If your cyber insurance renewal is approaching, the application is probably longer and more detailed than the one you completed last time.
That change is intentional. Each new question generally corresponds to a security control that was missing in a major 2023 or 2024 cyber claim, allowing the incident and its financial impact to escalate.
The wording reflects how insurance carriers responded to the losses they paid during those years. As a result, how you answer the application matters more than it once did.
Why the renewal application got longer
The current generation of cyber insurance applications was shaped by three major claim events from 2023 and 2024.
The MOVEit supply-chain breach surfaced on May 28, 2023, when Progress Software received its first reports of unusual customer activity. The Cl0p ransomware group had been exploiting a previously unknown vulnerability in Progress Software’s MOVEit Transfer file-sharing platform, with some researchers detecting activity as early as February of that year.
By late 2023, more than 2,650 organizations and over 66 million individuals had been affected, with those totals continuing to rise into 2024. Insurance carriers paid claims across that broad footprint, and the experience changed how underwriters evaluate third-party software and supply-chain risk.
Then, in February 2024, the Change Healthcare ransomware incident disrupted healthcare claims processing across the United States for weeks.
The attacker gained access to the company’s network on February 12, 2024, and deployed ransomware on February 21. The disruption affected pharmacies, healthcare providers, and patients nationwide. Coverage from HIPAA Journal noted that the absence of multifactor authentication at a key entry point made the initial intrusion possible.
Industry analysts have estimated that cyber insurance losses from this single event exceeded $250 million. The insurance industry responded by asking more detailed questions about backup immutability, multifactor authentication, and incident response readiness.
The Arup deepfake wire fraud, also reported in early 2024, changed how underwriters approach social engineering risk.
A finance employee in the engineering firm’s Hong Kong office transferred $25.6 million through 15 separate wire transactions after participating in a video call with what appeared to be the company’s chief financial officer and other executives. The people on the call were AI-generated deepfakes.
The fraud was not discovered for approximately one week, when the employee contacted Arup headquarters about a “secret transaction.” Out-of-band callback verification for wire transfers has since become a standard item on many underwriting checklists.
If your organization operates an e-commerce store that handles cardholder information, a healthcare practice that stores protected health information, an accounting or law firm that transfers client funds, or a real estate brokerage that manages escrow, your application may be especially extensive.
Those industries fall within the loss categories where carriers experienced some of their most costly claims.
The backup question changed
The backup section of cyber insurance applications has become significantly more demanding since 2023.
What was once a single yes-or-no question now asks whether backups are immutable or air-gapped, when they were last tested, and whether someone using your domain administrator credentials could delete them.
You may see wording similar to:
“Are backups stored in an immutable or air-gapped state, tested for restoration within the past 12 months, and inaccessible to domain administrator credentials?”
An immutable backup cannot be deleted or altered during a defined retention period, even by someone using stolen administrator credentials.
An air-gapped backup is stored on infrastructure that cannot be reached from the organization’s production network.
CISA’s Stop Ransomware Guide identifies immutable, tested backups as a baseline security control. Most cyber insurance carriers now apply a similar standard.
Simply stating that your organization has a “Microsoft 365 backup” is no longer enough.
Native Microsoft 365 retention is not necessarily a backup in the way an insurance carrier defines it. A third-party backup platform may also be insufficient if it shares the same identity and administrator credentials as your production Microsoft 365 tenant. A compromised global administrator account could potentially delete both the live data and the backup.
The strongest response to the immutability question identifies a backup platform with object lock or write-once-read-many storage enabled, an immutability period of at least 14 days, with 30 days increasingly preferred, credentials that are separate from production administrator accounts, and documentation of a recent successful restore test.
A weaker answer might describe daily backups stored on a network-attached storage device connected to the same network, with no recent restoration test. That response will commonly trigger additional underwriting questions and may lead to a premium increase.
Unclear answers about backup immutability are among the most likely to result in ransomware sub-limits or policy non-renewal.
MFA questions go deeper than one checkbox
Multifactor authentication was once represented by a single yes-or-no question on most cyber insurance applications.
Current applications are more specific. They may ask whether MFA is enforced for email, virtual private network access, remote desktop access, all administrator accounts, and privileged service accounts.
For the strongest underwriting response, the answer should be yes in all five areas.
SMS-based MFA is also increasingly treated as a weaker security control. SIM-swap attacks and weaknesses within the cellular network have made text-message codes one of the least secure authentication methods available.
Some carriers now ask whether your MFA uses an authenticator application, a hardware security token, or push notifications with number matching instead of SMS.
If administrator accounts still rely on text-message codes, expect additional questions or a possible premium adjustment.
The privileged access management, or PAM, question is one many business owners have not encountered before.
PAM refers to a category of security tools designed to keep administrator credentials separate from ordinary password managers. A PAM platform stores privileged credentials in a secure vault, rotates them after use, and records administrator sessions.
This means a stolen administrator password is less likely to remain usable for weeks without detection.
A strong PAM response describes a credential-vaulting platform with password rotation and session logging enabled.
A weaker response might explain that administrator passwords are stored in a shared password manager and changed annually. That arrangement will often lead to additional underwriting questions.
Shared administrator accounts that never rotate and do not create an audit trail showing who used them are the most likely to result in coverage sub-limits or non-renewal.
Will cyber insurance automatically be denied if MFA is not enabled everywhere? Not necessarily.
However, organizations should expect significantly higher premiums, sub-limits on ransomware coverage, or exclusions for incidents that originate through an entry point where MFA was not enabled.
