If you have a cyber insurance renewal coming up, the application is probably longer than the one you filled out last year. It’s also more specific.
Each new question maps to a control that, if missing, allowed a major 2023 or 2024 claim to escalate. How you answer matters more than it used to — and for businesses across Laurel, Hattiesburg, and the wider Pine Belt, the stakes are real: a denied claim can mean absorbing the full cost of an incident yourself.
This post covers why the form got longer, what each new section is asking, how to answer honestly without overstating your controls, and what to fix in the 30 days before you submit.
The expensive mistake on a cyber insurance application is rescission — where a future claim is denied because the carrier finds that the controls you declared were not in place.
Why the renewal application got longer
The current generation of cyber applications was shaped by three claim events from 2023 and 2024.
MOVEit (2023). The Cl0p group exploited a vulnerability in Progress Software’s MOVEit Transfer tool. By late 2023, thousands of organizations and tens of millions of individuals were affected. Carriers paid across that footprint — and underwriters tightened questions about third-party software risk.
Change Healthcare (February 2024). Network access on February 12 led to ransomware on February 21, freezing U.S. healthcare claims processing for weeks. Industry estimates put the cyber insurance loss above $250 million. The response: tighter questions about backup immutability and incident-response readiness — and renewed focus on multifactor authentication at key entry points.
Arup deepfake wire fraud (early 2024). A finance employee transferred about $25.6 million after a video call with what appeared to be executives — all AI-generated deepfakes. Out-of-band callback verification for wire transfers is now on every underwriter’s checklist.
If you handle cardholder data, PHI, client funds, or escrow — think healthcare practices, CPAs, law firms, and real estate brokerages common across Mississippi — your application is usually the longest. You sit in the loss categories carriers got burned on.
The backup question changed
What used to be a single yes/no about backups now asks whether those backups are immutable or air-gapped, when they were last tested, and whether they can be deleted with domain administrator credentials.
Expect wording like: “Are backups stored in an immutable or air-gapped state, tested for restoration within the past 12 months, and inaccessible to domain administrator credentials?”
- Immutable means nobody can delete or alter the backup during a fixed retention window — including someone using stolen admin credentials.
- Air-gapped means the copy sits on infrastructure that cannot be reached from your production network.
CISA’s Stop Ransomware guidance lists immutable, tested backups as a baseline control. Most carriers now apply the same standard.
“We use Microsoft 365 backup” is no longer a passing answer on its own. Native Microsoft 365 retention is not a backup in the sense the carrier means. Third-party backups that share the same identity perimeter as your production tenant can still be wiped by a compromised global admin.
Strong answer: a platform with object lock or write-once-read-many storage enabled, an immutability window of at least 14 days (30 days increasingly preferred), credentials separated from production admins, and a recent successful restore test with date and evidence.
Weak answer: daily backups to a NAS on the same network with no recent restore test — that usually triggers follow-up underwriting and sometimes a premium adjustment.
At West Computers, we deploy isolated cloud backup and disaster recovery with vaulted copies that ransomware can’t reach — and we test restores. A backup you’ve never tested is just a hope on an insurance form.
MFA questions go deeper than one checkbox
MFA was once a single yes/no. Current applications ask whether MFA is enforced on:
- VPN
- Remote desktop (RDP)
- All administrator accounts
- Privileged service accounts
You generally need yes on all five for a clean pass.
SMS-based MFA is treated as a weaker control. SIM-swap and related attacks have made text codes the weakest common factor. Several carriers ask whether you use an authenticator app, hardware token, or push with number matching instead of SMS. If admin accounts are still on SMS, expect follow-up or a premium adjustment.
You may also see a privileged access management (PAM) question. PAM tools vault admin credentials, rotate them on use, and log sessions — so a stolen admin password can’t be used unnoticed for weeks.
Will coverage be denied if you don’t have MFA everywhere? Not always outright. Expect premium increases, ransomware sub-limits, or exclusions for incidents that trace back to the unprotected entry point.
Wire transfer and deepfake verification
After Arup and a string of business email compromise losses, carriers added callback verification questions.
Callback verification means: before sending any wire above a defined threshold (often $10,000 or $25,000), the person authorizing the transfer calls the recipient at a phone number previously verified and stored — not the number on the request email.
Expect wording like: “Does your organization require out-of-band verification using a previously known phone number for all funds transfer requests above [threshold], including requests appearing to come from executives?”
Several applications now ask separately whether staff have been trained on AI voice cloning and deepfake video risks.
Strong answer: a written wire-transfer policy requiring callback to a verified number above a stated threshold, dual approval, and annual social-engineering training that includes deepfake awareness.
