4 min read

Your Cyber Insurance Application is an Audit. Answer it Like One.

Natalie : Oct 16, 2026, 12:48:54 PM

cyber security cyber threat detection cyber security provider compliance Cyber Insurance
Your Cyber Insurance Application is an Audit. Answer it Like One.

Someone at your company signs the cyber insurance application every year. Usually it's the CEO or the CFO. That signature states that the controls described on the form are in place today. The carrier prices the policy on that statement and relies on it again when a claim comes in.

Price isn't the problem right now. Marsh reports that U.S. cyber rates fell 2% in Q2 2026, and global cyber rates have now declined for twelve straight quarters. Marsh's index skews toward larger accounts, so a 120-person company's renewal won't track it exactly. However, the direction is clear. Carriers are competing for business.

The exposure is in the answers. A renewal questionnaire now reads like a control audit, and most of the questions ask how far a control reaches across your environment. If an answer on the form doesn't match what an investigator finds after an incident, the carrier can deny the claim or void the policy entirely. 

 

What The Questions Actually Ask

Carriers ask about the same core controls every year. What changed is the scope. Lockton, a large insurance broker, lists patching, isolated backups, unsupported software, email filtering, remote access, and admin privileges alongside MFA as controls that carry weight in applications. Each one has a gap between the answer people want to give and the answer that holds up. 

The Form Asks What an Honest "Yes" Requires Evidence to Keep on File
Is MFA enforced for remote access and admin accounts?

 Every admin, service desk, and vendor account, plus VPN, cloud consoles, and the backup system  

 Identity provider report showing enforcement by account, with exceptions listed. 
 Is EDR deployed on all endpoints? 
  

 Every laptop, workstation and server, including the shop-floor PC nobody logs into.   

  

 EDR console export matched against your asset inventory. 
 Are backups offline or immutable, and tested? 
  

 A copy ransomware can't reach, plus a dated restore test.  

 Backup configuration screenshot and the last restore test result.
 Are critical patches applied within a set window?   A written patch window and proof you meet it on internet-facing systems. 

 Patch compliance report for the last 90 days. 
 Do you have an incident response plan?   A current plan with names, phone numbers, and your carrier's hotline. 

 The plan and the date of the last tabletop exercise. 

 

The carriers' interest is backed by their own data. Marsh McLennan's Cyber Risk Intelligence Center found that each 25% increase in EDR coverage across workstations and laptops correlated with a further 10% drop in breach likelihood. Phishing-resistant MFA correlated with a 9% lower breach likelihood than other MFA. Marsh's client base skews toward larger organizations. However, the takeaway applies at any size. Partial deployment earns partial credit, and underwriters know it. 

 

A Wrong Answer Can Void The Whole Policy

The case brokers still cite involves a manufacturer. In 2022, Travelers sued International Control Services, an electronics manufacturer in Decatur, Illinois, after a ransomware attack. Travelers alleged the application was signed by the CEO and the person responsible for network security and stated that MFA protected administrative access. It's investigation found MFA protected the firewall and nothing else. The server hit in the attack had none.

ICS agreed to rescission within weeks. The court declared the policy void from its inception. That's a worse outcome than a denied claim. A rescinded policy doesn't exist, so nothing under it responds.

Two points from Lockton's analysis matter to anyone who signs these forms. Rescission is generally available whether the misstatement was intentional or not. The false answer also has to be material to the risk the carrier took on, not to the specific claim. A missing MFA exception on a vendor account can sink a claim that started with a phishing email. 

The broader claims data calls for some care. The NAIC reports that U.S. insurers closed 28,555 cyber claims without payment in 2024 and 9,941 with payment. Unpaid claims include notices that never became a covered loss and losses that stayed under the retention, and the NAIC doesn't break out denials. However, the ratio shows how often a claim ends without a check. A bad application answer is one route that you control. 

 

What it Costs a $25M Manufacturer

Our example company has $25 million in revenue, 120 employees, and 250 operating days. For this example, assume a $1 million cyber policy with a $25,000 retention and a $100,00 sublimit for funds transfer fraud. The policy terms are illustrative assumptions, not a quote or a benchmark. 

Event Accurate Application Application Misstates MFA Scope
 Five-day ransomware outage ($457,360 in lost revenue and idle payroll, assumption from #2) 

 Company pays the $25,000 retention. The policy responds up to $1M, subject to its business interruption terms and waiting period. 

 Company pays the full $457,360, plus incident response and recovery labor at $250/hr (assumption).  
 Funds transfer fraud at Coalition's 2025 average of $141,000
  

 Policy pays up to the $100,000 sublimit. Company absorbs the $41,000 above it.  

  

 Company pays the full $141,000 

The fraud row matters as much as the ransomware row. Coalition reports that business email compromise and funds transfer fraud made up 58% of its 2025 claims, with an average funds transfer fraud loss of $141,000. Its average ransomware loss was $269,000. Coalition's book spans more than 100,000 policyholders across five countries. It also found that businesses above $100 million in revenue file claims five times as often as smaller ones, so a $25 million company should expect fewer claims than those averages suggest.

The soft market helps here. Marsh says carriers are competing on broader coverage and lower deductibles as well as price. This is a good renewal to ask for a higher fraud sublimit. However, that negotiation only pays off if the answers underneath it hold up. 

 

Treat The Renewal Like a Close

Finance already knows how to do this. You don't sign a financial statement without support for each number. The application deserves the same process.

Start 90 days before the renewal date. That leaves time to fix a gap before you have to disclose it. Give the signature to finance and the evidence to IT or your MSP. The person who signs shouldn't also be the only person who checks.

Build an evidence file with one entry per question. Each entry should hold the answer, the scope it covers, the report or screenshot behind it, and the date it was pulled. When the honest answer is "mostly," write the exception into the application. A disclosed gap is a pricing conversation. An undisclosed one is a coverage defense. 

 

Get The Checklist

We built a Cyber Insurance Application Readiness Checklist that follows the process above. For each question carriers commonly ask, it shows what a defensible "yes" requires and the evidence to keep on file. It also includes a 90-day renewal timeline and a sign-off page for finance and IT. 

 If you'd like a second set of eyes on your answers before you sign, talk to our team.

 

sources: