How to Answer Your Cyber Insurance Application Honestly

Article Summary: Your cyber insurance application has grown longer because of major claims from 2023 and 2024. These include the MOVEit supply-chain breach, the Change Healthcare ransomware attack, and the Arup deepfake wire fraud. The new questions ask about immutable backups, layered MFA, callback verification on wire transfers, EDR or MDR coverage, vendor risk, and a tested incident response plan. If your answers overstate your security, the carrier can rescind the policy after a claim and treat it as if it never existed.

If you have a cyber insurance renewal coming up, expect a longer application than last time. It’s also far more specific. Each new question maps to a security control that, when missing, let a major claim spiral out of control. The wording reflects lessons carriers learned from the losses they paid, and your answers matter more than they used to.

At Pacific Edge Technology, we help businesses across Richland, Kennewick, and Pasco work through their cyber insurance application every renewal cycle. This post explains why the application got longer and what each new section really asks. It also covers how to answer honestly and what to fix in the 30 days before you submit.

The most expensive mistake is rescission. That’s when a carrier denies a future claim because the controls you declared weren’t actually in place.

Why the cyber insurance application got longer

Three major claim events from 2023 and 2024 shaped today’s applications.

The MOVEit supply-chain breach

Progress Software received the first customer reports of unusual activity on May 28, 2023. The Cl0p ransomware group had been exploiting an unknown flaw in Progress Software’s MOVEit Transfer file-sharing tool. Some researchers detected activity as early as February. By late 2023, the breach had affected more than 2,650 organizations and over 66 million people. The totals kept climbing into 2024. Carriers paid claims across that entire footprint, and they changed how they ask about third-party software risk.

The Change Healthcare ransomware attack

The Change Healthcare attack in February 2024 froze healthcare claims processing across the US for weeks. The attacker got into the network on February 12 and launched ransomware on February 21. Pharmacies, providers, and patients nationwide felt the impact. HIPAA Journal reported that a key entry point lacked multifactor authentication, which made the break-in possible. Industry analysts estimated the cyber insurance losses at over $250 million. Carriers responded with tougher questions about backups and incident response.

The Arup deepfake wire fraud

The Arup deepfake fraud, also from early 2024, changed how underwriters think about social engineering. A finance employee at the engineering firm’s Hong Kong office joined a video call with what looked like the company’s CFO and other executives. Every one of them was an AI-generated deepfake. The employee then sent $25.6 million across 15 wire transfers. Nobody noticed the fraud for about a week. Today, every underwriter’s checklist includes callback verification for wire transfers.

Who gets the longest application

Some businesses face extra scrutiny. These include e-commerce stores that handle credit card data and healthcare practices with patient records. Accounting and law firms that move client funds also qualify, as do real estate brokerages that handle escrow. Carriers took their biggest losses in these categories.

The backup question changed

The backup question used to be a simple yes or no. Now it asks whether your backups are immutable or air-gapped and when you last tested them. It also asks whether someone with your administrator credentials could delete them.

Expect wording like: “Are backups stored in an immutable or air-gapped state, tested for restoration within the past 12 months, and inaccessible to domain administrator credentials?”

Nobody can delete or change an immutable backup during its retention period, not even an attacker with stolen admin credentials. An air-gapped backup lives on systems your main network can’t reach. CISA’s Stop Ransomware Guide lists immutable, tested backups as a baseline control. Most cyber insurance carriers now apply the same standard.

“We back up Microsoft 365” no longer works as a complete answer. Microsoft 365’s built-in retention isn’t a backup in the sense the carrier means. Also, some third-party backups share the same login system as your production environment. An attacker who takes over a global admin account can wipe those out.

What a strong backup answer looks like

The strongest answer describes a backup platform with object lock or write-once storage turned on. It includes an immutability window of at least 14 days, though carriers now prefer 30. Your backup credentials should stay separate from your everyday admin accounts. You should also have a recent successful restore test.

