Cyber Insurance Renewals: What Underwriters Now Demand
Not long ago, buying cyber insurance meant filling out a short application and checking a few boxes. Those days are over. After years of heavy ransomware losses, insurers have become far more selective about who they cover, how much they cover and what controls they require. Renewal season now feels more like a security audit than a paperwork exercise.
For security and finance leaders, understanding what underwriters look for can mean the difference between favorable terms, higher premiums, reduced coverage or no offer at all.
The controls underwriters expect
Requirements vary by carrier, industry and company size, but most underwriters now focus on a common set of controls:
Multi-factor authentication everywhere it matters. MFA for email, remote access, privileged accounts and cloud applications is now close to a baseline expectation. Gaps, such as an unprotected VPN or admin accounts without MFA, can be deal-breakers.
Endpoint detection and response. Underwriters increasingly expect EDR across workstations and servers, often with 24/7 monitoring through an internal team or managed detection and response provider.
Secure, tested backups. Backups that are offline, immutable or otherwise isolated from the main network, combined with regular restore testing, show you can recover from ransomware without paying.
Privileged access management. Limiting and monitoring administrator accounts, removing local admin rights and using separate credentials for privileged work reduce the blast radius of a breach.
Patch and vulnerability management. Insurers ask how quickly critical vulnerabilities are patched, especially on internet-facing systems, and some scan applicants’ external attack surface directly.
Email security and phishing training. Advanced email filtering, domain authentication and regular security awareness training remain standard questions.
Incident response planning. A documented, tested incident response plan, including tabletop exercises, signals that you can contain an attack quickly.
Third-party risk management. With supply chain attacks rising, underwriters want to know how you assess vendors and limit their access.
Beyond the questionnaire
Underwriting has become more data-driven. Many carriers now run outside-in scans of your domains, looking for exposed remote desktop services, unpatched systems, leaked credentials and misconfigured email security. Findings can affect pricing or trigger requirements to fix issues before binding coverage. Answers on applications also matter more than ever: inaccurate responses can jeopardize claims later.
Watch the policy terms, not just the price
Renewals may bring changes beyond premiums, including higher retentions, sublimits for ransomware or business interruption, exclusions for war or state-sponsored attacks, coinsurance on certain losses, and conditions tied to maintaining specific controls. Review these carefully with your broker and legal team.
How to prepare for renewal
- Start early, at least three to four months before renewal.
- Assess yourself against common underwriting requirements and close gaps before submitting.
- Gather evidence, such as MFA coverage reports, EDR deployment metrics, backup test results and incident response exercise records.
- Scan your own external footprint so there are no surprises.
- Tell your security story. Explain improvements made over the past year and planned investments. Brokers can use this narrative to negotiate better terms.
- Coordinate security, finance, legal and risk teams so answers are accurate and consistent.
The bottom line
Cyber insurance has become a forcing function for security maturity. Organizations that treat renewal as an opportunity to validate their controls, rather than a form to fill out, are better protected, better insured and better positioned to negotiate.
This article is for general information. Coverage terms and underwriting requirements vary; consult your broker for specifics.