Cyber Insurance Readiness: What Underwriters Check For

A ransomware attack shuts down a 60-person accounting firm's file servers on a Tuesday morning. The firm holds a $2 million cyber insurance policy, purchased eighteen months earlier through its commercial insurance broker. Six weeks later, the claim comes back denied. The forensic investigation found that remote desktop access had been open to the internet without multi-factor authentication, a control the firm had attested to having in place when it applied for the policy. The insurer doesn't just deny the claim. It voids the policy entirely.

That scenario is becoming common enough that insurers now build their underwriting process around preventing it, not just pricing around it.

The Underwriting Bar Just Moved

Cyber insurance pricing has been easing after several years of steep increases, which sounds like good news for the 25-to-200-employee organizations that make up most of the buying market. It isn't, or at least not in the way it looks. According to the National Association of Insurance Commissioners' 2025 Cybersecurity Insurance Report, U.S. direct written cyber premium declined in 2024 even as claim frequency jumped by roughly 40% year over year, with close to 50,000 claims reported. Softer pricing and rising claims at the same time means one thing: carriers are competing on price while tightening what they'll actually insure against. The underwriting questionnaire is doing more work than the rate table.

For organizations in Elevaire's client range specifically, the number worth paying attention to is $246,000. That's the five-year average cost of a cyber incident for organizations under $2 billion in annual revenue, according to NetDiligence's 2025 Cyber Claims Study, which analyzed more than 10,000 claims. Organizations this size account for 98% of the claims insurers process, even though large enterprises account for a disproportionate share of total dollar losses. The exposure is real and common. The question underwriters are increasingly focused on is how often the policy they wrote turns out not to apply when that exposure hits.

What Underwriters Actually Verify Before They'll Quote You

Every major carrier's application now walks through the same handful of controls, in more or less the same order. The specific brand names differ, but the categories don't.

Control	What "Yes" Actually Means	Common Gap
Multi-factor authentication	Enforced on email, VPN and remote access, cloud admin consoles, and every privileged account	Applied to email but not to RDP, legacy VPN appliances, or shared admin logins
Endpoint detection and response	Deployed and actively monitored on every workstation and server	Installed on laptops, skipped on servers or unmanaged devices
Backup resilience	Encrypted backups with at least one immutable or offline copy, restores tested on a schedule	Backups run nightly but have never actually been restored
Incident response plan	A written plan naming internal roles, an outside forensics contact, and first containment steps	A plan exists as a document nobody on staff has read or rehearsed
Security awareness training	Recurring, documented training with phishing simulation results tracked over time	A one-time onboarding video with no ongoing cadence

None of these controls is new or exotic. What's changed is the level of proof insurers expect. Attesting that a control exists on an application is no longer enough on its own; carriers increasingly expect documentation that shows the control was actually enforced at the time of loss, not just described in good faith when the policy was written. That shift toward proof, more than any single technical requirement, is what's driving the current wave of underwriting scrutiny.

The Gap Between Having a Policy and Being Covered

Owning a cyber insurance policy and being covered when an incident happens are not the same thing, and the gap between them is where most of the bad outcomes live.

Coalition's 2025 cyber claims data shows business email compromise and funds-transfer fraud driving 58% of claims, with 71% of that fraud originating from social engineering rather than a technical exploit. Initial ransomware demands rose 47% year over year to more than $1 million, even as a record 86% of ransomware victims refused to pay. Encouragingly, 64% of closed claims resulted in no direct financial loss to the policyholder, largely because the incident response and negotiation support built into the policy did its job before a payout was ever necessary. That's the strongest argument for carrying the coverage at all.

It's also the argument for making sure the coverage actually holds up. Industry-wide, more than 40% of cyber insurance claims close with reduced or no payment, most often because of gaps in required controls, late notification to the carrier, or exclusions the policyholder didn't fully understand at the time of binding. Misrepresentation on the original application, stating a control was in place when it wasn't fully enforced, is consistently cited as the single largest driver of coverage disputes, because it gives the carrier grounds to void the policy rather than simply deny one claim.

For comparison, IBM's most recent size-segmented breach cost data (2023, the last year IBM broke out results by organization size in its annual Cost of a Data Breach Report) put the average breach cost for companies under 500 employees at $3.31 million. Even accounting for methodology differences with the NetDiligence figure above, the range makes the same point from two directions: an underinsured or wrongly-denied claim after an incident this size is not an inconvenience, it's an existential event for most organizations in the 25-to-200-employee range.