The wire transfer and deepfake verification questions
Following the Arup incident and a series of costly business email compromise claims, cyber insurance carriers added callback verification questions to their applications.
Callback verification requires the person authorizing a wire transfer above a defined threshold, commonly $10,000 or $25,000, to call the recipient using a phone number that was previously verified and stored.
The employee should not use a phone number supplied in the email or payment request being verified.
You may see wording similar to:
“Does your organization require out-of-band verification using a previously known phone number for all funds transfer requests above [threshold], including requests appearing to come from executives?”
Several current applications also ask whether employees have received training on AI voice cloning and deepfake video risks.
The Arup fraud made that question relevant to nearly every carrier underwriting professional services organizations.
Accounting firms, law firms with escrow or trust accounts, and real estate brokers should expect this section to receive especially close attention. Organizations that transfer other people’s money are attractive targets, and wire fraud claims can become costly very quickly.
A strong response references a written wire transfer policy requiring callback verification to a previously approved phone number for transfers above a defined threshold. It should also include dual approval and annual social engineering training that addresses deepfake risks.
An informal verification practice without a written policy will often be flagged for additional review.
Wire transfers that can be authorized through email approval alone are increasingly a risk that carriers may refuse to cover.
EDR, MDR, and the end of the “we have antivirus” answer
Traditional antivirus software scans files and compares them against a database of known threats.
Endpoint Detection and Response, or EDR, goes further by monitoring activity and behavior on each device. It can identify suspicious actions, such as a process attempting to encrypt large numbers of files or increase its system privileges.
Managed Detection and Response, or MDR, combines EDR technology with a security team that monitors alerts and responds around the clock, including at 2:00 a.m. on a Sunday.
Current cyber insurance applications may ask whether EDR is installed, whether it covers 100% of endpoints and servers, and whether a 24/7 security operations center monitors and responds to alerts.
The MDR question is increasingly treated as a direct yes-or-no control, and answering no can affect pricing and coverage.
If your organization does not currently have MDR but plans to implement it, state that clearly and include a specific timeline.
An underwriter can work with an answer such as, “MDR deployment is scheduled for the second quarter, and a vendor has been selected.”
Vague statements about plans to improve security at some point in the future are much less useful.
The vendor risk questions
Supply-chain risk was once addressed through a single yes-or-no question.
After the MOVEit and Change Healthcare incidents, carriers began requesting much more information about the software vendors that store, process, or access an organization’s sensitive data.
You may encounter questions such as:
“List your top five software vendors with access to sensitive data and confirm whether each provides a SOC 2 Type II report or equivalent.”
If your organization has never requested a SOC 2 report from its practice management, accounting, file-sharing, or cloud software provider, that conversation is overdue.
You are not necessarily expected to conduct a complete security audit of every vendor.
The carrier wants evidence that your organization knows which vendors present the most risk, understands what information they hold, and has asked basic due-diligence questions, including whether an independent security attestation is available.
An honest response such as, “We have identified our five highest-risk vendors and requested SOC 2 reports from each. Three have responded, and two remain outstanding,” is better than an overly confident answer that cannot be supported during a claim investigation.
The mistake to avoid: misrepresentation and rescission
The most expensive answer on a cyber insurance application may be the one that exaggerates the security controls your organization actually has in place.
Cyber insurance applications function as warranty documents. If a forensic investigation following a claim determines that your environment did not match what you declared, the insurance carrier may attempt to rescind the policy.
Rescission means the policy is treated as though it never existed. The claim may be denied, and previous payments made during the same policy period could potentially be recovered by the carrier.
Some courts have determined that the carrier does not need to prove a direct connection between the inaccurate answer and the incident. The material misrepresentation itself may be enough.
The safest approach is direct and honest.
If the application asks whether MFA is enabled on every administrator account and you know there is a gap, disclose the gap and provide a specific remediation date.
Carriers are generally better able to evaluate an honest deficiency with a documented correction plan than a polished answer that does not survive a forensic investigation.
Selecting “no” or “in progress” may raise the premium or result in more restrictive coverage terms. That cost is visible and predictable.
A misrepresentation discovered after a claim can void the policy entirely, leaving your organization responsible for the full cost of the incident.
The 30-day pre-renewal checklist
Complete these steps in order. Most are achievable within one month when the work begins promptly.
Week 1: Confirm that MFA is enabled for email, VPN access, remote desktop access, all administrator accounts, and any service accounts that support it. Move administrator MFA away from SMS and use an authenticator application or hardware security token instead.
Weeks 1 to 2: Verify that backups are immutable or air-gapped. Perform a test restoration and document the result with the date, notes, and screenshots.
Week 2: Create a one-page wire transfer policy requiring callback verification to a previously approved phone number for any transaction above your selected threshold. Have everyone who can authorize payments review and sign the policy.
Weeks 2 to 3: Confirm that EDR is installed on every workstation and server. If your organization currently relies only on traditional antivirus, request quotes for EDR or MDR so the application can include a specific deployment timeline.
Week 3: Identify your five most critical software vendors and request SOC 2 reports or equivalent security attestations. Document which vendors responded and which requests remain outstanding.
Weeks 3 to 4: Document or update the incident response plan. Conduct a 60-minute tabletop exercise with the leadership team and retain the meeting notes. Those records provide evidence that the plan has been tested within the previous 12 months.
Week 4: Review the cyber insurance application carefully and answer each question honestly. Clearly flag anything that could not be corrected before renewal and include a specific remediation date.
Article used with permission from The Technology Press.