What Your Cyber Insurance Application Is Really Asking

A few years ago, buying cyber insurance took about ten minutes. Revenue, industry, do you take credit cards, sign here.

The application you are holding now is six pages of technical questions, and it does not read like a marketing form. It reads like an audit. That is not an accident, and it is not the broker being difficult.

Here is what changed, what each question is actually driving at, and the part almost nobody explains until it matters: the application is not a survey. It is a set of statements you are making, in writing, that your carrier can hold you to later.

Why the form got hard

Carriers spent several years losing money on cyber. Ransomware claims came in faster and larger than the pricing assumed, and the industry’s response was not just to raise premiums. It was to stop insuring businesses that had not done the basics.

So the application became the underwriting. Rather than assessing you on industry and revenue, carriers now assess you on specific controls, and certain answers will end the conversation before a premium is ever quoted.

The practical effect for a small business is that the form is no longer paperwork to get through. It is a scored test, and you can study for it.

What they are actually asking

Each question maps to a loss pattern the carrier has paid out on. Once you see the pattern behind the question, the question stops being arbitrary.

Multi-factor authentication, and the word “all”

This is the first question and the one that causes the most trouble, because of a detail in how it is worded.

Applications rarely ask “do you use MFA.” They ask whether MFA is enforced on email, on remote access, on cloud administration consoles, and on privileged accounts. Some now ask separately about service accounts and about access to your backups.

The trap is scope. A business that turned on MFA for Microsoft 365 will read that question and think yes. But if the VPN still accepts a password alone, or the domain admin account is exempt, or there is a legacy server reachable from the internet that nobody included, then the honest answer is not yes. It is “yes for these systems, no for those.”

That distinction is not pedantic. It is the single most litigated detail in cyber insurance, and there is a case below that shows exactly why.

Endpoint detection and response

Carriers want EDR or MDR on endpoints and servers, with someone actually watching the alerts.

Traditional antivirus does not satisfy this. The question exists because the loss data shows attackers landing on a machine, moving quietly for days, and then triggering encryption everywhere at once. Antivirus catches known bad files. EDR catches the behaviour in between, which is where the response window lives.

The coverage question matters as much as the product question. One unmanaged laptop or one server excluded from the rollout undermines the answer, because that is where an attacker will be.

Backups, and whether you have ever restored one

Expect three separate questions here, and treat them as three:

Are backups kept offline, immutable, or otherwise out of reach of an attacker who gains domain admin?
How often do they run?
When did you last perform a test restore, and what was the result?

The third one is where most small businesses are genuinely exposed. Modern ransomware operators look for the backup server first and encrypt or delete it before touching anything else. A backup sitting on the same network with the same credentials is not a recovery plan, it is a second copy of the problem.

“We back up nightly” is not an answer to the question being asked. “We back up nightly, one copy is immutable and off-network, and we last restored a server on a date I can show you” is.

Remote access

Expect direct questions about whether Remote Desktop is exposed to the internet, how remote workers connect, and whether remote access requires MFA.

Internet-facing RDP is close to an automatic decline with many carriers. It has been a leading ransomware entry point for years and it is trivially scannable, so a carrier treats it as a decision you made rather than bad luck.

Patching and end-of-life software

Two things get asked: how quickly you apply critical patches, and whether you are still running anything the vendor no longer supports.

The second one catches people. An unsupported server humming along in a closet, a line-of-business application that only runs on an old operating system, a firewall past its support date. These are common in small businesses for understandable reasons, usually cost, and they are exactly what the question is looking for.

Privileged access

Do users run as local administrators on their own machines? Do your administrators have separate accounts for admin work and for email? Who can reach what?

The logic is containment. If a user who clicks something is also a local admin, the attacker inherits those rights immediately. Separating those accounts is unglamorous and it meaningfully changes what a single mistake costs.

Email security and training

Filtering, and recurring security awareness training with simulated phishing, with completion records you can produce.

The reason this rates so heavily is visible in the claims data. In Coalition’s 2026 cyber claims report, business email compromise and funds transfer fraud together accounted for 58% of cyber incidents. Ransomware was costlier per event, averaging $269,000, but email fraud is what happens most.

The wire transfer question

Somewhere on the form there will be a question about how you verify changes to payment details or requests to move money.

Do not skim past it. Of all the controls on the application, this one has the best ratio of effort to loss avoided for a small business, and it costs nothing to implement.

