If you have a cyber insurance renewal coming up, you may have noticed the application is longer and far more detailed than it used to be. That is intentional. Each new question is tied to a control that failed in real claims during 2023 and 2024. Carriers adjusted their underwriting based on those losses, and how you answer the application now carries more weight than before.
This guide breaks down why applications have expanded, what the newer sections are really asking, how to answer accurately without overstating your environment, and what you should focus on fixing in the 30 days leading up to submission. The biggest risk to avoid is rescission, where a claim is denied because the controls you certified were not actually in place at the time of the incident.
Why the application got longer
Recent applications were shaped by a few high impact events.
The MOVEit breach exposed weaknesses in third party software risk. Thousands of organizations were affected when attackers exploited a vulnerability in a widely used file transfer platform. Carriers paid across a large number of claims and now ask more detailed questions about vendor risk.
The Change Healthcare ransomware incident highlighted how a single point of failure can disrupt an entire ecosystem. The lack of MFA on a key access point contributed to the breach, and the scale of disruption led to much tighter questions around MFA, backup integrity, and incident response.
The Arup wire fraud case showed how convincing social engineering has become, especially with AI generated voices and video. That incident drove new requirements around payment verification and employee training.
If your business handles client funds, protected data, or financial transactions, expect more scrutiny. Those are the loss categories that drove these changes.
Backup requirements have tightened
Backup questions are no longer simple yes or no answers. Insurers now want to know if backups are immutable or air gapped, whether they have been tested, and whether they can be accessed or deleted using administrative credentials.
A strong answer demonstrates:
- Backups that cannot be altered or deleted during a defined retention window
- Separate authentication from your production environment
- A recent successful restore test
Basic backups stored on the same network without testing are a weak position and often trigger follow up questions or pricing changes.
MFA is now examined in detail
MFA is no longer a checkbox. Applications now ask if it is enforced across:
- VPN
- Remote access tools
- Administrative accounts
- Service accounts
All five need to be covered for a clean answer.
SMS based MFA is considered weak and may result in follow up questions. Stronger methods include authenticator apps or hardware based authentication.
Privileged access management is another area that now shows up. Insurers want to know how administrative credentials are stored, rotated, and monitored. Shared admin passwords without logging are one of the biggest red flags.
Wire transfer controls are now required
Following recent fraud cases, insurers now expect formal verification procedures for financial transactions.
This typically includes:
- Verifying transfer requests using a known phone number, not information in the request itself
- Requiring dual approval for larger transactions
- Training staff on social engineering risks, including deepfake scenarios
Informal processes are no longer sufficient. A documented policy is expected.
Endpoint security expectations have increased
Traditional antivirus is no longer enough for underwriting purposes.
Applications now ask:
- Whether endpoint detection and response is deployed
- Whether all systems are covered, including servers
- Whether alerts are actively monitored
Having monitoring in place is a major factor. If you do not currently have it, being clear about your plan and timeline is better than leaving the answer vague.
Vendor risk is now part of the application
Insurers want to understand which vendors hold your sensitive data and whether those vendors have been vetted.
You may be asked to list key vendors and confirm whether they provide security attestations such as SOC reports.
You are not expected to audit every vendor, but you are expected to know who they are and have started the conversation.
The biggest risk: misrepresentation
The most expensive mistake on a cyber insurance application is overstating your controls.
If an investigation shows that your environment did not match what you declared, the carrier can void the policy entirely. That means no coverage for the claim and potential recovery of previous payouts.
The right approach is simple:
- Answer truthfully
- Disclose gaps
- Provide a plan with a clear timeline
A higher premium is predictable. Losing coverage entirely is not.
30 day preparation checklist
Use this as a practical approach leading into renewal.
Week 1
Confirm MFA is in place across all required areas and upgrade authentication methods for admin accounts.
Weeks 1 to 2
Validate backups. Confirm immutability or separation and perform a test restore.
Week 2
Document a wire transfer policy with verification requirements and approval steps.
Weeks 2 to 3
Ensure endpoint protection covers all systems and confirm monitoring is active.
Week 3
Identify key vendors and request their security documentation.
Weeks 3 to 4
Review and update your incident response plan, then run a basic tabletop exercise.
Week 4
Complete the application honestly and document any remaining gaps with remediation dates.
FAQs
What does rescission mean
It means the insurer voids the policy entirely due to inaccurate information on the application.
Will lack of MFA lead to denial
Not always, but it can increase cost or limit coverage significantly.
What is the difference between endpoint monitoring and traditional antivirus
Traditional tools detect known threats. Modern tools monitor behavior and alert on suspicious activity, often with active response.
Why are applications more detailed now
They reflect real losses carriers paid and are designed to prevent those same failures from happening again.
What is an immutable backup
A backup that cannot be changed or deleted for a set period, even if administrative credentials are compromised.