Not long ago, applying for cyber insurance took about ten minutes. A few yes-or-no questions, a premium quote, done. Then ransomware payouts wrecked the insurers’ math, and the application grew teeth. Today’s questionnaire reads less like an insurance form and more like an IT audit, because that is exactly what it is.
Here is the part that matters: how you answer those questions decides more than your premium. It decides whether the policy pays at all. Insurers now check claims against the answers on the application, and a wrong answer, even an honestly mistaken one, can void the whole policy. So let’s decode what the form is really asking, question by question, and what to do when your honest answer is “not yet.”
Why the Application Grew Teeth
Cyber insurance carriers spent years paying ransomware claims for companies with weak defenses, and they adjusted the only way insurers can: stricter underwriting. The questionnaire is the carrier’s way of measuring how likely you are to cost them money. Every question maps to a real attack pattern they have paid out on, thousands of times. Understand that, and the form stops being a bureaucratic annoyance and starts being something useful: a free list of the defenses that matter most, ranked by people who lose money when those defenses fail. It is much the same list we walked through in Why Cybersecurity Is No Longer Optional, this time with a price tag attached.
The Questionnaire, Decoded
The wording varies by carrier, but the same five questions show up on nearly every application. Here is what each one is really asking.
- “Is multi-factor authentication enforced?” Translation: when a password gets stolen, and one eventually will, does the thief still get in? Carriers want MFA on everything: email, remote access, VPN connections, and especially administrator accounts. “Mostly” is not a yes.
- “Do you have EDR on your endpoints?” Translation: is anything watching your computers for attack behavior, or just scanning for yesterday’s viruses? EDR, short for endpoint detection and response, spots suspicious activity and lets someone shut it down fast. Carriers increasingly expect it to be monitored around the clock.
- “Are backups tested and separated from your network?” Translation: when ransomware hits, can you recover without paying? Carriers want backups an attacker cannot reach and proof you have actually restored from them. Security firm Todyl reports that in a review of more than 10,000 policies, the backup question was answered incorrectly or incompletely 90 percent of the time. It is the question businesses get wrong most.
- “Do employees receive security awareness training?” Translation: most breaches start with a person, so is anyone teaching your people what phishing looks like? Short, regular training with simulated phishing emails is the standard.
- “Do you have a written incident response plan?” Translation: at 2 a.m. on the bad night, does anyone know who to call, what to unplug, and who is in charge? A plan in someone’s head does not count. Carriers want it written down, owned by someone, and rehearsed.
Longer applications go further: questions about email filtering, patching schedules, administrator account controls, end-of-life software, and log retention. The pattern holds, though. Every question is a control that has decided real claims. If a question confuses you, that is worth a conversation with your IT provider, not a guess.
Why Honest Answers Matter More Than Good Answers
Here is the counterintuitive advice: a truthful “no” on the application is safer than an optimistic “yes.” A no might raise your premium or narrow your coverage. A wrong yes can erase the policy entirely.
The case everyone in the industry cites is Travelers versus International Control Services. ICS, an Illinois manufacturer, said on its application that it used multi-factor authentication. After a May 2022 ransomware attack, the investigation found MFA protecting only a firewall, not the servers. Travelers went to court to rescind the policy, meaning cancel it as if it had never existed, and ICS ultimately consented. The company was left with a ransomware attack and no coverage, after paying its premiums.
Insurers call this material misrepresentation, and you do not have to lie on purpose to commit it. Signing an application filled out with guesses counts. Which leads to a rule we give every client: never answer a cyber insurance questionnaire from memory. Verify each answer with whoever runs your IT, in writing, before you sign.
Closing the Gaps Before Renewal
Treat the application as a to-do list, and give yourself 60 to 90 days before renewal.
- Answer everything honestly first. Do a dry run of the questionnaire with your IT provider and mark every no and every “sort of.” No judgment, just inventory.
- Close the MFA gaps. Usually the fastest win. Turning on MFA everywhere typically costs little or nothing and removes the most common misrepresentation risk.
- Deploy EDR where it is missing. Modern EDR is priced per computer per month and installs quickly. Pair it with monitoring so alerts reach a human at 2 a.m.
- Run a restore test and save the evidence. A dated, documented test restore turns your backup answer from a hope into a fact.
- Write the incident response plan. Even two pages of names, phone numbers, and first steps beats a blank stare. Then walk through it once as a team.
Do these five things and something pleasant happens: the application stops being scary. Some businesses even see premiums improve, because carriers price risk and you just lowered yours. And if the timeline is tight, tell your broker what is in progress. Carriers respond better to a dated remediation plan than to a shrug.
The Bottom Line
The cyber insurance application is not paperwork. It is a security audit with money attached, and it quietly defines the minimum standard for a defensible business: MFA everywhere, monitored endpoints, tested backups, trained people, and a written plan. Answer it honestly, fix what the honest answers expose, and you get two things for one effort: a policy that will actually pay when you need it, and a business that is less likely to need it at all.
We help Denton County businesses get application-ready: closing MFA and EDR gaps, running documented restore tests, and sitting with you while you fill out the questionnaire so every answer is true. If renewal is coming and some of your answers feel shaky, now is the time to fix that, not claim time. Contact us today.
Sources:
Comments are closed