Cyber insurance applications used to be a few questions with a modest premium. After the ransomware years, insurers paid out heavily and the forms got much longer.
Today they ask pointed technical questions, and how you answer matters twice: once for whether you get covered and at what price, and again, far more seriously, if you ever file a claim.
The questions map what causes claims
Insurers see thousands of incidents a year, so their application is a free education. Every question is there because its absence has paid for someone's very bad month. These are the ones I see come up again and again:
- Is multi-factor authentication (a second login step beyond the password) enforced for email and remote access, including administrator accounts? This one leads because stolen passwords lead. Note the word enforced. Available is a different answer.
- Are backups kept separate from the network, and have restores been tested? Ransomware crews delete the backups they can reach first, and a backup nobody has restored is only a guess.
- How quickly do you apply security updates? Unpatched systems with known holes are one of the most common ways in.
- Do you run security training and phishing tests? The way in that isn't a password or a patch is a person.
- Does anyone verify a request to change payment details? Wire fraud through impersonated email causes losses that rival ransomware, one transfer at a time.
Read as a list of demands, the form is annoying. Read as a list of what actually goes wrong, ranked by cost, it's useful security advice that costs nothing.
Rounding mostly up to yes
Here's where I've watched businesses get hurt. The form asks whether MFA is enforced everywhere, and at a lot of companies the honest answer is mostly.
MFA is on for email, except two shared mailboxes and the owner's account, because the prompts annoyed him. The remote access the old vendor still uses has none. Under a deadline, mostly gets rounded up to yes.
If a claim ever comes, that rounding gets examined by people whose job is examining it. In my experience, insurers investigate incidents thoroughly. Where the way in was an exception the application said didn't exist, the business can find its claim contested or its policy rescinded, at the moment the money matters most. Our case study on the firewall that was never plugged in shows how easily an honest yes can be wrong.
The fix is unexciting. I'd make the answers true before you sign. Every question on the form describes a control worth having anyway, and closing the gap between mostly and yes protects you twice, once against the incident and once against the dispute after it.
Use the renewal as your deadline
Security projects drift without a date attached, and the renewal gives you one. I'd bring the application to your IT partner well before it's due. The good outcome is a form where every yes is documented and true, and a business that's harder to break into. It often brings a better premium too, because insurers price the controls they ask about.
We do this with clients as ordinary work. I sit down with the actual form, test each answer against the actual environment, fix what needs fixing, and hand over the evidence an insurer wants to see. It fits inside our cybersecurity services, and for businesses working through formal frameworks it connects to our compliance work, because the controls overlap heavily.
We're an IT company and not an insurance advisor, so what coverage you need, and from whom, is a conversation for your broker. What I make sure of is that the answers on the form are true, which is the part that decides whether the coverage is real.
If a renewal is on your calendar this year, schedule a call before it lands. The gap between mostly and yes closes far more cheaply on your schedule than on a claims adjuster's.