Cyber Insurance Underwriting: Controls That Get You Approved

TL;DR: This guide on Cyber insurance underwriting covers what changes in 2026, the controls that actually work, and the checklist you can hand to your team this week.

Cyber insurance got cheaper in 2025 — but only for organizations that meet a tightening list of underwriting controls. The questionnaire that used to be ten boxes is now a seventy-line technical interview. Here is what underwriters actually want.

The five controls that matter most

• Phishing-resistant MFA on email, VPN, and admin consoles. Number-matching push is acceptable; SMS no longer counts.
• Endpoint detection and response (EDR) on every server and workstation. Antivirus alone is rejected.
• Tested, immutable backups. Backups that are encrypted, off-network, and verified by restoration drills within the last 90 days.
• Privileged access management. Separate admin accounts, just-in-time elevation, audit logging.
• Documented incident response plan with named roles, contact lists, and a most-recent tabletop date.

The "soft" requirements that decide premiums

• Email security gateway with link rewriting and attachment sandboxing.
• Vulnerability scanning frequency (monthly or better).
• Patch management SLA, especially for internet-facing systems.
• Employee security training cadence (quarterly is the floor).
• Vendor risk management program.

Why claims get denied

The most common denial reason in 2025 was "control attestation did not match incident reality." If you said you had EDR and the attacker walked in through an unprotected server, the insurer voids the policy. Treat the questionnaire as a contract, not a survey.

How to prepare before renewal

• Get the questionnaire 90 days before renewal. Walk through every line.
• For every "yes," make sure you can produce evidence within an hour.
• For every "no," scope the gap and decide whether to remediate or document the compensating control.
• Have your broker review responses before submission. Word choice matters legally.

What an insurance-aligned program looks like

Insurers and good security programs want the same things; the insurer just measures them more bluntly. Build the program for actual risk reduction; the questionnaire becomes paperwork. Our cybersecurity engagements include underwriting-questionnaire walkthroughs and remediation planning aligned to the controls insurers actually verify.

Cyber Insurance Underwriting: where to start this week

If you are just starting on cyber insurance underwriting, pick one application or one business unit and run the playbook above end-to-end. A focused cyber insurance underwriting pilot beats a sprawling rollout every time — and the artefacts you produce (asset inventory, threat model, remediation tracker) seed every future engagement.

Further reading

• Vexta — vulnerability scanning & pentest platform
• more from our security blog
• OWASP Top 10
• NIST Cybersecurity Framework

Key takeaways on cyber insurance underwriting

• Threat model first. Map the assets in scope for cyber insurance underwriting, the attackers who would target them, and the controls already in place — before buying any tool.
• Detection beats prevention alone. Pair every preventive control with telemetry; assume one layer of cyber insurance underwriting defence will fail and design for visibility on the second.
• Document the decisions, not just the configs. Auditors and incoming team members read the why, not the YAML. A short cyber insurance underwriting architecture brief saves dozens of hours later.
• Test against real adversary patterns. Tabletop exercises and red-team drills tell you whether the cyber insurance underwriting plan survives contact with reality.
• Iterate quarterly. Reassess the cyber insurance underwriting posture every quarter; the threat surface changes faster than annual reviews can keep up with.

Cyber insurance underwriting: frequently asked questions

What is the fastest first step in cyber insurance underwriting?

Inventory. Until you know what is in scope, every other cyber insurance underwriting decision is theoretical. A two-day inventory exercise typically uncovers more risk than a quarter of policy work.

How much should a small team spend on cyber insurance underwriting each year?

Plan for 5–10% of IT budget on cyber insurance underwriting controls and an additional 2–3% on assurance (audits, pentests, training). Mid-market teams often under-spend on assurance and over-spend on tooling.

Who owns cyber insurance underwriting when there is no CISO?

The CTO or VP Engineering — accountability without ambiguity. Bring in a fractional CISO when cyber insurance underwriting obligations cross regulatory boundaries (DPDP, HIPAA, PCI, RBI).

How do we measure whether cyber insurance underwriting is working?

Three numbers: mean time to detect, mean time to recover, and the count of unpatched critical-severity vulnerabilities older than 30 days. Trend matters more than absolute value.