A few years ago, applying for cyber insurance meant ticking a handful of boxes. Today the renewal form for a 30-person company can run to several pages, and the questions are specific: which accounts have multi-factor authentication, where the backups live, which devices run endpoint protection and how quickly critical patches go in. Underwriters aren’t asking out of curiosity. Those answers become part of the contract, and getting them wrong can cost you the coverage you thought you were paying for.
Here’s how the application changed, why the answers matter more than the premium, and how a small business can answer every question honestly and back it up.
What changed on the application?
The short version: insurers stopped asking whether you “have security” and started asking how specific controls are deployed. Losses drove that shift. The FBI’s Internet Crime Complaint Center recorded about $20.9 billion in reported losses in 2025, up 26% on 2024, with business email compromise alone at just over $3 billion (FBI IC3 2025 Internet Crime Report).
Alt text: Bar chart of FBI IC3 reported business email compromise losses for 2023, 2024 and 2025. Image: original graphic created by RDE Technologies for this article. You’re free to publish it with the post.
The threat itself also moved. Verizon’s 2026 Data Breach Investigations Report found that exploiting software vulnerabilities has overtaken stolen credentials as the top way attackers get in, at 31% of breaches, and that breaches involving a third party rose 60% to 48% of the total (Verizon 2026 DBIR). So expect more questions about patching speed and your vendors, not only about passwords.
Why does a wrong answer matter so much?
Because the application is usually incorporated into the policy. If a statement turns out to be materially false, the insurer may argue the policy should never have existed.
That isn’t hypothetical. In 2022 Travelers asked a federal court in Illinois to rescind a cyber policy it had issued to International Control Services after a ransomware attack. Travelers alleged the company had stated on its application that it used MFA to protect access to its systems, when MFA in fact protected only its firewall, not its server or other assets. The parties agreed to rescission and the court declared the policy void from the start (Insurance Journal). No coverage for that claim, or any other.
The lesson isn’t that insurers are out to get you. It’s that “yes” to “Do you use MFA?” means everywhere the form says, not “we turned it on for a few people.”
Which questions trip companies up?
In our experience the problems are rarely lies. They’re answers given by someone who didn’t know the full picture. Watch for these.
“MFA is enforced for all remote access”
All of it: email, VPN, remote desktop, the remote-control tool your IT provider uses, cloud admin portals and the old accounting system someone logs into from home. One forgotten service account or legacy login can make the answer false.
“Endpoint detection and response is deployed on all endpoints”
Laptops are usually covered. Servers, the reception PC and the machine running the door-access software often aren’t. Check the console’s device count against your actual inventory.
“Backups are stored offline or are immutable”
A second copy on a synced cloud drive isn’t offline. If ransomware can reach it with the same credentials, it doesn’t count.
“Critical patches are applied within X days”
Pick a number you actually meet, not the one you aspire to. If the honest answer is 30 days, say 30 and work on improving it.
“You verify changes to payment instructions”
Is there a written procedure, and does the finance team follow it every time? Underwriters increasingly ask for a call-back to a known number before any change to bank details.
How do you answer honestly and prove it?
Treat the application like an audit you’ll have to defend. Four habits make that manageable.
- Start 90 days before renewal. That leaves time to fix a gap rather than misstate it.
- Get the technical answers from the people running the systems. The owner or office manager often fills out the form. The person who can see the MFA and EDR consoles should check every technical answer.
- Build an evidence pack. For each “yes,” keep a dated screenshot or report: MFA enforcement settings, EDR device coverage, the last successful backup restore, patch compliance, your payment-verification procedure and training records. Save it with a copy of the signed application.
- Disclose exceptions in writing. If one legacy system can’t support MFA, say so and describe the compensating control, such as network isolation. A disclosed exception is a negotiation. An undisclosed one is a misrepresentation.
If your IT is outsourced, ask your provider to review and sign off on the technical answers. Any firm offering managed IT services in New York or elsewhere should be able to export MFA, EDR and backup reports in an afternoon, and it’s reasonable to make that part of the service agreement.
What should you do between renewals?
Controls drift. A new hire gets set up without MFA, a laptop is reimaged without the EDR agent, a backup job silently fails. A quarterly check against your last application catches that drift before it becomes a coverage problem. It also means renewal is a matter of updating the evidence pack instead of starting from scratch.
It’s worth reading your policy for the obligations that kick in after an incident, too: who you must call first, which vendors you can use and what needs the insurer’s consent. Those terms are as much a part of the bargain as the application.
The bottom line
The cyber insurance application has quietly become one of the most detailed security assessments a small business will ever fill out. Answer it as if you’ll need to prove every line, because if you ever file a claim, you might.
About the author: Nathan Spitalny is the CEO of RDE Technologies, a managed IT and cybersecurity provider founded in 2009 in Oceanside, New York. His team supports healthcare practices, senior-living facilities and small businesses across New York City and Long Island.
