Every business that handles customer data, processes payments, or would struggle to operate for even a few days without its systems should carry a cyber insurance policy.
Cybercrime cost businesses $16.6 billion in 2024 alone, up 33% in a single year, and ransomware now shows up in 44% of all breaches. A policy won’t stop an attack. It’s the difference between a very bad week and a company-ending event.
This is not insurance or legal advice. Work with a licensed cyber insurance broker to find the right policy and coverage limits for your business. What follows is what we see consistently, from the technical side, in what underwriters require and what causes claims to get denied.
Why this stopped being optional
A growing number of clients, vendors, and contracts now require proof of cyber coverage before they’ll do business with you at all. Separately, the real costs of an incident, including legal fees, regulatory fines, breach notification requirements, business interruption, and potential ransom, can far exceed the cost of a policy. For most businesses, the math isn’t close.
What insurers actually require before they’ll write a policy
Underwriting has gotten noticeably stricter, and three controls have become effectively non-negotiable. Missing any one of them is one of the most common reasons carriers decline coverage outright, not just raise the price:
- MFA on email, remote access, and administrative accounts. Roughly 80% of insurers now require this as a baseline condition.
- EDR or MDR on all endpoints and servers. Around 65% of insurers specifically require this. Basic antivirus is no longer considered sufficient.
- Immutable, tested backups. Not just backups that exist, but backups an attacker can’t encrypt or delete, and that someone has actually verified can be restored.
Beyond those three, weaker controls in the following areas won’t necessarily get you declined, but they can lead to higher premiums and deductibles:
- Documented patch SLAs
- Email filtering
- Security awareness training
- A written incident response plan
- Privileged access controls
And on the other end, insurers are now offering real premium credits, typically in the 5–10% range, for businesses that can document stronger controls. These include phishing-resistant MFA specifically (not just any MFA), OT/IT network segmentation, 24/7 SOC monitoring, and tested tabletop exercises.
| Control | What it means |
|---|---|
| MFA | On email, remote access and admin accounts |
| EDR or MDR | On every endpoint and server, not just antivirus |
| Immutable backups | Backups attackers can’t touch, tested to restore |
The fine print that actually burns people
The riskiest part of cyber insurance isn’t the premium; it’s what happens on the application. Two real cases illustrate why:
- Travelers v. International Control Services (2022): the insurer rescinded the policy entirely after discovering the applicant had misrepresented its MFA coverage on the application.
- City of Hamilton: after a ransomware incident with an $18.3 million recovery bill, the claim was denied because MFA had only been partially deployed, not the full coverage the application had claimed.
The lesson is simple and worth repeating to whoever fills out your renewal questionnaire: never overstate your security posture to get a better rate. A denied claim after an incident is far worse than a higher premium before one, and insurers do verify.
What this actually costs
Premiums are projected to rise 15-20% in 2026, per S&P Global Ratings. For context, a typical small business $1 million policy runs roughly $45-$200 per month depending on industry and controls, and missing the basic controls above can add another 25-50% on top of that. Even at the higher end, that’s a fraction of the cost of a single serious incident.
Where this intersects with your IT environment
The uncomfortable truth about cyber insurance is that it’s no longer really about picking a plan. It’s about whether your actual environment would pass the underwriting questions honestly. That’s an IT conversation as much as an insurance one. We don’t sell policies, but we do build environments that are already aligned with what underwriters require, and we’ll sit down and go through your renewal questionnaire line by line, because a few overstated checkboxes today can cost you the entire payout exactly when you need it most.
If you’re not sure whether your current environment would actually hold up to an honest cyber insurance application, Book Your Free Assessment and we’ll walk through it with you.