TL;DR
Cyber insurance renewal forms have become longer and more specific. High-profile incidents involving supply-chain compromise, missing MFA and deepfake payment fraud illustrate why insurers increasingly scrutinise backups, identity controls, payment verification, EDR/MDR and vendor risk. The costliest mistake is not necessarily answering “no”; it is overstating a control that is not actually in place. This article explains common areas of focus and provides a four-week plan to help you verify your answers before submission. Policy requirements vary by insurer and risk profile.
Why the form got longer
If your renewal application looks different from last year’s, increased scrutiny of cyber controls is likely part of the reason. Several high-profile incidents illustrate the types of risks insurers are now paying closer attention to.
The MOVEit breach hit in May 2023, when attackers exploited a flaw in a widely used file transfer tool. By late 2023, more than 2,650 organisations and over 66 million individuals had been affected, according to Emsisoft’s tracking, with the number still climbing. The incident demonstrates how a vulnerability in one widely used vendor platform can create downstream exposure across many organisations.Emsisoft’s tracking
Then, in February 2024, the Change Healthcare ransomware attack froze US healthcare claims processing for weeks. HIPAA Journal reported that attackers got in through a remote access system with no multi-factor authentication (MFA) enabled. UnitedHealth Group’s own figures put the total cost of the incident at over $2.4 billion. Incidents like this help explain why insurers increasingly scrutinise MFA, incident response and resilient backups.HIPAA Journal reported
Weeks later, the Arup deepfake fraud reshaped how insurers think about social engineering. A finance employee at the firm’s Hong Kong office authorised 15 wire transfers worth $25.6 million after a video call with what looked and sounded like the company’s CFO and senior colleagues, all AI generated. CNN confirmed the fraud went unnoticed for about a week. Payment-verification controls are also commonly scrutinised where organisations transfer significant sums or handle client funds.CNN confirmed
If your business handles cardholder data, health records, client funds or trust or escrow funds, you may face more detailed questions because these activities can increase the potential impact of a cyber incident or payment-fraud event.
The backup question isn’t a simple ‘yes’ or ‘no’ anymore
A single tick box has become three: are your backups immutable or air-gapped, tested within the past 12 months, and out of reach of your own admin credentials? “We back up to Microsoft 365” no longer answers that on its own, because native retention and same-perimeter backups can still be wiped by a compromised admin account.
Where an application asks about backup immutability, a well-supported answer should accurately describe the platform, retention or immutability period, credential separation and the date and outcome of the most recent restore test. The exact requirements and underwriting response will vary by insurer and risk profile.
MFA now means wherever possible, not just email
Applications increasingly ask where MFA is enforced, including email, VPN, remote access, administrator accounts and service accounts that support interactive authentication. Requirements vary, but insurers often distinguish stronger authentication methods from SMS-based codes because SMS is more vulnerable to interception and SIM-swap attacks.
The newer question is about privileged access management: are admin credentials vaulted, rotated after use, and logged? A shared administrator password stored in a spreadsheet, rarely rotated and without an audit trail is a material weakness that may prompt follow-up questions or affect offered terms.
Wire transfers need a human check
Applications may ask about out-of-band verification for significant or unusual payments: before a transfer above a defined threshold, does someone call the recipient using a number that was independently verified and already on file, rather than a number supplied in the request email? Some forms may also ask whether staff receive training on deepfake and voice-cloning risks. Businesses that move client or third-party funds should expect closer scrutiny in this area.
EDR, MDR, and the end of “we have antivirus”
Traditional antivirus primarily checks files against known threats. Endpoint Detection and Response (EDR) monitors device behaviour for suspicious activity. Managed Detection and Response (MDR) combines detection technology with an external team that monitors and responds to alerts under the agreed service scope. Applications increasingly ask about EDR coverage and whether alerts are monitored outside business hours. If a control is planned but not yet deployed, state that accurately and include a realistic target date where the form allows it.
Know your top vendors
Some applications ask organisations to identify important technology vendors, the data or access those vendors hold, and whether independent assurance such as a SOC 2 report or equivalent is available. The exact number of vendors and evidence required will depend on the application. You may not be expected to audit each vendor yourself, but you should be able to explain how critical suppliers are identified and reviewed.
The one mistake that can cost you
Accuracy matters when completing a cyber insurance application. If the controls described in an application do not reflect what is actually in place, it may affect coverage or the insurer’s response to a future claim, depending on the policy wording, circumstances and applicable law.
If you are unsure how to answer a question, confirm the technical facts with your IT provider or security team and discuss the insurance implications with your broker or insurer. An honest gap with a documented remediation plan is better than overstating a control that has not yet been implemented. A declared gap may affect the premium, conditions or coverage offered, but it gives the insurer accurate information on which to assess the risk.
Your 4 week pre-renewal checklist
- Week 1: Confirm where MFA is enforced, prioritising email, remote access and administrator accounts. Move privileged accounts away from SMS-based MFA where stronger methods are supported.
- Weeks 1–2: Test-restore your backups and document it.
- Week 2: Put your wire transfer policy in writing, with callback verification and a signed threshold.
- Weeks 2–3: Confirm EDR/MDR coverage, or get a timeline in place.
- Week 3: Identify your critical technology vendors and request available independent assurance, such as SOC 2 reports or equivalent documentation where relevant.
- Weeks 3–4: Run a short incident response tabletop exercise and keep the notes.
- Week 4: Answer the form honestly, with remediation dates for anything outstanding.
A cyber insurance renewal can serve as a useful security health check with a deadline attached. Getting the facts and evidence in order before completing the form is practical work that can reduce uncertainty. Symsafe can help verify the technical controls described in the application. Your broker, insurer or legal adviser should confirm how those facts affect coverage and disclosure obligations.
Note: This article provides general cybersecurity information and is not insurance or legal advice. Policy requirements vary. Confirm coverage and disclosure requirements with your insurance broker, insurer or legal adviser.
Frequently asked questions
What can happen if an insurance application contains inaccurate information? The outcome depends on the policy, circumstances and applicable law. Inaccurate or incomplete information may affect coverage, claim handling or the insurer’s available remedies. Confirm technical answers with your IT provider or security team and seek guidance from your broker, insurer or legal adviser.
Will my cyber insurance be denied if I do not have MFA where possible? Not necessarily. Requirements and outcomes vary by insurer and risk profile. Missing MFA may influence eligibility, premium, exclusions, sub-limits or remediation requirements, particularly where email, remote access or privileged accounts are not protected.
What’s the difference between EDR and MDR? EDR (Endpoint Detection and Response) is the technology that watches device behaviour for suspicious activity. MDR (Managed Detection and Response) is that same technology plus a 24/7 team monitoring alerts and responding to them. Renewal forms increasingly ask about both separately.
Why did cyber insurance renewal forms get longer? Insurers rewrote their questions in response to specific 2023 and 2024 losses, including the MOVEit breach, the Change Healthcare ransomware attack, and the Arup deepfake fraud. Each event drove more detailed questions on backups, MFA, wire transfer controls or vendor risk.
Can an incorrect answer affect a cyber insurance claim? Yes, it can. The consequence depends on the policy wording, circumstances and applicable law, so businesses should answer accurately and discuss uncertain answers with their broker, insurer or legal adviser.
What does “immutable backup” mean on an insurance application? It generally means a backup copy that cannot be modified or deleted during a defined retention period, including by an account with compromised administrator credentials. The insurer’s required retention period and evidence will vary, so answer using the actual configuration and most recent restore-test records.