Why Your Cyber Insurance May Not Cover You (And How to Fix It)

You pay your cyber insurance premium every year. You sleep a little easier knowing that if something happens, you’re covered.

But are you?

Recent industry data shows that over 40% of cyber insurance claims are being denied. Not because of fine print buried on page 47 of the policy. Because businesses didn’t have basic security controls in place when the attack happened.

If you’re running a small business in Georgia with 10 to 50 employees, this is something you need to understand before you need to file a claim. Not after.

The Rules Changed and Nobody Sent a Memo

Five years ago, getting cyber insurance was straightforward. Fill out a questionnaire, check a few boxes, write a check. Done.

That’s not how it works anymore.

The Identity Theft Resource Center tracked 3,322 data compromises in 2025 alone, a five percent increase over the previous year and a new record. Insurers have been paying out massive claims, and they’ve responded by getting much pickier about who they cover and what they’ll actually pay for.

Today’s cyber insurance applications look less like questionnaires and more like security audits. Carriers want documentation: screenshots, security logs, backup test results, and written policies. They want proof, not promises.

And if your answers on the application don’t match reality when you file a claim? That’s when the denial letter shows up.

The Hamilton Cautionary Tale

Here’s a real-world example that should get your attention.

The City of Hamilton, Ontario suffered a major cyberattack. When officials filed their insurance claim, the insurer denied it. The reason? Hamilton hadn’t fully implemented multifactor authentication across its systems at the time of the breach.

The result: taxpayers got stuck with an $18.3 million recovery bill.

Hamilton isn’t a tiny organization. They have IT staff, budgets, and resources most small businesses can only dream of. If they can get caught by this, so can you.

In another case, a business had its $1.8 million ransomware claim denied because an admin account was compromised that didn’t have MFA enabled. The insurer investigated, found the gap, and cited “failure to maintain minimum security standards.”

These aren’t edge cases anymore. This is the new normal.

What Insurers Actually Require Now

If you’re applying for or renewing a cyber insurance policy in 2026, expect your carrier to look for these specific controls. Missing even one can mean higher premiums, reduced coverage, or outright denial.

Multifactor Authentication (MFA)

This is the big one. MFA means that logging into your systems requires something beyond just a password, like a code sent to your phone or a prompt from an authenticator app.

Insurers now expect MFA on:

Email accounts (especially Microsoft 365 and Google Workspace)
Remote access (VPN, remote desktop, cloud applications)
Admin accounts (anyone with elevated privileges on your network)
Financial systems (banking, payroll, accounting software)

It’s not enough to have MFA on some accounts. Carriers are looking for it everywhere that matters. One unprotected admin account can sink your entire claim.

What it costs: Most MFA solutions are free or included with your existing software subscriptions. Microsoft 365 Business includes it. Google Workspace includes it. You’re likely already paying for it and just haven’t turned it on.

Data Backup and Recovery

Insurers want to know that if ransomware locks up your systems, you can actually recover without paying the ransom. That means they’re looking for:

Regular automated backups of critical business data
Offsite or cloud-based backup copies (not just an external hard drive sitting next to the server)
Tested restores (can you actually recover from your backups, or are you just hoping they work?)
Backup isolation (backups that a ransomware attack can’t reach and encrypt)

The “tested restores” part trips up a lot of businesses. Having backups is one thing. Knowing they work is another. Insurers are increasingly asking for documentation proving you’ve tested your restore process.

What it costs: Cloud backup for a small business typically runs $50 to $200 per month depending on data volume. Budget options exist. The key is consistency and testing, not the most expensive solution.

Endpoint Detection and Response (EDR)

Traditional antivirus isn’t enough anymore. Insurers want to see endpoint detection and response tools that actively monitor for suspicious behavior on your computers and servers.

EDR goes beyond just scanning for known viruses. It watches for unusual patterns, like someone trying to access a bunch of files at 3 AM or a program attempting to encrypt your data.

What it costs: EDR solutions for small businesses typically run $5 to $15 per device per month.

An Incident Response Plan

This doesn’t have to be a 200-page document. But you need a written plan that answers basic questions:

Who do you call first when something happens?
How do you contain the damage?
Who notifies affected customers?
Who contacts your insurance carrier?

Georgia has its own data breach notification law that requires businesses to notify affected residents within a reasonable time. Your incident response plan should account for this.

What it costs: Writing a basic incident response plan costs nothing but your time. Templates are available online from CISA (the Cybersecurity and Infrastructure Security Agency) and other government resources.

Security Awareness Training

Phishing emails remain the number one way attackers get into small business networks. Insurers know this, and many now require proof that your employees receive regular security awareness training.

This doesn’t mean a one-time presentation during onboarding. It means ongoing training, ideally with simulated phishing tests to see who clicks.

What it costs: Security awareness training platforms for small teams typically run $2 to $5 per user per month.

The Application Honesty Problem

Here’s where a lot of small businesses get into trouble. The cyber insurance application asks if you have MFA enabled. You know your IT person set it up at some point, so you check “yes.”

But maybe MFA was only enabled for some accounts. Maybe an employee turned it off because it was inconvenient. Maybe your new accounting software doesn’t have it configured yet.

When you file a claim, the insurer investigates. They bring in forensic experts who will find those gaps. And if your application said one thing but reality says another, you’ve just given them grounds to deny your claim or even void your policy entirely.

Travelers Insurance actually took a policyholder to court to rescind a policy because the business had misrepresented its MFA implementation on the application. This isn’t theoretical risk. Insurers are actively litigating these cases.

The lesson: audit your actual security posture before filling out your application. Know what’s really in place, not what you think is in place.

A Practical Game Plan for Getting Compliant

You don’t need to do everything at once. But you do need to start. Here’s a realistic prioritization for a small business:

Month 1: MFA everywhere. Start with email and remote access. Then expand to admin accounts and financial systems. This is non-negotiable for insurers and it’s the single most impactful thing you can do.

Month 2: Backup audit. Verify your backups are running, stored offsite, and actually work. Run a test restore. Document the results.

Month 3: EDR and training. Replace basic antivirus with an EDR solution. Start a security awareness training program for your team.

Month 4: Document everything. Write your incident response plan. Create a simple security policy document. Keep records of training completion, backup tests, and security configurations.

This isn’t about perfection. It’s about demonstrating that your business takes cybersecurity seriously and has the documentation to prove it.

The Bottom Line

Cyber insurance is still worth having. But it’s not a substitute for actually securing your business. Think of it like homeowner’s insurance: it covers you when bad things happen, but it won’t pay out if you left all your doors unlocked.

The businesses that will have the smoothest insurance renewals and the fewest claim denials are the ones treating cybersecurity compliance as an ongoing practice, not a checkbox exercise.

If you’re unsure where your business stands, a cybersecurity assessment can identify the gaps before your insurer does. It’s a lot cheaper to fix these things proactively than to discover them in a denial letter after an attack.

Need help figuring out where you stand? Talk to our team about a cybersecurity assessment for your business. No pressure, just honest answers about your coverage readiness.