A few years ago, buying cyber insurance meant answering a handful of questions and paying a modest premium. Today the questionnaire runs to pages, the questions are pointed, and a wrong answer can mean no cover, a higher price, or worst of all, a claim declined on the day you need it. Firms that were comfortably insurable are finding renewal harder — not because they got less secure, but because the bar moved.
The reason is simple: insurers paid out a great deal. UK insurers reported paying nearly £200 million in cyber claims to help businesses recover in 2024, a 230% year-on-year jump, with ransomware and malware making up over half of that by value (Association of British Insurers, 2025). When losses rise that fast, underwriters respond by demanding proof of the controls that reduce them. The good news: the controls insurers now want are the same ones that genuinely make you safer. Here is what they check, why a gap can void a claim, and how to prepare for renewal.
Why underwriting tightened
The shift is from self-attestation to evidence. For years, insurers largely took firms at their word on the application form. After the ransomware losses of recent years, they no longer do. The market has moved towards evidence-based underwriting: underwriters increasingly want proof that your controls are real, enforced and monitored, not merely written down. Premiums have softened again recently in the UK as more firms met the bar — but the bar itself is now a precondition, not a nice-to-have.
The controls insurers now demand
Across the market, the same short list of controls appears again and again. Treat these as the price of entry:
Multi-factor authentication (MFA), everywhere it matters. On email, remote access and administrative accounts, for everyone, with no exceptions. This is the single most requested control, because it stops the account takeovers behind so many claims.
Endpoint detection and response (EDR). Traditional antivirus is no longer enough. Insurers increasingly expect EDR — or a managed detection and response service — across all endpoints, with evidence it is actually monitored, not just installed.
Tested, isolated backups. Automatic backups with at least one offline or immutable copy, and evidence you have restored from them recently. Because ransomware groups deliberately target backups, insurers now ask specifically about immutability and offline copies.
A written, rehearsed incident response plan. Underwriters want to see that you know what you would do in the first hours, who you would call, and that you have tested it.
Timely patching and vulnerability management. Security updates applied promptly — typically critical and high-risk patches within around 14 days — with a process rather than good intentions.
Many insurers also look favourably on, or increasingly require, Cyber Essentials certification, because it evidences several of the above in one place. From assessments created after 26 April 2026, IASME has confirmed that missing MFA on an in-scope cloud service where it is available is an automatic failure — which tells you how central MFA has become to the whole ecosystem.
It is worth being clear about what these controls are not. They are not a guarantee against attack, and no insurer treats them that way. What they do is shift the odds and cap the damage — MFA closes the most common route in, EDR shortens the time an intruder goes unnoticed, and tested backups mean an encryption event is a recovery exercise rather than a ransom negotiation. Underwriters price on exactly that shift in odds, which is why they ask, and why they now ask for proof.
How a failed control can void a claim
This is the part firms underestimate. A cyber policy is a contract built on the answers you gave in the proposal. If you attested that MFA was enabled everywhere and an attacker gets in through the one mailbox where it was not, the insurer can argue you misrepresented your risk — and reduce or decline the claim. The most painful cyber losses are not the ones where a firm had no insurance; they are the ones where the firm had insurance and discovered, mid-incident, that a gap between the questionnaire and reality had voided it.
This is not insurers being difficult. It is how insurance has always worked: the premium was priced on the controls you claimed to have. The practical lesson is to answer the questionnaire against reality, not aspiration — and to fix the gap rather than paper over it.
How to prepare for the renewal questionnaire
Renewal goes far better when you treat the questionnaire as a checklist to satisfy before you fill it in, not a form to complete under time pressure. A sensible sequence:
- Get the questionnaire early and read it as a to-do list. Identify every control it asks about and check, honestly, whether you can evidence it today.
- Close the obvious gaps first. Enable MFA everywhere, confirm EDR is deployed and monitored, and run a test restore from backup so you can answer that question with a date and a recovery time.
- Assemble the evidence. Underwriters increasingly want proof, so keep the screenshots, policy documents, patch reports and restore-test records to hand. Evidence-based underwriting rewards firms that can show their work.
- Answer against reality. If a control is only partly in place, say so and describe the plan, rather than ticking a box you cannot defend after a claim.
- Consider Cyber Essentials. Certifying evidences several required controls at once and is often viewed favourably by insurers.
Insurable and secure are now the same project
The controls insurers demand — MFA, EDR, tested backups, an incident response plan, timely patching — are precisely the controls that reduce your real-world risk. Getting insurable is no longer a paperwork exercise separate from getting secure; it is the same work. On the TrustOps Maturity Model, a firm that can evidence these controls is typically at Level 3 to Level 4 — Managed moving to Measured — where security is not just present but demonstrable. That is exactly the posture that makes renewal straightforward and a claim payable.
A sensible next step
If you want to know whether you would satisfy today's cyber insurance questionnaire, our free 15-minute assessment scores you out of 100 against the very controls underwriters check — MFA, endpoint protection, tested backups, incident planning and patching — and shows your top five gaps, whether or not we ever speak again. Start with the free assessment at trustops.co.uk/.
Sources
Association of British Insurers — Nearly £200 million paid in cyber claims (230% rise; ransomware/malware over half of claims), 2025: https://www.abi.org.uk/news/news-articles/2025/11/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover/
IASME — Changes to Cyber Essentials for April 2026 (MFA auto-fail on in-scope cloud services): https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
National Cyber Security Centre — Mitigating malware and ransomware attacks (backups, MFA, patching): https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks
Microsoft — Multi-factor authentication blocks the vast majority of account-compromise attacks: https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
techUK — Trends in the UK cyber insurance market: https://www.techuk.org/resource/trends-in-the-uk-cyber-insurance-market.html