The control is a callback rule: any request to change bank details, or any payment above a threshold you set, gets verified by phone using a number already on file, never a number in the email. That single habit defeats the most common cyber claim there is, and voice cloning has made “I recognised who was speaking” unreliable as a substitute.

Incident response plan

Do you have a written plan, does it name who does what, and have you tested it?

The underwriter is asking whether the first two hours of your worst day will be organised or improvised. If you have never written down who calls the insurer, who calls the lawyer, who decides to disconnect, then the honest answer is no, and no is survivable. A plan is a weekend of work, not a project.

Segmentation

Is your network flat? Can a compromised front-desk PC reach the server, the backup and the point-of-sale system without crossing a boundary?

This one often earns a premium credit rather than gating coverage, and it matters more the more operational technology you run. For a manufacturer, separating the office network from the shop floor is one of the highest-value projects available.

The part that bites

Now the part that is genuinely worth your attention, and the reason to slow down on the form.

In most policies, your application answers become part of the contract. They are not context. They are representations the carrier relied on to decide whether to insure you and at what price. If a material answer turns out to be wrong, the carrier may be able to rescind the policy, which means treating it as though it never existed, rather than simply denying one claim.

This is not hypothetical. In 2022, Travelers sued a policyholder, International Control Services, seeking to rescind a cyber policy after a ransomware attack. The application had represented that MFA was in use. Travelers alleged that MFA was in fact protecting only the firewall and not the other systems, including the server involved. The case did not run to a verdict on the merits. ICS agreed to the rescission and the matter was dismissed, which meant the policy was undone after a loss had already occurred.

Read that outcome carefully. The business had paid premiums, suffered a ransomware attack, and ended up with no policy at all.

The lesson is not that insurers are looking for ways out. It is that an answer given quickly, by someone who assumed MFA was on everywhere because it was on for email, can be worth more than the premium it saved.

What to do when the honest answer is “partly”

This is the practical question, because for most small businesses the truthful answer to several questions is somewhere in the middle.

Do not round up. The instinct is to read “MFA on all remote access” and think about the ninety percent that is covered. Answer for the ten percent that is not.

Write the qualification down. Most applications have space for clarification, and a broker can attach detail. “MFA is enforced on Microsoft 365 and VPN. Two legacy application accounts are excluded, with remediation scheduled.” An underwriter can price that. What an underwriter cannot do is un-ring the bell after a loss.

Fix what you can before you sign, not after. Some of these are quick. MFA on the remaining accounts, closing exposed RDP in favour of a VPN, removing local admin rights, setting up the callback rule for payments. Those are days of work, not quarters, and each one converts a qualified answer into a clean yes.

Let the person who knows the systems answer the systems questions. These forms are frequently completed by an owner or an office manager reading terms they have not been given a way to verify. If someone else runs your IT, the technical answers should come from them in writing, so the answer is a checked fact rather than an assumption.

Keep the evidence. Underwriters increasingly want proof that a control was actually in force, not that a product was purchased. Screenshots of MFA enforcement policies, the EDR console showing full coverage, a dated restore test, training completion records. Put them in one folder. You will want them again at renewal, and you will very much want them at claim time.

Before you fill out the next one

Three steps, in order.

Read the whole form before answering anything. It tells you what your carrier considers table stakes this year, which is useful information whether or not you buy the policy. Treat it as a free gap assessment.

Mark every question you cannot answer with certainty. Not the ones you answer no, the ones where you are not sure. That list is your actual risk register, and it is usually shorter than people fear.

Close what you can, disclose the rest. A qualified yes priced accurately is worth far more than a clean yes that unravels.

The honest summary

The application is not an obstacle between you and a policy. It is the clearest statement available of what a business your size is expected to have in place, written by the people who pay when it goes wrong.

Answer it precisely. Where the answer is no, say no. Where the answer is partly, say partly and say which part. A policy priced on accurate information is a policy that pays.

This is general information, not insurance or legal advice. Coverage terms, application wording and the consequences of a misstatement vary by policy and by state, so your broker and your attorney are the right people to review your specific application and policy language.

RepairIT Kentucky helps small and medium businesses across Central Kentucky work through cyber insurance applications, close the gaps they expose, and produce the evidence underwriters ask for. If you have an application sitting on your desk, get in touch.

Claims figures cited are from Coalition’s 2026 Cyber Claims Report.