In 2020, getting cyber insurance was relatively straightforward. You answered a short application asking whether you had antivirus software and whether you backed up your data. You said yes to both — or close enough — and the policy was issued. Premiums were modest. Coverage was broad.
That world no longer exists.
The ransomware wave of 2021–2024 cost the insurance industry billions. Insurers responded by overhauling their underwriting requirements — the controls they require as a condition of coverage — and by tightening their claims review processes. Organizations that misrepresented their security posture on the application now have claims denied after incidents. Organizations with inadequate controls can't get coverage at any price.
If you have cyber insurance, or you're shopping for it, here's what underwriters actually require in 2026 — and what gets claims denied.
The Baseline Controls That Are Now Mandatory
The following controls are now required by most major cyber insurers as a condition of issuing a policy. If you can't attest to them on the application — honestly — you either won't get coverage or you'll get coverage that can be voided if a claim is filed and the underwriter finds out you misrepresented your posture.
Multi-factor authentication (MFA) on email. This is the single most common requirement. Every major insurer requires MFA on email accounts — and most now require it specifically for email, remote access, and administrative accounts. MFA on "critical systems" used to be enough; now MFA on email specifically is the baseline.
MFA on remote access. VPNs, RDP, Citrix, and any other remote access solution must require MFA. A VPN that uses only a username and password is no longer acceptable. This is a direct response to the volume of ransomware attacks that originated through compromised RDP credentials.
Endpoint Detection and Response (EDR). Traditional antivirus is no longer sufficient. Insurers distinguish between legacy AV (signature-based detection, catches known malware) and EDR (behavioural detection, can catch novel attacks and alert on suspicious activity). EDR products include CrowdStrike Falcon Go, SentinelOne, Microsoft Defender for Business (included in Microsoft 365 Business Premium), and others. Most require deployment on all endpoints — every workstation, every laptop.
Tested, offline backups. "We back up to an external drive" is no longer sufficient. Insurers want to know that backups are: (1) stored offline or in an air-gapped cloud environment, (2) tested by actual restoration, and (3) covering all critical systems and data. The "tested" requirement is the one most businesses fail — they back up regularly but have never verified the backup can actually be restored.
Patch management. Critical security patches must be applied within a defined window — most insurers specify within 30 days of release for critical patches, 60–90 days for high severity. Businesses running end-of-life operating systems (Windows Server 2012, Windows 7) often cannot get coverage at all.
2026 Cyber Insurance Baseline Checklist
- MFA enabled on all email accounts (Microsoft 365, Google Workspace, etc.)
- MFA enabled on all remote access (VPN, RDP, remote desktop tools)
- MFA enabled on all admin/privileged accounts
- EDR deployed on all endpoints (not just traditional antivirus)
- Backups stored offline or in air-gapped cloud — not on a connected drive
- Backup restoration tested at least quarterly
- Critical patches applied within 30 days of release
- No end-of-life operating systems on the network
- Incident response plan documented (even a basic one)
- Employee security awareness training, at minimum annually
Why Claims Get Denied
The cyber insurance claims denial rate has climbed significantly since 2022. The most common reasons:
Misrepresentation on the application. An organization's application stated they had MFA on all email accounts. The insurer's post-claim forensics (which they conduct before paying) found that MFA was enabled on some accounts but not all — including the account through which the attack occurred. The claim is denied on the basis that the application contained a material misrepresentation.
Policy exclusions for known vulnerabilities. Some policies exclude coverage for incidents that exploit vulnerabilities for which a patch was available at the time of the incident. If your systems were compromised through an unpatched vulnerability that had been publicly disclosed — and you hadn't patched it — the insurer may argue the loss was foreseeable and excludable.
War exclusions. Many policies now include exclusions for "acts of war" or "state-sponsored attacks." Following geopolitical incidents, some insurers have attempted to apply war exclusions to ransomware attacks attributed to state-affiliated groups. This has been litigated in multiple jurisdictions; the outcomes have been mixed. Read your policy's war exclusion carefully.
Business interruption sublimits. Business interruption coverage — covering lost revenue during the period your systems are down — is often sublimited. A policy with $1M in total coverage may have only $250,000 in business interruption coverage, with a waiting period (commonly 8–12 hours) before the clock starts. If your actual business interruption loss is $400,000, the sublimit means you're paying $150,000 yourself.
Cyber insurance applications require attestation — you're signing a statement that the information provided is accurate to the best of your knowledge. If a claim is filed and forensics reveal your environment didn't match your attestation, the insurer has grounds to void the policy from inception. The claim is denied, premiums may be non-refundable, and you may face legal exposure for the misrepresentation. Answer the application based on your actual controls, not your aspirational ones.
What "Having Cyber Insurance" Actually Gets You
When a claim is paid, cyber insurance typically covers:
- Incident response costs: the forensic firm that determines what happened, what was accessed, and how to remediate it
- Legal counsel: privacy lawyers to manage breach notification obligations and any resulting regulatory investigations
- Notification costs: the cost of notifying affected individuals under PIPEDA
- Business interruption: lost revenue during the downtime period (subject to waiting periods and sublimits)
- Ransom payment: most policies cover ransom payment, subject to sanctions screening
- System restoration: the cost of rebuilding or restoring systems
What's typically not covered or substantially sublimited: regulatory fines and penalties (excluded in many policies), third-party liability claims from clients whose data was breached (often sublimited), social engineering losses like BEC wire fraud (often sublimited at $25,000–$100,000 in small business policies), and reputational damage.
Getting Coverage That Will Actually Pay
The most important thing you can do when shopping for cyber insurance is be honest about your current posture, implement the baseline controls before applying, and read what you're signing.
A policy with real coverage from a reputable insurer — with honest attestation of controls you actually have — is worth significantly more than a cheap policy obtained by overstating your security posture. The former pays when you need it. The latter is a false sense of security that will be voided at the worst possible moment.
Work with a broker who specializes in cyber insurance — not a generalist who also sells commercial property. Cyber policy language has become specialized enough that generalist brokers frequently miss sublimits and exclusions that matter enormously in a real incident.