Weaker answers usually trigger follow-up questions and sometimes a higher premium. One example is daily backups to a storage device on the same network with no recent restore test. Unclear answers carry the most risk. They can push a renewal toward reduced coverage limits or non-renewal.

MFA questions go deeper than one checkbox

MFA used to be a single yes or no question. Now applications ask about five specific areas: email, VPN, remote desktop, administrator accounts, and privileged service accounts. You need a yes on all five for a clean pass.

Carriers now consider text message (SMS) codes weak. Attackers can defeat them through SIM-swap attacks and phone network flaws. Several carriers ask whether you use an authenticator app, a hardware security key, or push notifications with number matching. If your admin accounts still rely on text codes, expect a follow-up question or a higher premium.

The privileged access management question

Most business owners haven’t seen the privileged access management (PAM) question before. PAM tools keep administrator passwords out of ordinary password managers. They lock privileged credentials in a vault, change them after each use, and log every session. That way, an attacker can’t quietly use a stolen admin password for weeks.

A strong PAM answer describes a vaulting tool that rotates credentials after use and logs sessions. Admin passwords in a shared password manager, changed once a year, will usually prompt follow-up questions. Shared admin accounts that never change and leave no usage record carry the most risk. That setup often leads to reduced coverage or non-renewal.

Missing MFA somewhere doesn’t always mean an outright denial. More often, you’ll see a big premium increase or lower limits on ransomware coverage. The carrier may also exclude any incident that starts at the unprotected entry point.

The wire transfer and deepfake verification questions

After the Arup case and a wave of business email compromise losses, carriers added questions about callback verification. Here’s how it works. Before sending a wire above a set amount, often $10,000 or $25,000, the approver calls the recipient. They use a phone number they verified and saved ahead of time, never the number in the request email.

Expect wording like: “Does your organization require out-of-band verification using a previously known phone number for all funds transfer requests above [threshold], including requests appearing to come from executives?”

Some applications now also ask whether you’ve trained staff on AI voice cloning and deepfake video scams. After Arup, carriers that insure professional services firms consider this a fair question.

Underwriters examine this section most closely for accounting firms, law firms with trust accounts, and real estate brokers. Anyone who moves other people’s money makes an attractive target and an expensive claim.

A strong answer references a written wire transfer policy. The policy should require callback verification above a stated amount and approval from two people. It should also include annual social engineering training that covers deepfakes. Carriers usually flag informal habits that lack a written policy. If your team approves wire transfers by email alone, carriers may exclude or decline coverage for funds transfer fraud.

EDR, MDR, and the end of the “we have antivirus” answer

Traditional antivirus checks files against a list of known threats. Endpoint Detection and Response (EDR) watches activity on each device and flags suspicious behavior. For example, it can catch a program that suddenly starts encrypting files or tries to gain admin rights. Managed Detection and Response (MDR) adds a team that watches those alerts around the clock. They respond even when something happens at 2am on a Sunday.

Current applications ask whether you’ve installed EDR on 100% of your computers and servers. They also ask whether a 24/7 security operations center (SOC) monitors and responds to alerts. The MDR question is increasingly a straight yes or no, and a “no” affects your price.

If you plan to add MDR, say so with a specific timeline. Underwriters can work with “MDR deployment scheduled for Q2, vendor selected.” They can’t work with vague plans.

The vendor risk questions

Vendor questions used to be a single yes or no. After MOVEit and Change Healthcare, carriers now want a full section on the software vendors that hold your data.

Expect questions like: “List your top five software vendors with access to sensitive data and confirm whether each provides a SOC 2 Type II report or equivalent.” Have you ever asked your practice management or accounting software vendor for a SOC 2 report? If not, now is the time.

Nobody expects you to audit every vendor in detail. The carrier wants to see that you know your key vendors and what data they hold. They also want to see that you’ve asked the basic questions. Honesty works best here. “We’ve identified our top five vendors and received SOC 2 reports from three, with two outstanding” reads better than a confident answer that falls apart after a claim.

