Cyber Insurance Renewal Is a Controls Audit

The Decision in Front of You

Most companies renew cyber insurance the way they renew property cover. The broker sends a questionnaire, someone in finance or IT fills it in, an officer signs it, and the policy binds. The decision is whether that signature is an administrative step or a statement of fact about your security that the business is prepared to defend in court.

The stakes are the whole limit. A policy that pays $10 million after a ransomware attack is worth nothing if the insurer can show that a control you said existed did not.

Market conditions make this easy to overlook. Marsh's Global Insurance Market Index for the third quarter of 2026 shows cyber rates down 4% worldwide, the thirteenth consecutive quarterly decline, with US rates flat and new capacity letting many buyers broaden cover and lower their retentions ³. Cheap cover makes renewal look like a pricing exercise.

What's Happening

The market is larger, cheaper and more selective about controls

The US market has roughly tripled in five years. The NAIC's 2026 report puts 2025 US direct written premium at about $9.46 billion including alien surplus lines insurers, up 3.5% on 2024 ⁴. Domestic insurers wrote nearly $7.5 billion, against $2.75 billion in 2020, and domestic policies in force rose 33% to about 5.8 million ⁵. The industry loss ratio worsened to 53 in 2025 from 48.7 in 2024, and claim severity rose for large and medium businesses ⁵. Munich Re estimates the global market at nearly $15 billion in 2025 and expects around $28 billion by 2030 ⁷.

Claims data shows where losses come from. Coalition's 2026 Cyber Claims Report, drawn from more than 100,000 policyholders in five countries, found claim frequency up 3% in 2025 while average severity fell 19% to $116,000 ⁶. Initial ransom demands rose 47%, and a record 86% of ransomware victims did not pay ⁶. Businesses with more than $100 million in revenue filed claims five times as often as smaller ones ⁶.

Underwriters ask about specific controls

Brokers and insurers have converged on a short list. Marsh's twelve key controls start with MFA for remote and privileged access, email filtering, secured and tested backups, privileged access management, endpoint detection and response (EDR, software that records and blocks malicious activity on each machine), and patch management ⁸. Marsh says the adoption of certain controls "has now become a minimum requirement of insurers" ⁸. The same controls appear in CISA's #StopRansomware Guide, which tells organizations to keep offline, encrypted backups, test them, and implement phishing-resistant MFA for all services ¹⁴.

The list rests on claims data. Marsh McLennan paired its claims records with its clients' security self-assessments in 2023 and measured which controls predicted fewer incidents ⁹. Organizations that applied hardened baseline configurations to servers were nearly six times less likely to have an incident. MFA reduced the likelihood only when it covered all critical data, all remote logins and all administrator accounts. Patching high-severity flaws within seven days halved the probability of an event, and only 24% of the organizations studied did it ⁹.

Three cases show what a wrong or missing answer costs

International Control Services, 2022. Travelers issued a cyber policy to an Illinois electronics manufacturer whose application stated that it used MFA to protect administrative access ¹². After a ransomware attack in May 2022, Travelers' investigation found MFA protected only the firewall and not the server that was attacked ¹. Travelers sued on July 6, 2022, saying it would not have issued the policy had it known ¹. The company agreed to a judgment rescinding the policy from inception, entered on August 26, 2022 ¹. No claim under that policy, past or future, was covered. The lesson is that materiality attaches to the application as a whole. An answer that was true for the firewall and false for one server was enough.

City of Hamilton, 2024. Ransomware hit the Ontario city on February 25, 2024. The city refused to pay the ransom and spent $18.3 million on response and recovery, about $14 million of it on outside experts ¹⁰. Its insurer denied the claim because MFA "had not been fully implemented at the time of the attack," and the policy excluded losses where the absence of MFA was the root cause ¹⁰¹¹. City staff told council that the insurer had recommended MFA in late 2022 ¹⁰. The rollout was under way and incomplete. Taxpayers carried the full bill ¹¹. The lesson for the CFO: an exclusion tied to a named control turns a deployment schedule into a coverage question.

Jaguar Land Rover and Marks & Spencer, 2025. Two large UK attacks in 2025 show the difference cover makes. Jaguar Land Rover's factories stopped from September 1, 2025 for five weeks. The company was still negotiating a cyber policy through its broker when the attack hit, and the deal was not complete ¹². JLR booked about £260 million of costs by February 2026 with nothing recovered from insurers, the UK government provided a £1.5 billion loan guarantee, and the Cyber Monitoring Centre estimated the cost to the UK economy at up to £1.9 billion ¹². Marks & Spencer, attacked in April 2025, put its total cost at about £136 million and claimed up to £100 million on its cyber policy ¹³. The policy absorbed most of the direct cost. Its half-year profit still fell 55.4% ¹³.

