Cyber Insurance: Getting Covered Without Getting Burned

Your cyber insurance policy is not a security control. It is a contract, packed with conditions most buyers never read, backed by attestations someone in your company signed without checking. When the breach comes, the gap between what you told the underwriter and what your infrastructure actually does decides whether the claim pays or dies in dispute.

Why underwriters stopped trusting questionnaires

The ransomware wave that started around 2019 wrecked the economics of cyber insurance. Loss ratios blew past sustainable levels, carriers exited the market, and the survivors changed the rules. Premiums climbed, capacity shrank, and the application process went from a checkbox exercise to something closer to a technical audit.

Two things changed structurally:

• Outside-in scanning became standard. Most carriers now scan your public attack surface before quoting: open ports, exposed remote access, TLS hygiene, email authentication records, leaked credentials in breach dumps. Some, notably the insurtech carriers, rescan continuously through the policy period and can adjust terms at renewal based on drift.
• Questionnaires got legal teeth. Depending on the jurisdiction and the policy language, your answers can be treated as warranties rather than representations. A false warranty can void the policy from inception. Insurers have gone to court to rescind policies over MFA attestations that turned out to be aspirational rather than accurate. Some won.

Treat the application like a deposition. Every yes needs evidence behind it. Every "partially" needs a footnote.

The attestation trap

The most dangerous question on a cyber application looks harmless: "Do you enforce multi-factor authentication for all remote access to your network?"

Most teams answer yes. Most teams are wrong. The failure modes we see repeatedly:

• A VPN with MFA, plus a forgotten SSH bastion without it.
• MFA enforced at the identity provider, but legacy authentication protocols (IMAP, POP3, SMTP AUTH) still enabled, which bypass conditional access entirely.
• Break-glass admin accounts excluded from MFA policies and never reviewed.
• Service accounts with static credentials and broad network access that no MFA policy touches.
• A subsidiary or acquired company running its own directory that nobody mapped during the application.

Any one of these can turn a yes into a misrepresentation. The fix is not creative wording. The fix is closing the gaps before you sign, then wording the answer precisely: what is covered, what is excluded, what the compensating control is. Underwriters respond better to "yes, with two documented exceptions and remediation dates" than to a clean yes they later disprove during a claim investigation.

If your admins still approve push notifications, note that many carriers now ask specifically about phishing-resistant methods. Moving privileged users to hardware-backed passkeys is one of the cheapest underwriting wins available, and we covered the mechanics in our passkeys guide.

See what the scanner sees, first

Before any application goes out, run the same reconnaissance the carrier will:

# External surface: the ports underwriters flag hardest
nmap -Pn -p 3389,445,22,23,1433,3306,5432,9200,27017 203.0.113.10

# Email authentication: missing DMARC is a standard ding
dig TXT _dmarc.example.com +short
dig TXT example.com +short | grep spf

Exposed RDP on 3389 is the fastest route to a declined quote or a ransomware exclusion. Exposed database ports and Elasticsearch on 9200 are close behind. A missing DMARC record, or one stuck at p=none, signals weak email controls, and that maps directly to how your funds transfer fraud coverage gets priced.

Also check the breach corpuses. Carriers query leaked credential databases against your domains. If hundreds of employee credentials are floating around from old third-party breaches, force resets now and be ready to explain your rotation policy in the application notes.

The controls that actually move premiums

Not all controls are priced equally. In our experience, four dominate underwriting outcomes.

EDR with real coverage

Underwriters ask which endpoint detection product you run. The better ones ask about deployment percentage and tamper protection. An EDR agent on 60 percent of endpoints is a talking point, not a control. Target coverage above 95 percent, reconciled against a real asset inventory, with tamper protection enabled and alerts routed somewhere a human actually watches, whether that is an internal team or an MDR provider.

Backups an adjuster will believe

Ransomware claims live or die on backups. The questions have evolved from "do you back up" to "are backups immutable, offline or logically air-gapped, and when did you last test a full restore." Immutability is now table stakes:

resource "aws_s3_bucket_object_lock_configuration" "backups" {
  bucket = aws_s3_bucket.backups.id
  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 35
    }
  }
}

Compliance mode matters here: nobody, including your own root account, can shorten the retention window. That is exactly the property that stops a ransomware operator holding stolen admin credentials from deleting your recovery path before detonating. Document restore tests with timestamps and durations. If you have never restored at scale, fix that before it becomes an adjuster's favorite question. Our guide on backups you can actually restore goes deeper on immutability tiers and restore testing.

Privileged access hygiene

Local admin rights stripped from daily-driver accounts. Separate admin identities, or a proper PAM tool. Domain admin membership in single digits and reviewed quarterly. Session recording for the highest tiers if you can get it. These items appear on every serious application, and they are also the controls that most reduce actual blast radius, so the premium discount is a side effect of genuine risk reduction.

Logging you can hand to forensics

A claim triggers a forensic investigation, and the investigation is only as good as your logs. Ninety days hot and one year cold is a reasonable baseline for identity, endpoint, VPN, and cloud control-plane logs. Centralize them, protect them from the same credentials an attacker would steal, and verify clock synchronization across sources. An investigation that cannot establish a timeline drags on for months, and business interruption payouts often hinge on exactly that timeline.

