Your broker emails sixty days before the policy expires. The questionnaire is longer than last year's, the questions are sharper, and this time the underwriter wants evidence, not checkboxes. For a growing business without a large internal security team, the cyber insurance renewal has become one of the most demanding compliance exercises of the year.
This guide explains what changed, what underwriters now check, why a casual "yes" can cost you a claim, and how a Cyber Secuirty Consultant you qualify on better terms.
Key takeaways
- Underwriters have moved from questionnaires to proof. A control you cannot evidence is treated as a control you do not have.
- Most carriers now treat MFA, endpoint detection and response (EDR), and tested backups as the entry ticket, not a premium discount.
- Inaccurate answers on a cyber insurance questionnaire can give an insurer grounds to deny a claim or rescind the policy.
- Starting 90 to 120 days before renewal gives you time to close gaps rather than explain them.
- The controls insurers demand are the same ones that prevent the incident in the first place, so the work pays twice.
Why the cyber insurance renewal got harder
Insurers price risk from claims, and the claims data of the last few years has not been kind. Coalition's 2026 Cyber Claims Report, built on more than 100,000 policyholders, found that initial ransom demands rose 47% year over year in 2025, and ransomware remained the most expensive claim type at an average loss of $269,000. Business email compromise and funds transfer fraud together made up 58% of all incidents, and 71% of funds transfer fraud claims came directly from social engineering.
Carriers responded the way any risk-bearing business would. They tightened cyber insurance underwriting, raised retentions, narrowed sublimits, and began asking for proof that controls are actually running. The renewal form you signed in 2023 described your intentions. The one you sign now describes facts you may be asked to prove after an incident.
Did you know? The same Coalition report found that 86% of businesses hit by ransomware refused to pay. The firms that can refuse are almost always the ones with clean, tested backups, which is exactly why underwriters ask about them first.
What cyber insurance requirements look like now
Carriers vary in wording, but cyber insurance requirements have converged on a recognisable baseline. The question is no longer whether you own a control. It is whether you can show it was enforced everywhere, on the day an attacker would have tried to get in.
Control | What the underwriter is really asking | Evidence to have ready |
|---|---|---|
Multi-factor authentication | Is MFA enforced on email, remote access, cloud apps and every admin account, with no quiet exceptions? | Identity provider enrollment report, conditional access policies, a documented exception list with compensating controls |
Endpoint detection and response | Is EDR on every laptop and server, and is someone watching the alerts? | Agent coverage report, monitoring or MDR agreement |
Backups | Are backups isolated from production credentials, immutable and restore-tested? | Backup architecture summary, dated restore test log |
Privileged access | Are admin rights limited, separated and logged? | Privileged account inventory, access review records |
Patching | Do you patch critical vulnerabilities on a defined cadence? | Patch policy, recent compliance report |
Incident response | Is there a written plan, and has leadership exercised it? | IR plan, tabletop exercise record |
Email security and training | Can staff recognise phishing and payment fraud, and is it tested? | Training completion and phishing simulation results |
Vendor access | How do third parties reach your systems, and who approves it? | Vendor inventory, access approvals, contract security terms |
If any of the first three are missing, many carriers will not quote at all. MFA for cyber insurance is the single most scrutinised control, and SMS codes on admin accounts are increasingly flagged as a remediation item rather than accepted.
The "yes" that can cost you the claim
The most dangerous part of a renewal is not the control you lack. It is the control you believe you have.
In 2022, Travelers asked a court to rescind the cyber policy of International Control Services after a ransomware attack. The application had stated that MFA protected the company's systems. In practice it protected the firewall and little else. The case settled with the policy rescinded, which meant no coverage for the incident at all.
The lesson for every executive signing a renewal is simple. Partial MFA does not earn partial credit. Your answers are representations the insurer relies on, and a well-intentioned "yes" given without checking can become the reason a cyber insurance claim is denied.
Common mistakes at renewal
- Answering from memory. The person filling in the form assumes MFA covers everything. Nobody pulls the enrollment report.
- Forgetting the exceptions. Service accounts, break-glass admin logins and legacy systems are where attackers look first, and where questionnaires now ask directly.
- Untested backups. A backup that has never been restored is a hope, not a control.
- A plan nobody has read. An incident response plan that leadership has never walked through will not survive the first hour of a real event.
- Starting two weeks out. By then the only options are to answer optimistically or accept worse terms.
- Leaving AI out of the picture. Staff using unapproved AI tools with company data is now a governance question underwriters are starting to raise, and some policies have begun adding generative AI exclusions.
