Cyber insurance applications: the security questions that trip businesses up
Cyber insurance applications used to be a page of yes or no questions. Now they read like a security audit, and a wrong answer can matter twice: once when the premium is set, and again when a claim is investigated. If the application said you had multifactor authentication and the breach happened through an account without it, expect a hard conversation with the insurer.
These are the controls that come up on nearly every application.
Multifactor authentication
Insurers typically ask about MFA on email, remote access (VPN, remote desktop), and administrator accounts separately. "We have MFA" is not enough if it only covers some users. Check every account, including the shared ones and the owner's.
Endpoint detection and response (EDR)
Traditional antivirus is no longer the bar. Many carriers ask specifically for EDR, which watches for suspicious behavior rather than known virus signatures. Microsoft Defender for Business and several third party products qualify.
Backups
Expect questions about how often you back up, whether backups are kept offline or immutable (so ransomware cannot encrypt them too), and when you last tested a restore. An untested backup is a hope, not a plan.
Patching
Insurers want to know how quickly critical updates are applied and whether any unsupported systems remain. That old Windows PC running one piece of legacy software counts.
Email security and training
Phishing is the most common way in, so applications ask about email filtering and whether staff get regular security awareness training. Documented training, with dates, helps.
How to answer honestly
- Do not guess. If you are unsure, find out before you sign.
- If a control is partly in place, say so, and note the date it will be complete.
- Close the easy gaps before renewal. MFA and EDR are usually quick wins that can lower your premium.
- Keep evidence: screenshots, reports, training records. You may need them at claim time.
We help businesses review applications line by line and put the missing controls in place before the renewal date. See compliance readiness or start with a security assessment.