Read the policy like an engineer

The number on the declarations page is marketing. The real coverage lives in sublimits, exclusions, and conditions.

• Sublimits. A policy with a headline limit of 2 million can carry a ransomware sublimit of 500k and a social engineering sublimit of 100k. Funds transfer fraud, the most common loss for small and mid-sized companies, is frequently the smallest sublimit on the page.
• Waiting periods. Business interruption coverage typically starts after a waiting period measured in hours, often somewhere between 8 and 12. An outage shorter than the waiting period pays nothing, regardless of what it cost you.
• The failure-to-maintain exclusion. Some policies exclude losses arising from failure to maintain the security controls described in your application. This quietly converts your questionnaire into a continuing obligation. If you attested to patching critical vulnerabilities within 30 days and drifted to 90, that exclusion is live.
• War and state-sponsored exclusions. After years of litigation over destructive attacks attributed to state actors, exclusion wording has been rewritten across the market. Read the attribution language carefully: who decides an attack was state-sponsored, and on what evidence standard?
• Consent provisions. Most policies require insurer consent before you incur response costs, hire vendors, or pay a ransom. Spending first and asking later is a classic self-inflicted denial.
• Panel requirements. Carriers maintain panels of approved forensics firms, breach counsel, and ransom negotiators. If you want your own team on the incident, negotiate them onto the policy at binding, not at 2 a.m. during the incident.

Wire the policy into your incident response

A policy PDF that lives in the CFO's inbox will fail you under pressure. The insurance workflow belongs inside your incident response runbook, not adjacent to it:

• The carrier's 24/7 hotline number and your policy number on the first page of the runbook.
• Notification deadlines mapped and assigned: many policies require notice within days of discovery, and late notice is a real, recurring denial ground.
• A hard rule against wiping or reimaging compromised machines before forensics approves. Destroying evidence can sink both the investigation and the claim.
• Ransom decisions routed through breach counsel with sanctions screening. Paying a sanctioned entity is a legal problem no policy will cover, and the check must happen before negotiation, not after.

If your runbook does not exist in a form you would actually follow at 2 a.m., start with our incident response playbook and adapt it. Then run a tabletop that includes the claim process itself: who calls the hotline, who talks to the adjuster, who preserves the evidence the claim will need.

A 90 day readiness plan

1. Week 1: inventory your attestation surface. Pull last year's application, or a sample from a broker, and audit every answer against reality. Log every gap in a tracker with an owner.
2. Weeks 2 to 3: scan yourself. External attack surface, email authentication, leaked credentials. Close exposed remote access before anything else.
3. Weeks 3 to 6: kill the MFA exceptions. Disable legacy authentication protocols, cover bastions and VPNs, review break-glass accounts, move admins to phishing-resistant factors.
4. Weeks 4 to 8: harden backups. Enable immutability, separate backup credentials from domain credentials, run a full restore test, and write down how long it took.
5. Weeks 6 to 8: verify EDR coverage. Reconcile agent counts against the asset inventory, enable tamper protection, confirm alert routing to a watched queue.
6. Weeks 8 to 10: fix logging retention. Centralize identity, endpoint, and cloud logs. Set retention. Verify time sync across every source.
7. Weeks 10 to 12: integrate the policy into IR. Hotline in the runbook, deadlines mapped, panel vendors reviewed, tabletop executed with the claim workflow included.
8. Week 12: answer the application with evidence. Attach precision to every yes. Disclose exceptions with remediation dates instead of rounding up to compliance.

Teams that walk into underwriting with this package routinely see better pricing, higher sublimits, and fewer bolted-on exclusions. Teams that walk in cold get the standard form and carry the standard rescission risk.

How much coverage do you need?

There is no universal number, but the inputs are knowable:

• Interruption exposure: daily revenue at risk multiplied by a realistic recovery window. If your restore test took four days, model four days, not the four hours in the slide deck.
• Records exposure: notification, credit monitoring, and legal costs scale with the number of individuals affected, and regulated data (health, financial) multiplies the per-record cost.
• Ransom exposure: demands, in our experience, scale with perceived revenue, and negotiated settlements usually land well below the opening number. The forensics, rebuild, and downtime costs around the ransom often exceed the ransom itself, so do not size the limit on the demand alone.
• Retention tolerance: a higher retention (your deductible) cuts premium meaningfully. If your balance sheet can absorb 50k without flinching, do not pay the carrier to insure the first 50k.

Run the numbers annually. Your revenue, your data footprint, and the threat landscape all move, and a limit that fit two years ago is probably wrong today.

How Innovation T can help

Insurance readiness is security engineering with a deadline. Innovation T designs and implements the controls underwriters actually price: phishing-resistant authentication, EDR rollout, immutable backup architecture, centralized logging, and incident response programs that hold up under a real claim. We work across cloud and on-premise estates, and we document everything so your attestations are evidence-backed rather than hopeful. Explore our services.

If a renewal is coming or a first policy is on the table, we can run a full gap assessment against the application before you sign it. Talk to us and we will tell you exactly where a claim would break today.