What Your Cyber Insurance Carrier Is About to Ask You (And Why You Should Care)

Cyber insurance used to be simple. Fill out a questionnaire, pay a premium, get a policy. The questions were surface-level. The underwriting was loose. If you had an antivirus and a firewall, you were good.

That era is over.

After several years of massive payouts — ransomware attacks, data breaches, business interruption claims — cyber insurers have fundamentally changed how they underwrite policies. Premiums have gone up. Coverage terms have gotten stricter. And the application process now looks a lot more like a security audit than a formality.

For startups and growth-stage companies, this shift matters because cyber insurance is increasingly a business requirement. Enterprise customers ask if you have it. Investors want to see it. Board members expect it. And the carriers that issue it are now setting a minimum security bar that you have to clear.

Here's what I'm seeing on current cyber insurance applications and renewal questionnaires:

MFA. This is non-negotiable for almost every carrier. Do you have MFA enabled for email, VPN, remote access, and admin accounts? If the answer is no to any of these, expect either a denial or a significantly higher premium. Some carriers won't even quote without an MFA.

Endpoint detection and response. Having antivirus isn't enough anymore. Carriers want to see EDR — a solution that can detect, investigate, and respond to threats on your endpoints in real time. Products like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint.

Email security. Beyond basic spam filtering. Carriers are asking about email authentication (DMARC, DKIM, SPF), phishing protection, and whether you have controls to prevent business email compromise.

Backup and recovery. Do you have backups? Are they tested? Are they air-gapped or immutable (meaning an attacker who gets into your network can't also encrypt or delete your backups)? This is a direct response to ransomware attacks where companies paid ransoms because their backups were also compromised.

Patch management. How quickly do you patch critical vulnerabilities? What's your process? Carriers are looking for evidence that you can respond to new threats promptly, not on a 90-day cycle.

Incident response plan. Do you have one? Has it been tested? Do you have a retainer with a forensics firm? Carriers want to know that if something happens, you have a plan and the resources to execute it.

Employee training. Are your employees trained on phishing, social engineering, and security awareness? How often? Carriers view untrained employees as a risk factor.

Privileged access management. Who has admin access to your critical systems? How is that access managed, reviewed, and rotated? Over-privileged accounts are a common attack vector, and carriers know it.

Here's the thing about cyber insurance requirements: they're not arbitrary. The controls carriers are asking about are the same controls that actually prevent breaches. MFA, EDR, patching, backups, incident response — this is the core security program that every company should have.

If you're implementing controls specifically to qualify for cyber insurance, you're doing security backwards. But the outcome is the same. And for companies that haven't invested in security because there was no forcing function, the insurance application is becoming exactly that.

Premiums vary widely based on industry, company size, revenue, data sensitivity, and — increasingly — your security posture. But here's the general pattern:

Companies with strong security programs — MFA everywhere, EDR deployed, tested incident response plans, current patching — are getting competitive premiums and favorable coverage terms.

Companies with gaps — no MFA on some systems, no EDR, untested backups, stale incident response plans — are facing premium increases of 30-100% or coverage exclusions that make the policy significantly less useful.

Companies with significant gaps — no MFA, no EDR, no incident response plan — are being denied coverage entirely. And a denial on your record makes future applications harder.

Review your current policy. Do you actually know what's covered and what's excluded? Many policies have sublimits for ransomware, carve-outs for certain attack types, and waiting periods for business interruption claims. Read the fine print.

Prepare for your renewal. If your renewal is coming up, start preparing now. Review the likely questionnaire topics above and identify any gaps. Fix them before the renewal application, not after.

Use the application as a security checklist. The controls your carrier is asking about are the controls you should have. If you're failing the insurance questionnaire, you're also failing at basic security.

Get help if you need it. If you're not sure whether your security program meets current insurance requirements, get an assessment. It's cheaper than a denied claim.