The mistake to avoid: misrepresentation and rescission

The most expensive answer on a cyber insurance application is one that overstates your security. Your policy typically relies on the answers you give. After a claim, the carrier will often run a forensic investigation. If your environment doesn’t match what you declared, the carrier may be able to rescind the policy.

Rescission means the carrier treats the policy as if it never existed. It denies your claim and can claw back money it already paid under that policy. In some cases, courts have ruled that the carrier didn’t need to prove the misstatement caused the loss. The misstatement alone was enough. Rules vary by state and policy, so talk with your insurance broker about how this applies to you.

The fix is simple. Suppose a question asks about MFA on all admin accounts and you have a gap. Disclose the gap and include a date when you’ll fix it. Carriers respond better to honest gaps with a plan than to polished answers that fail under investigation.

Answering “no” or “in progress” might raise your premium or tighten your coverage. That cost is predictable. A misstatement that surfaces after a claim can void the policy entirely, and you’ll absorb the full cost of the incident yourself.

The 30-day pre-renewal checklist

Work through these in order. You can finish most items in a month if you start now.

Week 1: Confirm MFA covers email, VPN, remote desktop, all admin accounts, and any service accounts that support it. Move admin accounts off text message codes to an authenticator app or hardware key.

Weeks 1 to 2: Verify your backups are immutable or air-gapped. Run a test restore and document the results with the date and screenshots.

Week 2: Write a one-page wire transfer policy. Require callback verification to a known phone number for any transfer over your chosen amount. Have everyone who approves payments sign it.

Weeks 2 to 3: Confirm EDR runs on every computer and server. If you only have traditional antivirus, get quotes for EDR or MDR now. That way, you can answer with a deployment timeline.

Week 3: Identify your top five software vendors and request SOC 2 reports or similar documentation. Note who responds.

Weeks 3 to 4: Write or update your incident response plan. Then run a 60-minute tabletop exercise with your leadership team. Keep the notes as proof you “tested the plan in the past 12 months.”

Week 4: Sit down with the application and answer honestly. Flag anything you couldn’t fix, along with a specific date for fixing it.

Do you run a Tri-Cities business with a renewal coming up? Get in touch with Pacific Edge Technology. We’ll review your cyber insurance application with you and help close the gaps. We’ll also make sure your answers match what’s actually in place.

Cyber Insurance Application FAQs

What does rescission mean on a cyber insurance policy?

Rescission means the carrier voids the policy from the start. It happens when the carrier finds a significant misstatement on your application. The carrier treats the policy as if it never existed, denies the current claim, and can claw back earlier payouts.

Will my cyber insurance be denied if I don’t have MFA on everything?

Not always. More often, you’ll see a big premium increase or lower limits on ransomware coverage. The carrier may also exclude incidents that start at the unprotected entry point. The most common gap is MFA on privileged or service accounts.

What is the difference between EDR and MDR on a cyber insurance application?

EDR (Endpoint Detection and Response) is software that watches device behavior and flags suspicious activity. MDR (Managed Detection and Response) adds a team that monitors alerts and responds 24/7. Carriers increasingly want both, and the application often asks about each one separately.

Why is my cyber insurance application longer than it used to be?

Carriers added detailed sections after major losses in 2023 and 2024. These included the MOVEit supply-chain breach, the Change Healthcare ransomware attack, and the Arup deepfake wire fraud. Each event led to new questions about backups, MFA, vendor risk, or wire transfers.

Can my claim be denied if I answered the application incorrectly?

Yes. A significant misstatement on your cyber insurance application can lead to rescission, which cancels coverage retroactively. In some cases, courts have ruled that the carrier didn’t need to prove the misstatement caused the loss. Your broker can explain how this works under your policy.

What does immutable backup mean on a cyber insurance application?

Nobody can change or delete an immutable backup during its retention period, even with stolen admin credentials. Cloud object lock and write-once storage are common ways to set one up. Most carriers want a window of at least 14 days, and many now prefer 30.

Article used with permission from The Technology Press.