Five years ago, getting cyber insurance was relatively straightforward: answer a short questionnaire, pay a modest premium, and you were covered. Those days are gone. The dramatic increase in ransomware attacks, data breaches, and business email compromise has fundamentally changed the cyber insurance market — and the requirements businesses must meet to obtain and maintain coverage have tightened substantially.
Today, many insurers conduct pre-coverage audits of applicants’ security controls. Renewals include detailed questionnaires that go far deeper than before. And businesses that misrepresent their security posture — even unintentionally — risk having claims denied when they need coverage most.
What Insurers Are Looking For in 2026
Cyber insurance underwriters have become significantly more sophisticated about what security controls actually reduce risk. These are the controls they most commonly require or assess:
Multi-Factor Authentication (MFA)
MFA is now effectively a baseline requirement for cyber insurance. Most insurers require MFA on email, remote access (VPN), privileged accounts, and cloud applications. Some require it broadly across all systems. Businesses without MFA may be unable to obtain coverage at all — or may face significantly higher premiums and lower coverage limits.
Endpoint Detection and Response (EDR)
Traditional antivirus software is no longer sufficient. Insurers increasingly require Endpoint Detection and Response (EDR) solutions — more sophisticated tools that continuously monitor endpoint behavior, detect anomalous activity, and can automatically contain threats. If your business is running basic antivirus, you may not meet current insurer requirements.
Tested Backup and Recovery
Insurers want to know not just that you have backups, but that you’ve tested them. They ask about backup frequency, offsite or cloud storage, air-gapped or immutable backup copies (resistant to ransomware encryption), and recovery time testing. Businesses that can demonstrate a robust, tested backup posture are significantly more attractive to underwriters.
Privileged Access Management
How are administrator accounts managed? Are admin credentials used for day-to-day tasks? Is there a process for managing and auditing privileged access? Insurers are increasingly asking detailed questions about how the most powerful accounts in your environment are controlled.
Email Security
DMARC, DKIM, and SPF records — the email authentication standards that prevent domain spoofing — are increasingly assessed in cyber insurance applications. Advanced email filtering and anti-phishing tools are also commonly required, particularly for businesses in higher-risk industries.
Security Awareness Training
Insurers want to know that your employees have received security awareness training — and increasingly, they want evidence of ongoing training and phishing simulation testing, not just an annual checkbox exercise.
Incident Response Planning
Do you have a documented incident response plan? Have you tested it? Insurers are increasingly requiring businesses to demonstrate that they have a plan for responding to a cyber incident — and that the plan has been reviewed and tested, not just written.
The Consequences of Gaps
Businesses that can’t demonstrate these controls face a range of consequences: inability to obtain coverage, significantly higher premiums, lower coverage limits, higher deductibles, or exclusions that eliminate coverage for the most common attack types. And businesses that answer questionnaires inaccurately — even without intent to deceive — may find their claims denied based on misrepresentation.
How to Prepare
The best way to prepare for a cyber insurance audit is to actually implement the security controls that insurers are looking for — not just to check boxes on a questionnaire. This means working with your IT provider to conduct a genuine security assessment, identify gaps against current insurer requirements, and implement the controls needed to both qualify for coverage and actually reduce your risk.
At Adaptive IT, we regularly help businesses prepare for cyber insurance applications and renewals. We assess your current security posture against insurer requirements, identify and remediate gaps, and provide the documentation that underwriters need — including evidence of MFA deployment, EDR coverage, backup testing, and employee training.
Don’t wait until your renewal to discover that your current controls don’t meet requirements. Contact Adaptive IT today for a cyber insurance readiness assessment and ensure your coverage is in place when you need it most.