an attack causes the most damage. A plan (and evidence you’ve rehearsed it) shows insurers you can respond fast.
How to action it: Write it in plain English, keep it to 2-3 pages, print a copy (your systems may be down), and run a "tabletop exercise" once a year simply talking through a fictional attack scenario as a leadership team and writing up what you’d improve.
5. Patching and vulnerability management
What it means: Keeping software and systems updated with security fixes on a defined schedule.
Why insurers demand it: Many breaches exploit vulnerabilities that had a patch available for weeks or months before the attack insurers increasingly treat this as avoidable negligence.
How to action it: Agree a patching SLA with your IT provider (e.g., critical fixes within 72 hours, everything else within 30 days) and ask for a monthly report confirming it’s being met.
6. Email authentication (SPF, DKIM, DMARC)
What it means: Technical settings on your email domain that stop criminals from sending emails that look like they’re from you or your suppliers.
Why insurers demand it: Email impersonation is the leading route into invoice fraud and business email compromise claims.
How to action it: Ask your IT provider to confirm DMARC is set to "reject" (not just "monitor") for your domain.
7. Staff security awareness training
What it means: Regular, short training so staff can spot phishing emails and social engineering attempts.
Why insurers demand it: Most incidents start with a person clicking a link or being tricked on the phone, not a technical hack.
How to action it: Run brief training (15 to 20 minutes) at least twice a year, plus periodic simulated phishing tests, and keep a record of who’s completed it insurers want evidence, not just a policy statement.
Your Pre-Renewal Action Checklist
Before your next renewal date, work through this with your IT provider and keep the evidence on file:
- MFA confirmed on email, VPN/remote access, cloud admin accounts, and every privileged account (screenshot or export as proof)
- EDR deployed and actively monitored on all laptops, PCs and servers.
- Backups tested with a documented, successful restore in the last 12 months
- Written incident response plan in place, with a tabletop exercise completed and documented this year.
- Patching schedule agreed with your IT provider, with monthly compliance reports
- DMARC set to "reject" on your email domain.
- Staff security awareness training completed and logged in the last 6 months
- Whoever completes your renewal questionnaire actually verifies each answer with your IT provider don’t guess
- Ask your broker for a copy of the underwriting questionnaire before renewal, so you know exactly what will be checked.
- Confirm your incident and data breach reporting process meets the ICO’s 72-hour requirement.
Conclusion
None of this means cyber insurance is a bad idea, quite the opposite. A well matched policy is still one of the most valuable safety nets a small or medium business can have, covering forensic investigation, business interruption, legal costs and more, often running into tens or hundreds of thousands of pounds per incident. What’s changed is that the policy is now only as good as the accuracy of what you told the insurer and the controls you actually have running day to day.
The good news is that every item on the checklist above is achievable for a 10-250 employee business without a dedicated security team most can be implemented or verified within a few weeks by your existing IT provider, and Cyber Essentials offers a structured, affordable route to proving it. The businesses getting caught out aren’t the ones with no security; they’re the ones who assumed "good enough" was good enough, and never checked.
If you’d like a second pair of eyes on your renewal questionnaire, or want us to run through this checklist against your current setup before your policy comes up for renewal, get in touch it’s a conversation worth having before an incident, not after.
Until next month, stay secure.