How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy

If you have a cyber insurance renewal coming up, the application is probably longer than the last one.

That’s not random. Insurers paid out on some big losses in 2023 and 2024, and each new question maps to a control that, if it had been in place, might have kept one of those claims smaller.

The expensive mistake isn’t a higher premium. It’s answering optimistically, saying yes when the honest answer is no.

Why the form got longer

Three incidents shaped a lot of the new questions.

MOVEit (2023). Attackers exploited an unknown flaw in Progress Software’s MOVEit Transfer file-sharing tool. By mid-2024, a widely cited running tally from security researchers counted 2,773 organizations and about 95.8 million people affected. Insurers now ask much more about the vendors holding your data.

Change Healthcare (2024). A ransomware attack froze US healthcare claims processing for weeks. In Senate testimony, UnitedHealth Group’s CEO said the attackers got in through a remote-access portal that didn’t have multifactor authentication. Verisk’s PCS, which tracks insurance industry losses, designated it a cyber catastrophe, a label that means insured losses are expected to top $250 million. It’s a reminder of why MFA and recovery questions get so much attention.

The Arup deepfake (2024). A finance employee at the engineering firm’s Hong Kong office made 15 transfers totaling HK$200 million (about US$25.6 million) after a video call with what looked like the company’s CFO and other colleagues. All of them were deepfakes, according to Hong Kong police and Arup. Cases like this are a big reason insurers now ask how you verify payment requests.

If you run a healthcare practice, an accounting office or anything else that moves client money here in Mid-Michigan, expect the longest application of all.

What the new sections are asking

Backups. Not just “do you have backups,” but whether they’re immutable or air-gapped, how often you test a restore and whether they’re safe from your own admin accounts. We covered this one in detail in what “immutable backup” means on your insurance form.

MFA everywhere. Expect separate questions for email, VPN, remote desktop, all admin accounts and service accounts. Applications may also ask what kind of MFA you use, since text-message codes are the weakest option compared with an authenticator app, hardware key or push with number matching.

Wire transfers. Do you call back a known, verified phone number before sending money, especially when the request seems to come from an executive? Expect questions about the dollar amount where that check kicks in, and about whether staff know how to spot voice cloning and deepfake video.

EDR and MDR. “We have antivirus” isn’t enough anymore. Endpoint detection and response (EDR) watches for suspicious behavior on each device. Managed detection and response (MDR) adds a 24/7 team responding to the alerts.

Vendors. Who are your top software vendors, and have you asked for their SOC 2 security reports?

The mistake to avoid: overstating your controls

Cyber insurance applications are warranty documents. If a forensic investigation after a claim finds your setup didn’t match your answers, the insurer can rescind the policy. The policy is treated as if it never existed, and your claim is denied. This has happened. In 2022, after a ransomware attack, Travelers asked a federal court in Illinois to rescind a policy it said was issued on a misstated MFA answer. The court rescinded the policy and declared it void from the start, with the company’s agreement.

So if there’s a gap, say so and give a date for fixing it. Underwriters can work with “MDR deployment scheduled for next quarter, vendor selected.” A “no” or “in progress” may cost some premium, but that’s a cost you can plan for.

A 30-day pre-renewal checklist

• Week 1: Confirm MFA on email, VPN, remote desktop and every admin account. Move admin MFA off text messages.
• Weeks 1-2: Confirm backups are immutable or air-gapped. Run a test restore and save the date and screenshots.
• Week 2: Write a one-page wire policy requiring callback verification above a set amount. Have everyone who can approve payments sign it.
• Weeks 2-3: Confirm EDR is on every computer and server, or get quotes so you can give a timeline.
• Week 3: List your top five software vendors and request their SOC 2 reports.
• Weeks 3-4: Update your incident response plan and run a one-hour tabletop exercise with leadership.
• Week 4: Answer honestly, with dates for anything still open.

Most of this lines up with our cybersecurity work. If you’d like a second set of eyes on your application before you sign, reach out or call (888) 933-2975. Loop in your insurance broker too.