The renewal packet lands on the owner’s desk in March. Last year the cyber liability application was two pages. This year it is twelve, and it asks whether multi-factor authentication is enforced on all privileged accounts, what your endpoint detection coverage is, and when you last tested a restore from backup.
Nobody in the building knows the answers with certainty. The deadline is Friday. So somebody checks yes to most of it, because the answers feel roughly true and the policy has to be bound.
That moment is a bigger risk than most business owners realize.
Why the questions got harder
Cyber insurance used to be easy to buy. Carriers wrote broad coverage with little underwriting, then spent several years paying claims far larger than anyone had priced for. The response was predictable: fewer questions about your revenue, many more about your controls.
The claims data explains the shift. In Coalition’s 2025 report, covering 2024 claims, business email compromise and funds transfer fraud together made up 60 percent of all claims. Ransomware accounted for 21 percent, with an average loss of 292,000 dollars and initial ransom demands averaging 1.1 million dollars. Forty-four percent of affected policyholders paid something. (Source)
Read that first number again. Most cyber claims are not sophisticated intrusions. They are email. Someone gets phished, an attacker sits in a mailbox reading the accounts payable thread, and a wire goes to the wrong account. That is why so much of the application is about email security, MFA, and user training rather than firewalls.
What carriers are actually asking for
Specific wording varies by carrier and broker, but the underlying list has converged. Expect questions covering:
- Multi-factor authentication, and not just whether you have it. Carriers ask about scope: email, remote access, VPN, and administrative accounts specifically. Partial coverage is where many applications fall apart.
- Endpoint detection and response, meaning behavior-based protection with monitoring, not traditional signature antivirus.
- Backups that are tested, with offline or immutable copies, a defined retention period, and a documented recovery objective.
- Patch management with a defined timeline for critical vulnerabilities, and a policy on end-of-life software still running in production.
- Email security including filtering, quarantine handling, and a way for users to report suspicious messages.
- Security awareness training with completion records and phishing simulation results, not just an annual video nobody watched.
- An incident response plan that exists in writing and ideally has been exercised.
- Logging and privileged access controls, and increasingly some review of your own vendors’ security.
The part that should worry you
Misrepresentation on the application is a leading cause of denied claims. (Source)
This is worth being blunt about. If you attest that MFA is enforced across all administrative accounts, and an attacker later compromises an admin account that did not have it, you have a coverage problem on top of a breach. The claim is tested the moment your answers are examined by people whose job is to examine them, with incident forensics in hand.
The gap is rarely dishonesty. The person signing the form often doesn’t have visibility into the environment and answers in good faith based on what they believe is true. “We have MFA” and “MFA is enforced on 100 percent of privileged accounts” are different statements, and only one of them is a defensible answer.
Before you sign anything, someone should be able to produce the evidence behind each yes.
How our monthly plans line up with the application
We did not design our service tiers around insurance questionnaires, but there is heavy overlap, because carriers are asking for the controls that actually prevent claims.
Every OmniTech plan, including the Core plan starting at $50 per user per month, includes multi factor authentication setup and documentation, endpoint detection and response, enterprise antivirus, Microsoft and third party patching, email security and encryption, content filtering, identity threat detection and response, 24/7 remote monitoring, network and firewall monitoring, online file backup, end user security training with simulated phishing campaigns, and documented IT asset inventory.
That covers a large share of a typical application on its own, including the control carriers ask about most aggressively. MFA is not an upsell here. We set it up and we document the scope, which matters more than it sounds, because the questionnaire rarely asks whether you have MFA. It asks where it is enforced, and you need to be able to answer for email, remote access, VPN and administrative accounts specifically.
If you want a simpler experience for your staff, managed Duo two factor and single sign on is available as an add on. That buys push approvals and single sign on instead of app based codes. It is an upgrade to the experience, not the thing that gets you covered.
One thing to keep in mind: server and workstation backup is separate from online file backup. If your application asks about full system recovery rather than file recovery, that distinction matters, and we should talk about it before you answer.
Managed detection and response with a security operations center is available as an add on. Some carriers now ask specifically about 24/7 monitored detection, and a few price for it.
Our Support plan starts at $125 per user and adds unlimited help desk and guaranteed response times. Omni starts at $150 per user and adds quarterly business reviews, full virtual CIO service, roadmap planning and vendor management, and bundles in both Duo 2FA and the SOC service. Omni is also where the documentation side gets handled deliberately rather than incidentally.
All three of those are starting rates. Per user pricing steps down as your headcount grows, so the larger your team, the lower the cost per user. Our pricing calculator will give you the actual number for your own headcount, including the add ons above.
The documentation is half the value.
Having control and being able to evidence it are separate problems, and the second one is what turns a renewal from a scramble into a form you fill out in an afternoon.
Because we monitor and manage these environments continuously, we can produce patch compliance reporting, training completion and phishing simulation results, backup status and restore test records, endpoint coverage figures, and a current asset inventory. When your broker asks what percentage of endpoints are covered by EDR, we can answer with a number rather than an estimate.
Clients on the Omni plan get this reviewed in their quarterly business review, which means the answers exist before the renewal packet arrives rather than being assembled under deadline.
A few honest caveats
We are not insurance brokers, and this is not insurance advice. Carriers differ, policy language differs, and what satisfies one underwriter may not satisfy another. Your broker should tell you what your specific carrier requires, and you should read your exclusions.
We can tell you whether the answers you are about to give are accurate, and what it would take to make the ones that aren’t true today true by renewal.
If your renewal is coming up
Send us the application before you fill it out. We will go through it question by question against your actual environment and tell you where you stand, including the places where the honest answer is no.
A no you can fix in sixty days is a much better position than a yes you cannot defend after an incident.