Cyber insurance has moved from a nice-to-have to something clients, landlords and lenders increasingly expect a business to hold. What's changed alongside it is the underwriting: insurers have grown far more specific about what security controls they expect to be in place, and far more willing to scrutinise those controls closely when a claim is actually made. A policy bought based on optimistic answers on an application form is not the same thing as a policy that will actually pay out.
Why Claims Get Refused
The most common reason a cyber insurance claim is refused isn't fraud or a technicality buried in the small print — it's a genuine mismatch between what the business told the insurer during underwriting and what was actually configured at the time of the incident. A business that confirmed MFA was enforced across the organisation, but where it was actually only switched on for some accounts, has misrepresented its risk — and insurers increasingly investigate exactly this during claims, not just at renewal.
Underwriting is no longer a formality: Cyber insurance applications used to be a fairly light-touch questionnaire. Increasingly, insurers require evidence — screenshots, configuration exports, or third-party security assessments — rather than simply taking a business's word for it, particularly for larger policies.
What Insurers Consistently Check For
- Multi-factor authentication, specifically on email, remote access and administrative accounts — now close to a baseline requirement rather than a nice-to-have. See our guide to MFA for what proper coverage actually looks like.
- Backup practices, including whether backups are isolated from the main network (so ransomware can't encrypt them too) and whether restores are actually tested.
- Patch management and how quickly critical vulnerabilities are addressed once identified.
- Endpoint protection — modern threat detection rather than basic antivirus, on every device with access to business systems.
- Email filtering and anti-phishing controls, given how many incidents still originate from a phishing email.
- An incident response plan — not necessarily an elaborate document, but evidence that the business has thought through what happens in the first hours of an incident.
- Staff security awareness training, particularly given how much fraud now involves social engineering rather than pure technical exploitation.
The Cyber Essentials Connection
Many insurers now offer preferential premiums, simplified applications, or both to businesses holding Cyber Essentials certification, because the certification independently verifies several of the exact controls insurers care about most. It isn't a substitute for a full policy review, but it does mean the certification process and the insurance underwriting process are increasingly pulling in the same direction rather than being separate exercises.
Application Honesty Is Non-Negotiable
The temptation when filling out an underwriting questionnaire is to answer optimistically — "yes" to a control that's mostly in place, or technically in place for some but not all systems. This is the single riskiest thing a business can do with a cyber insurance application. An overstated answer doesn't just risk a specific claim being refused; in some cases it can void the policy entirely, on the basis that the risk presented to the insurer wasn't accurate.
The safer approach is to answer honestly, even where that means a higher premium or a requirement to fix specific gaps before cover is confirmed. A policy that accurately reflects your actual security posture is worth more than a cheaper one built on answers that wouldn't survive a claims investigation.
Getting Ready Before You Apply or Renew
- Audit your actual configuration against what you'd claim on an application — not what was true when it was first set up, but what's genuinely in place today.
- Fix known gaps before applying rather than answering around them; a slightly delayed application with accurate answers beats a fast one with optimistic ones.
- Keep evidence — configuration exports, policy documents, training records — so that if a claim is investigated, the business can demonstrate the controls were genuinely in place, not just described as such.
- Review annually, since both your environment and insurer expectations change year to year, and a policy that was accurate at signing can drift out of alignment with reality over time.
Questions worth asking before your next renewal: Would every control we've claimed on our application survive an insurer actually checking it? Do we have evidence — not just a memory — that backups, MFA and endpoint protection are configured the way we've said? Has anything material changed in our environment since we last answered these questions?
The Bottom Line
A cyber insurance policy is only as good as the accuracy of what it's based on. The businesses that get real value from cover are the ones whose actual security posture matches what they told the insurer — not because insurers are looking for reasons to refuse claims, but because a mismatch between the two is, quite reasonably, exactly what a claims investigation is designed to catch.