Weak / declined configurations: informal “we usually call” with no written policy, or wires authorized by email approval alone.
EDR, MDR, and the end of “we have antivirus”
Traditional antivirus matches known threats. EDR watches behavior on each device and flags suspicious activity (for example, a process trying to encrypt files). MDR is EDR plus a 24/7 team watching alerts and responding — including at 2 a.m. on a Sunday.
Applications increasingly ask whether EDR covers 100% of endpoints including servers, and whether a SOC monitors and responds around the clock. The MDR question is often yes/no — and “no” has pricing consequences.
If you don’t have MDR yet but plan to add it, say so with a timeline. Underwriters can work with “MDR deployment scheduled for Q3 with vendor selected.” They cannot work with vague future plans.
Our 24/7 MXDR service is built for exactly this gap: detection and response that doesn’t stop when the office closes — which is also how many Mississippi SMBs prefer to answer the MDR line on the form.
Vendor risk questions
After MOVEit and Change Healthcare, carriers want more than a yes/no on supply chain. Expect: list your top five software vendors with access to sensitive data, and confirm whether each provides a SOC 2 Type II report or equivalent.
You’re not expected to audit every vendor’s entire program. Carriers want to see that you know who holds your data and that you’ve asked basic attestation questions. An honest “we’ve identified our top five and requested SOC 2 from three; two are outstanding” reads better than a confident answer that falls apart in discovery.
The mistake to avoid: misrepresentation and rescission
Cyber insurance applications are warranty documents. If forensics after a claim find your environment didn’t match what you declared, the carrier can rescind the policy.
Rescission treats the policy as if it never existed: the claim is denied, and prior payouts under the same term can sometimes be clawed back. Some courts have found the carrier doesn’t need to prove a direct link between the misrepresentation and the loss.
Cleanup approach: if a question asks about MFA on all admin accounts and you have a gap, declare the gap and include a remediation date. Carriers reward honest gaps with a plan more than polished answers that don’t survive forensic review.
Checking “no” or “in progress” may raise premium or tighten terms. That cost is predictable. Misrepresentation discovered after a claim can void the policy entirely.
The 30-day pre-renewal checklist
Work through this in order. Most items are achievable in a month if you start now.
Week 1. Confirm MFA on email, VPN, RDP, all administrator accounts, and any service accounts that support it. Move admin MFA off SMS to an authenticator app or hardware token.
Weeks 1–2. Verify backups are immutable or air-gapped. Run a test restore; document date and screenshots.
Week 2. Write a one-page wire-transfer policy requiring callback verification to a previously verified phone number above your threshold. Get it signed by anyone who can authorize payments.
Weeks 2–3. Confirm EDR on every endpoint and server. If you only have traditional antivirus, get EDR/MDR quotes so you can answer with a deployment timeline.
Week 3. Identify your top five software vendors and request SOC 2 (or equivalent). Note who responded.
Weeks 3–4. Document or update your incident response plan; run a 60-minute tabletop with leadership. Keep the notes — that’s your “tested in the past 12 months” evidence.
Week 4. Sit down with the application and answer honestly. Flag anything you couldn’t fix, with a specific remediation date.
Frequently asked questions
What does rescission mean on a cyber insurance policy?
Rescission means the carrier voids the policy from inception after discovering material misrepresentation. The policy is treated as if it never existed, the current claim is denied, and prior payouts under the same term can be clawed back.
Will my cyber insurance be denied if I don’t have MFA on everything?
Not always outright. Expect a significant premium increase, ransomware sub-limits, or exclusions for incidents that trace to the unprotected entry point. A common gap is MFA on privileged or service accounts.
What’s the difference between EDR and MDR on an insurance application?
EDR is the technology that watches device behavior and flags suspicious activity. MDR is that technology plus a 24/7 team watching and responding. Carriers increasingly want both and often ask about each separately.
Why are cyber insurance renewal applications longer than they used to be?
Carriers added detailed sections after specific 2023–2024 losses — including MOVEit, Change Healthcare, and the Arup deepfake wire fraud. Those events drove changes to backup, MFA, vendor risk, and wire-transfer questions.
Can my claim be denied if I answered the application incorrectly?
Yes. Material misrepresentation can trigger rescission and void coverage retroactively. Many courts have found the carrier does not need to prove a causal link between the misrepresentation and the specific loss.
What does immutable backup mean on a cyber insurance application?
A backup that cannot be modified or deleted for a defined retention period, even by someone using stolen administrator credentials. Cloud object lock and write-once-read-many storage are common implementations. Most carriers want at least 14 days; 30 days is increasingly preferred.
Article adapted with permission from The Technology Press.