Cyber insurance pays out on the answers you gave. Make sure they’re true.

I like cyber insurance. I’ll say that first, because the rest of this might sound as if I don’t. A good policy puts specialists on the phone within the hour and pays for a recovery that could otherwise sink a business. But over the years I’ve come to think most businesses misunderstand what they’ve bought. Cyber insurance doesn’t pay out because you had an attack. It pays out because you had an attack and the things you told the insurer were true.

The claims are real, and they’re growing

This is no longer a niche product. The Association of British Insurers says its members paid out £197 million in cyber claims to UK businesses in 2024, up from £59 million the year before. That’s a rise of 230% in one year. Malware and ransomware made up just over half of those claims.

So policies do pay, and in large amounts. I’d much rather a business had cover than didn’t. A serious incident brings forensic investigators, legal advice, customer notifications, lost trading days and sometimes replacement equipment. Very few businesses have that sort of money sitting idle.

But insurers who are paying out three times what they paid a year earlier look much harder at every claim. And the first thing they look at is the form you filled in when you bought the policy.

The form is a security audit you mark yourself

Think back to the proposal form. It probably asked whether you use multi-factor authentication for email and remote access. Whether you keep backups offline or separate from the network. Whether you install critical updates within a set number of days. Whether staff receive security training. Whether any software in use is no longer supported.

Those are good questions. They’re close to what I’d ask on a first visit. The difficulty is who answers them and how. Very often the form lands on the desk of whoever handles the insurance renewal, in the same week as the buildings cover and the vehicle fleet. They ask the IT person “we’ve got MFA, haven’t we?” and hear “yes, on email”. The box says “Yes”.

Under the Insurance Act 2015, a business buying insurance has a duty to make a fair presentation of the risk. In plain terms, you have to tell the insurer what you know, or ought to know, accurately. If you get it wrong, what happens next depends on how wrong and why. An insurer can reduce a claim in proportion, apply terms it would have insisted on, or in the worst cases treat the policy as if it never existed.

The proposal form is the most important security document many businesses ever sign, and it’s usually filled in by someone guessing.

Ashley Adkins, fromIT

What happens when the answer was wrong

Two cases from across the Atlantic show how this plays out, and although the law differs, the principle travels.

In 2022 the insurer Travelers went to court in Illinois over a policy held by an electronics manufacturer. The company had stated on its application that it used multi-factor authentication to protect its systems. After a ransomware attack, the insurer found it was only in place on the firewall and not on the servers that were hit. The case ended with both sides agreeing the policy was void. No cover at all.

In 2024 the City of Hamilton in Ontario suffered a ransomware attack that knocked out most of its systems. The following year the city confirmed its insurer had refused the claim because multi-factor authentication hadn’t been fully rolled out when the attack happened. The bill, reported at around 18 million Canadian dollars, fell on the taxpayer.

I can’t tell you what anyone was thinking in either case. I can tell you how easily it happens. Somebody believes a control is in place across the board when it covers only part of the estate. That’s the most ordinary mistake in IT, and it’s exactly the one a claims investigator is trained to find.

The conditions nobody reads until the day

The proposal form is one half. The policy wording is the other, and it usually contains conditions that apply during an incident. These are the ones I’d look for:

• Tell the insurer first. Many policies require you to notify them promptly and to use their approved incident response firms. If you bring in your own people and start rebuilding before you call, some of those costs may not be covered.
• Don’t admit liability or agree to pay anyone without consent. That includes ransom demands and promises to customers.
• Keep the security you declared. Some policies make certain controls a condition of cover for the whole term, so switching something off in March matters as much as what you said in January.
• Exclusions. Look for wording on unsupported software, on attacks attributed to a state, on fraud where a member of staff was tricked into sending money, and on fines.

None of this is hidden. It’s in the document. But I’ve met very few business owners who have read their cyber policy before the day they needed it, and that’s the worst day to be learning what it says.

Insurance is the last line

There’s also a limit to what any policy can do. It can pay for specialists, for lost income within its terms and for the cost of telling people. It can’t give you back the customer who went elsewhere while you were offline. It can’t undo the publication of your files. It can’t return the month your senior people spent doing nothing else.

I sometimes hear “we’re insured” used as a reason to skip the basics. That gets it backwards, and insurers now price it that way. The controls on the form are the same ones that stop most attacks. Do them properly and you’re less likely to claim, more likely to be paid if you do, and often cheaper to insure. It’s worth knowing that Cyber Essentials certification comes with cyber insurance included for most UK organisations with a turnover under £20 million, which tells you how insurers rate those five controls.

What I’d do before the next renewal

1. Answer the form with your IT person in the room. Go question by question and replace “I think so” with something you’ve checked. Where the honest answer is “partly”, write “partly” and explain.
2. Keep the evidence. A screenshot of the multi-factor settings, the date of the last restore test, a list of devices and their update status. Put it in a folder with the policy.
3. Read the conditions. Twenty minutes with a highlighter. Mark anything that tells you what you must do, or mustn’t do, during an incident.
4. Put the claims number in your incident plan. On paper and in your phone. If your systems are locked, you won’t be able to look it up.
5. Tell your insurer when things change. A new system, a new office, a control you’ve had to switch off. A short email now is better than an argument later.
6. Ask your broker the awkward question. “If we had ransomware tomorrow, what in our answers could cause you a problem?” A good broker will go through it with you.

If a control on the form turns out not to be in place, that’s good news of a sort. You’ve found it before an attacker or a loss adjuster did. Fix it, tell the insurer, and test the backups while you’re at it.

Buy the insurance. Then make sure every answer on that form is true on the day you sign it and still true six months later. A policy bought on a guess is an expensive piece of paper.