Cyber insurance is not a security strategy

Cyber insurance has moved from an optional extra to a line item many businesses are asked about — by customers, by tender requirements and by their own boards. That is a good development. But it has also created a dangerous misunderstanding: that buying a policy is the same as managing the risk.

It is not. Insurance transfers some of the financial consequence. It does not remove the cause, the downtime, the lost trust or the operational chaos. And increasingly, the policy itself is conditional on you having basic controls in place.

What a policy does and does not do

Cyber policies vary widely, but most cover some combination of incident response costs, forensic investigation, legal expenses, notification costs, business interruption and, in some cases, ransom payments. Those can be substantial — which is why the cover exists.

What a policy does not do:

• Prevent the incident. Insurers reimburse; they do not configure your firewall.
• Restore your data. If backups are missing or compromised, the policy pays a claim, not a recovery.
• Protect your reputation. Clients remember the week their invoices were exposed.
• Cover everything. Exclusions are common — often for poor maintenance, unreported incidents, unencrypted devices or failure to follow policy conditions.
• Guarantee a payout. A claim can be reduced or declined if the answers on the application were inaccurate.

The last point matters more than most businesses realise. If you told the insurer that MFA was enforced, and it was not, the claim conversation becomes very different.

What insurers are asking now

Applications have become more detailed, and the questions are effectively a security checklist. Typical examples include:

• Is multi-factor authentication enforced for email, remote access and privileged accounts?
• Are backups kept offline or immutable, and how often are restores tested?
• Is endpoint protection deployed on all devices, with central monitoring?
• How quickly are critical security patches applied?
• Is email filtering in place, and is phishing training provided?
• Do you have a documented incident response plan, and has it been tested?
• Are privileged accounts limited and reviewed?
• Is data encrypted at rest and in transit?
• Have you had a previous incident or claim?

These are not trick questions. They are the controls that correlate most strongly with whether a business survives an incident — and they are the same controls a competent IT provider would recommend anyway.

Six controls that do the heavy lifting

If you are preparing for an insurance application — or simply want to reduce risk — start here. These deliver the most benefit for the effort.

1. Multi-factor authentication everywhere it matters

Email, remote access, accounting systems and admin consoles should all require a second factor. MFA is cheap, widely supported and stops a large proportion of account-based attacks. It is the first question on almost every application for a reason.

2. Backups that are separated and tested

Ransomware specifically targets backups. Keep at least one copy offline or immutable, and test a restore on a schedule. An untested backup is a claim waiting to be denied.

3. Endpoint protection with central visibility

Every laptop and desktop needs active protection, and someone needs to see the alerts. A tool that nobody monitors is not a control; it is a licence fee.

4. Timely patching

Most successful attacks exploit known vulnerabilities for which a fix already exists. A documented patching routine — operating systems, browsers, servers and network devices — closes the easiest doors.

5. Email security and staff awareness

Phishing remains the most common entry point. Filtering catches a lot, but not everything. Short, regular awareness sessions and a simple “report suspicious email” process make a measurable difference.

6. A written incident response plan

When something happens, the first hour matters. A one-page plan covering who to call, how to isolate affected systems, who communicates internally and how to contact the insurer turns panic into procedure.

Evidence matters as much as intent

Insurers increasingly ask for proof, not assurances. That means documentation: MFA enforcement reports, backup configuration and restore logs, patch compliance summaries, endpoint coverage figures and a dated incident response plan.

This is one of the practical benefits of a managed approach. If monitoring, patching and backups are run consistently, the evidence already exists. If everything is ad hoc, assembling it before a renewal becomes a last-minute project.

The question is not “do we have cyber insurance?” It is “could we demonstrate, if asked tomorrow, that the controls we claimed are actually working?”

A sensible order of work

If you are starting from a low base, do not try to implement everything in a month. A pragmatic sequence looks like this:

1. Close the obvious gaps: MFA on email and remote access, and confirm backups actually run.
2. Get visibility: endpoint protection on every device, and monitoring that someone reviews.
3. Test recovery: restore a real file, then a larger set. Record the result.
4. Standardise patching: a routine with an owner and a simple report.
5. Document and rehearse: the incident plan, contacts and escalation path.
6. Then review cover: with evidence in hand, the insurance conversation is far easier and often cheaper.

The bottom line

Cyber insurance is worth having. It is not a substitute for doing the work. The businesses that get the most from their cover are the ones that treat the application as a prompt to fix the fundamentals — and then keep them fixed.

If you are renewing cover, preparing a customer security questionnaire or simply want to know where you stand, start with the basics. MFA, tested backups, monitored endpoints, patching and a written plan will do more for your risk than any policy wording.

This article is general information, not insurance or legal advice. Cover, conditions and exclusions vary by insurer and policy.