A Readiness Checklist You Can Actually Run

Cyber insurance readiness isn't a separate compliance project bolted onto your existing IT operations. It's a verification exercise against controls most organizations already believe they have.

Pull your last application or renewal questionnaire and re-answer it honestly. Compare what was attested against what's actually enforced today, not what was true when the policy was first written.
Confirm MFA coverage on every remote access path, not just email and the primary VPN. Legacy remote access tools and shared administrator accounts are the most common blind spot.
Verify EDR is both deployed and actively monitored on every server and workstation, including any systems an MSP or internal IT team considers "out of scope."
Test a real backup restore. A backup job completing successfully is not the same evidence as a restore actually working.
Put the incident response plan in writing, name specific people to specific roles, and confirm your outside forensics and legal contacts are current, not contacts from a prior renewal cycle.
Schedule recurring security awareness training and keep records of completion and phishing simulation results, since this is now a standard line item on renewal applications.
Read the exclusions section of the actual policy, not just the declarations page summary, and flag anything that depends on a control your organization doesn't consistently enforce.

Working through this list typically surfaces two or three real gaps, even in organizations that consider their IT operations solid. Closing them before a renewal application is a documentation and process exercise. Discovering them after a claim is denied is a much more expensive way to learn the same thing.

Where This Fits With the IT You Already Have

Most of the controls underwriters check sit squarely inside day-to-day IT operations: device management, patch oversight, monitored endpoint protection, backup administration. If your organization already has a managed IT provider or an internal IT team, cyber insurance readiness usually isn't a new project. It's a question of whether the controls your team already runs are documented and verifiable, not just running.

That verification is where a gap tends to open. A managed IT provider or an internal admin can confirm that EDR is installed and backups are scheduled. Confirming that those controls line up with what your specific policy's exclusions actually require, and that the paper trail exists to prove it after an incident, is a different task, closer to governance than to day-to-day operations. Fractional IT Leadership is where that kind of cross-check gets built into a standing process: someone senior enough to read the policy exclusions, map them against your real control environment, and flag gaps before a renewal application goes in, not after a claim comes back denied.

Frequently Asked Questions

How much does cyber insurance actually cost for a company our size?

Pricing depends heavily on industry, revenue, and the security controls already in place, but most organizations in the 25-to-200-employee range should expect a range rather than a single number, with stronger control environments consistently pricing lower than weaker ones at the same revenue and industry. The controls covered in this article are the single biggest lever an organization has over where in that range its own quote lands.

Will our existing managed IT provider or in-house IT team automatically satisfy underwriting requirements?

Not automatically. Most managed IT providers and internal IT teams already run the technical controls insurers ask about, but underwriting applications ask for specific, current, documented answers, not a general assurance that "IT handles security." The gap is usually in documentation and verification, not in the underlying technology.

What's the real difference between having a policy and being insurable?

Having a policy means a carrier agreed to write coverage at some point in the past, often based on attestations made at that time. Being insurable, in a way that actually pays out, means the controls attested to on the application are still true and provable at the moment an incident happens. Renewal cycles are exactly when that gap gets tested, since the questionnaire gets re-answered every year even if your environment hasn't been re-verified.

How long does it take to get cyber insurance ready?

For an organization with reasonably mature IT operations already in place, closing documentation and verification gaps typically takes a few weeks, not months. The work that takes longer, building out a written incident response plan, standing up recurring security awareness training, and testing backup restores on a real schedule, is worth starting well before a renewal deadline rather than in the final weeks before an application is due.

Does Elevaire sell cyber insurance or replace our insurance broker?

No. Elevaire doesn't sell insurance policies and isn't a substitute for your insurance broker, who remains the right resource for coverage limits, pricing, and policy language. What Elevaire does is verify and document the technology controls underwriters are asking about, and translate the policy's technical requirements and exclusions into a plan your IT team or managed provider can actually execute against.

How do we get started?

Start with the checklist above and an honest read of your current policy's exclusions against your actual control environment. If that review surfaces gaps you don't have the internal bandwidth or expertise to close and document on your own, that's the point where bringing in Fractional IT Leadership makes sense, either as a one-time readiness assessment ahead of a renewal or as an ongoing part of your technology governance.