Why the Usual Approach Fails

Renewal is run as a procurement task. The broker manages the market, finance manages the budget, and the application is completed under deadline by whoever can answer fastest. That process produces answers that describe policy. "Do you require MFA for all remote access?" gets a yes because the policy document says so. The insurer reads the same yes as a statement that no remote access path exists without MFA.

The questions are written in absolutes and the estates they describe are not. Every mid-size company has a forgotten VPN appliance, a vendor support account, a legacy server that cannot run the EDR agent, or a backup repository reachable with the same domain credentials as everything else. The person signing does not know these exist. The engineers who know have never read the application.

Evidence is assembled after the loss. Forensic investigators working for the insurer reconstruct what was enforced on the day of the attack, from logs and configuration. In both the ICS and Hamilton cases the gap surfaced during the claim ¹¹⁰. Few companies run that reconstruction on themselves before they sign.

Controls drift during the year. An application signed in March describes March. Acquisitions, new SaaS tools, contractors and emergency exceptions add unprotected access over the following months. Some policies, like Hamilton's, tie cover to a named control at the time of the loss ¹⁰, and few companies check in September whether the March answers still hold.

Insurers now measure some of this from outside. Coalition routinely scans policyholders for exposed remote access appliances after its claims data linked certain VPN and firewall devices to higher claim frequency ¹⁶. The insurer can see the internet-facing half of your estate whether or not the application describes it accurately.

The Framework: Attest, Evidence, Maintain

Run the renewal as a controls audit with two signatures. The CFO owns the commercial terms and the accuracy of the application. The CTO owns the controls and the evidence. Neither signs alone.

flowchart LR
    A[Map<br/>each question<br/>to a control] --> B[Assign<br/>one owner<br/>per control]
    B --> C[Evidence<br/>config exports<br/>and tests]
    C --> D[Decide<br/>fix, disclose<br/>or exclude]
    D --> E[Sign<br/>CFO and CTO<br/>together]
    E --> F[Re-check<br/>quarterly<br/>during the term]

Map. Start from last year's application and the draft for this year. Turn every question into a control statement with a defined scope. "MFA on all remote access" becomes a list of every remote access path: VPN, remote desktop gateways, vendor portals, cloud consoles, email.

Assign. One engineer owns each control and its evidence. The owner reads the exact wording of the question.

Evidence. For each control, produce something an investigator would accept: a configuration export showing MFA enforced on every path, an EDR console report showing coverage against the asset inventory, a log of the last restore test from immutable backups, patch reports for internet-facing systems. Test the control as well. Try to log in to each remote path without a second factor. Restore a system from backup.

Decide. Where a control is incomplete, there are three honest choices. Fix it before binding. Disclose it to the underwriter with a dated remediation plan. Or accept an exclusion. The fourth choice, answering yes and hoping, is the one that voided ICS's policy ¹.

Sign. The CFO and CTO both sign an internal attestation that the application matches the evidence file. The officer who signs for the insurer then has a record of how each answer was established.

Maintain. Re-run the evidence for the top controls every quarter. Report exceptions to the audit or risk committee the same way finance reports control deficiencies.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. Who signed our last cyber insurance application, and what did they check before signing?
2. Which answers on the application are absolute ("all", "every", "always"), and can we prove each one today?
3. How many ways can someone reach our network or email from outside, and which of them do not require a second factor?
4. Does our policy exclude or limit losses where a named control such as MFA was missing?
5. When did we last restore a production system from backup, and could ransomware reach that backup with stolen admin credentials?
6. Which servers or appliances cannot run our EDR agent or receive patches, and did we disclose them?
7. What changed in our environment since the last application: acquisitions, new vendors, new remote access?
8. If the insurer's forensic team arrived tomorrow, what would they find that contradicts our application?

Closing

A cyber policy is a promise from the insurer that depends on promises from you. The insurer's side is written by lawyers and priced with claims data. Yours is often written in an afternoon by someone who has never seen the firewall configuration. Make the CFO and CTO joint owners of the renewal, prove every answer with evidence before signing, fix or disclose what is missing, and keep the answers true through the policy year.