Your cyber insurance application is a list of promises. Every “yes” you check, from multi-factor authentication to tested backups, is a statement about how your business is protected. If you suffer an attack and the insurer’s investigation finds that a control you attested to wasn’t really in place, your claim can be denied. In some cases, the whole policy can be voided.
Most business owners don’t lie on these forms. They answer based on what they believe is true. The problem is that “we have MFA” and “MFA is enforced on every account” are two very different statements, and the application only asks you to check a box.
The case every insurance broker talks about
In 2022, an Illinois electronics manufacturer applied for cyber insurance with Travelers. The application, signed by the company’s leadership, said it used multi-factor authentication to protect administrative and privileged access.
A few weeks after the policy began, the company was hit by ransomware. The insurer’s investigation found that MFA was protecting the firewall and nothing else. The servers the attackers reached had no MFA at all. Travelers went to federal court to rescind the policy, arguing it would never have issued it had it known the truth. The company agreed, and the court declared the policy void from the start. Read the coverage in Insurance Journal.
A rescinded policy doesn’t just deny one claim. It is treated as if it never existed.
What cyber insurance applications typically ask
Every insurer’s form is different, but most ask about the same core controls:
- Multi-factor authentication on email, remote access, and administrator accounts.
- Endpoint detection and response (EDR) on every computer and server, not just antivirus.
- Backups that are kept separate from your network, protected from deletion, and tested.
- Patching of operating systems and software on a regular schedule.
- Email security, including filtering for phishing and malicious attachments.
- Security awareness training for employees.
- An incident response plan that says who to call and what to do.
Each of those is a yes-or-no question on paper. In a real environment, each one has exceptions, gaps, and settings that can quietly change. Our October security checklist walks through how to check several of them yourself.
Why honest businesses get it wrong
The person signing isn’t the person configuring. The owner or office manager fills out the application. The technical details live with the IT provider, and nobody puts the two side by side.
“Turned on” isn’t the same as “enforced.” An MFA policy can exist in test mode, where it logs sign-ins but stops no one. It can exclude a group of accounts. Older email connections can bypass it entirely. From the outside, all of these look like “we have MFA.”
Backups that report success aren’t proof. A backup job can finish every night for months while the data it protects can’t actually be restored. If nobody has tested a restore, “tested backups” is a guess.
One missed device is enough. “EDR on every endpoint” is false if a single laptop or server was never enrolled, or its protection stopped reporting.
Things change after you sign. Your answers need to be true on the day you sign and stay true for the life of the policy. New employees, new laptops, and quick fixes made under pressure all create drift.
How we check your application against reality
At Pointer Tech Solutions, comparing your cyber insurance attestations with your actual environment is one of the 94 written standards we review our managed clients against. We take your current application or renewal questionnaire and map it line by line to the evidence:
- MFA: is it enforced on every account, with no untracked exclusions and no test-mode policies?
- EDR: does every computer and server have it installed, reporting, and in protection mode?
- Backups: is every server backed up, is there a copy that can’t be deleted by an administrator, and has a person verified a real restore?
- Patching: are devices actually current, with any that have fallen behind named individually?
- Email security and training: are the protections and completion records what the application claims?
If we find a gap, we tell your decision-maker in writing, not in passing. Then it gets fixed, or your answer gets corrected with your broker before it becomes a problem. Your Technology Alignment Manager keeps checking on a schedule, so your answers stay true after you sign.
What to do before your next renewal
- Find last year’s application. Your broker can send you a copy if you don’t have one.
- List every “yes.” Each one is a control you promised to have.
- Ask your IT provider for proof, not reassurance. A screenshot, a report, or a restore test record for each item.
- Fix gaps or answer accurately. An honest “partially” is better than a “yes” that falls apart during a claim.
- Have IT review the form before you sign it. The questions are technical, so the answers should be checked by someone technical.
- Keep the evidence on file. If you ever need to make a claim, you’ll want to show the controls were in place.
Frequently asked questions
Can an insurer really deny a claim over one wrong answer?
It depends on your policy and the details, but yes, it has happened. Insurers set premiums and decide whether to offer coverage based on your answers. If an answer that mattered to that decision turns out to be false, the insurer may deny the claim or seek to void the policy, even if the mistake was honest.
Who should fill out our cyber insurance application?
Your business signs it, but the technical answers should come from, or be checked by, whoever manages your IT. Treat it as a joint effort between your leadership and your IT provider.
We think we answered something incorrectly. What now?
Talk to your insurance broker now rather than after an incident. Then work with your IT provider to close the gap, so the answer is true going forward.
Do you sell cyber insurance?
No. We’re an IT and cybersecurity provider, not an insurance agency. We make sure the security answers you give your insurer are accurate and stay that way. Coverage decisions belong with your broker. This article is general information, not legal or insurance advice.
Bring us your application
If you have a cyber insurance renewal coming up, or you’re not sure your last application still holds up, let’s look at it together. We’ll walk through the security questions and tell you plainly where your environment stands. Schedule a 15-minute discovery call, or call us at (225) 351-0775, Monday through Friday, 8 AM to 5 PM.