How a cyber security consultant helps you qualify
A broker knows the insurance market. A cyber security consultant knows your environment and what the evidence behind each answer should look like. Good cyber security consulting services close the gap between the two, using a simple three-step approach.
1. Assess
The consultant maps last year's questionnaire, and the carrier's current one if available, against what is actually configured. That means reading the identity provider, the EDR console and the backup logs, not interviewing people about them. The output is a plain-language gap list ranked by underwriting weight, so leadership can see which gaps affect eligibility and which only affect price.
2. Secure
Gaps are closed in the order that matters to the underwriter: MFA exceptions, EDR coverage and backup isolation first, then privileged access, patching and vendor controls. Where a gap cannot be closed before renewal, the consultant documents compensating controls and a remediation date. Carriers respond very differently to a known gap with a plan than to one the applicant did not know existed.
3. Continuously Improve
The evidence pack is kept current through the year: quarterly restore tests, an annual tabletop exercise, refreshed enrollment reports. Next year's renewal becomes a review, not a scramble. Many consultants will also join the broker or underwriting call to answer technical questions directly, which removes the guesswork from your answers.
Expert insight: In my experience working with regulated mid-market businesses, the renewal is rarely blocked by a missing product. It is blocked by missing proof. The firms that renew smoothly are not the ones with the biggest security budget. They are the ones who can produce a report on request and explain every exception without hesitation. The insurer's requirements also become a useful budget argument: controls that sat in the backlog for years tend to get funded the moment they appear in a renewal letter.
A 90 day renewal readiness timeline
When | What to do |
|---|---|
90 to 120 days out | Request the current questionnaire from your broker. Run a control and evidence assessment. |
60 days out | Close eligibility gaps: MFA exceptions, EDR coverage, backup isolation and a restore test. |
45 days out | Assemble the evidence pack. Run or schedule a tabletop exercise. Document any compensating controls. |
30 days out | Review every answer against the evidence before signing. Brief your broker on improvements made this year. |
Renewal | Join the underwriting call with technical support available. Diarise next year's start date. |
Pro tip: Ask your broker which controls earn premium credits with your carrier, not just which ones are required. Phishing-resistant MFA, managed detection and response, and an exercised incident plan often move price as well as eligibility.
What it costs to wait
The cost of an unprepared renewal is rarely dramatic on the day. It shows up as higher cyber insurance premiums, a larger retention, a ransomware sublimit that is half what you need, or an exclusion buried in the wording. The real cost arrives later, if an incident exposes a gap between what the application said and what was true. A calm, documented renewal protects the policy you are paying for and gives your board a clear answer when they ask whether the company is covered.
Frequently asked questions
What do cyber insurers require for renewal in 2026?
Most carriers expect MFA on email, remote access and privileged accounts, EDR on every endpoint, isolated and restore-tested backups, a written incident response plan, security awareness training and controls on privileged and vendor access. Evidence of each is increasingly requested.
Why was my cyber insurance renewal premium increased?
Premiums reflect the carrier's view of your risk and the wider claims market. Missing or unproven controls, a recent claim, or exposure to ransomware and payment fraud can all raise price or retentions.
Can an insurer deny a claim because of an inaccurate application?
Yes. Questionnaire answers are representations the insurer relies on. If they prove inaccurate, the insurer may deny the claim or seek to rescind the policy, as in the International Control Services case.
When should I start preparing for a cyber insurance renewal?
Start 90 to 120 days before the renewal date. That leaves time to close gaps and gather evidence rather than explaining them to the underwriter.
Does SMS count as MFA for cyber insurance?
Some carriers still accept it for general users, but it is increasingly flagged for admin and remote access accounts. Authenticator apps or phishing-resistant methods are the safer choice.
Do I need a cyber security consultant if I already have an IT provider?
Not always, but the roles differ. An IT provider runs systems day to day. A consultant independently verifies controls, maps them to underwriting and regulatory requirements, and documents the evidence.
The bottom line
Cyber insurance is no longer a form you sign. It is a statement of fact about how your business is protected. Treat the cyber insurance renewal as an annual proof-of-control exercise, start early, and bring in support where your team lacks the time or expertise. The result is better terms, fewer surprises and a policy that pays when it matters.
If your renewal is within the next four months, a pre-renewal security review is the simplest place to start. Singular Security provides cyber security consulting services for regulated mid-market businesses, helping leadership teams assess, secure and continuously improve with confidence.
About the author: Aaron Coleman leads Singular Security, Inc., a cybersecurity and compliance advisory firm working with regulated businesses across healthcare, financial services, manufacturing and the public sector.
No comments:
Post a Comment