How to Answer Your Cyber Insurance Renewal Without Voiding the Policy

If you’ve got a cyber insurance renewal coming up, the application is probably longer than the one you filled in last time. It’s also more specific. Every new question maps to a control that, when missing, let a major 2023 or 2024 claim spiral. How you answer matters more than it used to, and the most expensive mistake on the form isn’t a weak security setup. It’s overstating one.

Why the form got longer

Three claim events reshaped the current generation of applications. The MOVEit supply-chain breach in 2023 saw an attack group exploit an unknown vulnerability in a widely used file-transfer tool, eventually affecting more than 2,650 organisations. Carriers paid claims across that footprint and started asking much harder questions about third-party software risk. The Change Healthcare ransomware incident in February 2024 froze US healthcare claims processing for weeks after an attacker got in through an entry point with no multifactor authentication, an event industry analysts have put the insurance loss from at over $250 million. And the Arup deepfake payment fraud, also from early 2024, saw a finance employee transfer $25.6 million after a video call with AI-generated deepfakes of the company’s own executives.

If your business handles cardholder data, client or patient records, or moves other people’s money, your form is the longest of all. You sit squarely in the categories carriers got burned on.

The backup question is no longer a single tick

What used to be a yes/no question now asks whether backups are immutable or air-gapped, when they were last tested, and whether they can be deleted using domain administrator credentials. Native Microsoft 365 retention doesn’t count, and neither does a NAS sitting on the same network as everything else. If this is news to you, it’s worth a proper conversation with whoever manages your IT before you sign anything, because a weak answer here is one of the fastest ways to a premium hike or a non-renewal.

MFA questions that go deeper than one checkbox

Multifactor authentication used to be a single yes/no line. It now gets asked about separately for email, VPN, remote desktop, every administrator account, and privileged service accounts, and you need a clean yes across all five. SMS-based codes are increasingly treated as a weak answer, since SIM-swap attacks have made text messages the softest link in the chain. Several carriers now ask specifically whether MFA runs through an authenticator app or hardware token rather than SMS.

Privileged access management, a category of tool that keeps admin credentials out of a regular shared password manager, is the newer question most owners haven’t seen before. A strong answer describes a vaulting tool with credentials rotated on use and every session logged. Shared admin passwords with no rotation and no audit trail is the setup most likely to end in sub-limits or non-renewal.

The bank transfer and deepfake question

After the Arup case, carriers started asking about callback verification: before any bank transfer above a set threshold goes out, does the person authorising it call the recipient on a number that was already on file, not the number in the request email? Several applications now separately ask whether staff have had any training on AI voice cloning and deepfake video. Accounting firms, law firms with trust accounts, and anyone handling escrow will see this section scrutinised hardest, because moving other people’s money makes you both a soft target and an expensive claim.

EDR, MDR, and the end of “we have antivirus”

Traditional antivirus checks files against a list of known threats. Endpoint Detection and Response (EDR) watches what’s happening on a device and flags suspicious behaviour, like a process trying to encrypt files or grab admin rights. Managed Detection and Response (MDR) is EDR with a team watching the alerts around the clock, including the ones that fire at 2am on a Sunday. Current applications ask whether EDR covers every endpoint including servers, and whether anyone’s genuinely monitoring it. If you don’t have MDR yet, a plain answer with a timeline, such as “deployment scheduled for next quarter, vendor selected,” works far better with underwriters than a vague answer about future plans.

The vendor risk question

After MOVEit and Change Healthcare, carriers now want a section on the software vendors holding your data: your top five, and whether each provides a SOC 2 report or equivalent. You’re not expected to audit every vendor’s security programme in detail. Carriers want to see you know who your key vendors are and that you’ve asked the basic questions. An honest “we’ve identified our top five and requested SOC 2 reports from three, two outstanding” reads better than a confident answer that doesn’t hold up under scrutiny.

The real risk: misrepresentation and rescission

The most expensive answer on the form is the one that overstates what you actually have. Cyber insurance applications work as warranty documents. If a forensic review after a claim finds your environment didn’t match what you declared, the carrier can rescind the policy: treated as if it never existed, the claim denied, and any prior payouts under the same term clawed back. Some courts have found the carrier doesn’t even need to prove a direct link between the misstatement and the loss. The gap itself is enough.

The better approach is straightforward. If a question asks about MFA everywhere and you’ve got a gap, declare it with a remediation date. Carriers respond better to an honest gap with a plan than a polished answer that falls apart in discovery.

A 30-day plan before you submit

Confirm MFA on email, VPN, remote desktop, every admin account, and any service accounts that support it, and move admin MFA off SMS. Verify your backups are immutable or air-gapped, run a test restore, and keep the date and a screenshot as evidence. Write a one-page bank transfer policy requiring callback verification above a threshold you set, and get it signed by anyone who can authorise payments. Confirm EDR is running on every endpoint and server, and get quotes for MDR if you don’t have it yet. Identify your top five vendors and request SOC 2 attestations. Then run a short tabletop exercise on your incident response plan with leadership and keep the notes, since that’s your evidence it’s been tested in the last 12 months.

Most of this is achievable in the month before renewal if you start now, and it’s the difference between a form that reflects reality and one that quietly puts your coverage at risk.

If you’ve got a renewal coming up on the Northern Beaches or North Shore and want a second set of eyes on the application before you sign, our team at Vaelis IT can walk through your cybersecurity setup against what the form is really asking, so you’re answering from an honest, defensible position rather than an optimistic one.