A few years ago, getting cyber insurance was a paperwork exercise. 

Fill out a form. Pay the premium. File it away. Most organizations treated it like any other insurance policy. A box to check, not a conversation to have. 

That’s not what’s happening anymore. 

What’s changed 

Carriers got burned. Ransomware claims exploded, payouts climbed, and insurers started paying much closer attention to what organizations had in place before they wrote the policy. The questionnaires got longer. The requirements got more specific. And the underwriting process started looking a lot more like a security audit. 

Today, your cyber insurance application is asking a simple question: do you have controls in place that would prevent or limit the damage of an incident? 

If the answer isn’t convincing, one of three things happens:

1. You don’t get coverage 
2. You pay significantly more for it 
3. You find out at the worst possible moment that your claim can be denied because a control wasn’t in place when the breach happened 

That’s the part most organizations underestimate. You can have a policy, pay your premiums on time, and still find yourself without coverage when you need it most. 

What carriers are looking for 

The controls that come up consistently are the same ones we covered in our last post:  

• MFA across all systems, not just email 
• Endpoint detection and response rather than traditional antivirus 
• Immutable, off-site backups that have been tested 
• Documented incident response procedures 
• Security awareness training for staff 

These aren’t arbitrary requirements. They’re the controls that reduce the likelihood and severity of a claim. Carriers know this because they’ve paid out enough claims to understand exactly what was missing when things went wrong. 

If you can’t clearly demonstrate these controls are in place, you’re not just a harder insurance risk. You’re exposed. 

The renewal conversation is different now 

If your renewal is coming up, don’t wait until your broker asks the questions. Carriers are non-renewing policies or adding exclusions for organizations that can’t demonstrate adequate controls. And if you’ve had a claim in the past few years, the scrutiny is even more intense. 

The organizations that navigate renewal well aren’t scrambling to document what they have. They already know. They’ve done the work to build and maintain the controls their carrier expects, and they can demonstrate it clearly when asked. 

That’s not just a better insurance outcome. That’s what a strong security posture looks like. 

The broader shift 

This is what makes it more than just an insurance conversation. The controls your carrier requires are becoming a de facto security standard for mid-sized organizations. Not because a regulation mandates them, but because the market does. 

Your insurance carrier is pushing from one direction. Your clients and vendors are starting to push from another through security questionnaires (stay tuned for our next post). Between the two, the organizations that haven’t built a solid foundation are finding themselves squeezed from both sides. 

Technology decisions are no longer IT decisions. They directly impact revenue, risk, and insurability. Cyber insurance is just the place where that reality becomes impossible to ignore. 

Where to start 

If you’re not confident your controls would hold up to that level of scrutiny, start here. The self-assessment from our first post covers the thirteen controls that map closely to what most carriers are looking for. 

Download the self-assessment here. 

And if you want to pressure-test your environment before your next renewal conversation, we’re happy to spend 30 minutes walking through where you stand. 

[Schedule a reality check] 

 Your carrier is making a coverage decision whether you’re ready or not. 

 The question is whether your controls are. 

This is the second post in our Field Notes from the Front Lines series. Next up: Security Questionnaires are Now Revenue Gatekeepers, and What to do When One Lands in Your Inbox.