Cyber insurance used to be a quick form and a check. That’s changed. Insurers have paid out enough ransomware and breach claims that applications now ask pointed, specific technical questions—and a vague or wrong answer can mean a denied claim later, not just a rejected application now.
Here’s what insurers are actually asking, and what it takes to answer honestly.
The Questions That Show Up Most Often
- “Is multi-factor authentication enabled on email and remote access?” Not “do you have strong passwords”—specifically MFA, specifically on the systems attackers target most.
- “Are backups tested, and are they isolated from your main network?” A backup that ransomware can also encrypt doesn’t count as a real backup in an insurer’s eyes.
- “How quickly are security patches applied?” “Eventually” is not an acceptable answer, and increasingly insurers want a number.
- “Do you have endpoint detection on all devices?” Basic antivirus is often no longer considered sufficient on its own.
- “What’s your incident response plan?” Having an actual written plan—not “we’d figure it out”—is increasingly a real question on the application.
Why This Matters Beyond the Application
Answering these questions incorrectly, even accidentally, is a real problem. If a business claims MFA is enabled during a breach investigation and it turns out it wasn’t actually configured correctly, insurers have denied claims on exactly that basis. The application isn’t just a formality—it’s the standard your coverage gets measured against later.
Getting Ready Before You Apply
- Confirm MFA is actually enforced, not just available, on email and any remote access.
- Verify backups are tested on a schedule and stored somewhere a ransomware infection on your main network can’t also reach.
- Document your patching cadence, even if it’s informal—write down what actually happens.
- Have a basic written incident response plan, even a simple one. Something beats nothing.
Most of these gaps are fixable in weeks, not months, once someone takes an honest inventory. If you’re applying for cyber insurance, or renewing, and aren’t fully confident in how you’d answer these questions, that’s worth sorting out before the application, not after a claim. We’re happy to take a look.
Related: See our guide to Mac cybersecurity and backup solutions in New Jersey.
Social Media: Cyber insurance applications ask pointed, specific technical questions now—and getting them wrong can mean a denied claim later. Here’s what insurers actually want to know.