Cyber insurance has quietly changed. A few years ago you could tick a box and get covered. Today, insurers ask detailed questions about your security controls, and if the answers on the application don't match reality when you make a claim, the insurer may reduce or, in some cases, refuse the claim, depending on the policy and the circumstances. Readiness reduces the chance of a mismatch between your application and your actual controls.
Why claims get refused
A common reason a claim is reduced or disputed is a mismatch between the application and the controls actually in place: the business said it had a control in place, and it didn't, or it lapsed. Typical examples:
- "We enforce MFA everywhere", but several admin accounts were exempt.
- "We have tested backups", but no restore had actually been tested.
- "We run endpoint protection", but it wasn't deployed on every machine.
These aren't lies; they are usually optimistic answers nobody verified. They tend to be tested after an incident, which is the worst possible time to find a gap.
Controls insurers commonly ask about
Requirements vary by insurer and policy, so check your own application and policy wording.
The questions vary by insurer, but the core controls are consistent, and they map closely to the Essential Eight:
| Control area | What insurers look for |
|---|---|
| Multi-factor authentication | Enforced on email, remote access, and admin accounts |
| Backups | Off-site, immutable, and restore-tested |
| Endpoint protection | EDR on every endpoint, monitored |
| Patching | Operating systems and applications kept current |
| Email security | Filtering, anti-phishing, and user awareness |
| Privileged access | Admin rights restricted and controlled |
| Incident response | A documented, tested plan |
Getting ready: before renewal
- Read the application as a checklist. Every question is a control you must be able to prove.
- Verify, don't assume. Confirm MFA coverage, test a restore, check EDR is on every device.
- Close the gaps. Many are configuration rather than new purchases.
- Document the evidence. Keep proof you can hand to an adjuster.
- Answer the application truthfully: now that the answers are actually true.
A well-evidenced control set can also help in premium and cover discussions with your broker.
How Umbrella Tech helps
We assess your environment against the controls insurers ask about, including MFA, backup and recovery, endpoint protection and incident response, then plan and implement the uplift with your team or existing provider. You receive evidence for the controls we assess, which you can use when answering the questionnaire, and a control set that makes the organisation harder to breach in the first place.
Book an assessment before your next renewal.
This article is general information, not insurance or legal advice. Talk to your broker about your policy.