By Kaitlyn Callahan, MBA, MHA
A business gets hit with ransomware. The owner doesn’t panic. They bought cyber insurance for exactly this moment. They file the claim.
Then the questions start. Was multi-factor authentication actually enforced? Were backups protected and tested? Can anyone produce records showing which security controls were running when the attack hit?
Imagine that review ending in a denial or a coverage dispute because the business’s security practices did not match what it represented on its application. The attack was real. The premium was paid. The evidence was missing.
That is the risk worth addressing before renewal. Missing documentation does not automatically invalidate a policy: coverage depends on the policy’s terms, the application, the facts of the claim, and applicable law. But being unable to substantiate your answers can make a bad day much harder.
The questionnaire era isn’t enough
Check a box. Sign the application. Pay the premium. It is tempting to treat cyber insurance renewal as an administrative task. But a “yes” on a form should describe a control that works today, across the systems the question actually covers.
MFA enabled on paper but bypassed on remote access. Backups that run every night but have never been restored. An incident response plan nobody has opened since it was written. Those are gaps between an answer and reality.
Questionnaires still exist. Travelers, for example, provides a CyberRisk application and a separate MFA supplement. The practical lesson: read the exact questions with your IT team and broker, and keep evidence behind every answer.
Screenshots. Configuration exports. Backup restore logs. A response plan someone has walked through. The question your team should be ready to answer is simple: Can we prove it?
Why this matters now
Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of the breaches it reviewed, up from 32% the year before. Among breaches involving small and medium-sized businesses, the figure was 88%, compared with 39% at larger organizations. These are shares of reported breaches—not the percentage of all businesses that suffered an attack.
Coalition’s 2026 Cyber Claims Report, covering its 2025 claims experience, found initial ransom demands rose 47%, averaging more than $1 million. Seventy percent of ransomware events involved both encryption and data theft, while 86% of businesses hit by ransomware refused to pay the demand.
Those findings describe Coalition’s experience, not every insurer’s book of business. They also do not establish that businesses refusing a ransom are guaranteed an insurance payout. What they reinforce is the value of preparing before an attack.
Working backups can help restore operations. They cannot undo stolen data. You need both recovery capability and a practiced response.
What carriers want to see—and what to keep
Requirements vary by carrier, policy, and business. Use these four areas to start a review against your actual application and policy, rather than treating any generic checklist as a coverage guarantee.
Buying a security product is only the beginning. Someone has to confirm that it covers the right systems, stays active, and produces records you can retrieve.
Build your evidence file before renewal
- Start with the actual application. Match each answer to a control owner and supporting evidence. Clarify ambiguous wording with your broker before signing.
- Close the gaps. Compare enrolled users and protected devices with your full inventory. Document exceptions honestly.
- Test recovery. Restore important data and systems, record the result, and fix anything that prevents a usable recovery.
- Rehearse the first day of an incident. Confirm who contacts the insurer, who can authorize action, and which notification or consent requirements apply.
- Keep a history. Date evidence, retain change records, and agree on retention periods with the people responsible for your policy and security program. A screenshot from renewal day alone cannot show what happened months later.
- Protect the evidence. Store it securely with restricted access and a recovery path if your primary systems are unavailable. Never include passwords, recovery codes, or other secrets in an evidence pack.
The real cost isn’t the premium
Some might call this a pricing problem: pass the checklist, get a better rate. While pricing matters, the bigger risk is discovering mid-crisis that your application answers, your actual security practices, and your records do not line up.
That can mean delays, disputes, or an unexpected gap in coverage while your team is already dealing with downtime and recovery costs.
It is much easier to fix before a breach than while one is underway. If your carrier asked tomorrow, what could your business document?
The best time to prove your security controls work is before you need your cyber policy to.
Know before the renewal notice does
Solved IT will run a free audit of four core areas: MFA, backups, incident response, and endpoint monitoring. Bring your carrier’s questionnaire so we can help compare its technical questions with what your business can actually document.
You’ll walk away with a clear list of gaps and practical next steps. Our cybersecurity and compliance services can help you put the controls and supporting records in place. Your broker or insurer should confirm how the findings relate to your coverage.
