What a Cyber Insurance Renewal Looks Like Now (And Why You’ll Fail Without MFA)

The first cyber insurance application you filled out was a page long. The renewal sitting in front of you is not.

Insurers have spent the last few years paying out on claims they underpriced, and they have responded the way any business would. They tightened the questions. A cyber insurance renewal in 2026 reads less like a form and more like a security audit, and the controls they ask about are no longer suggestions. They are conditions of coverage.

Check a box claiming a control you do not actually have, and you have not secured coverage. You have created a reason for the claim to be denied.

The Questions Got Specific

Older applications asked whether you had antivirus and used firewalls. Current ones ask whether you have:

• Multi-factor authentication on email, remote access, and admin accounts
• Endpoint detection and response, not just traditional antivirus
• Tested, offsite, immutable backups
• A documented incident response plan
• Security awareness training for staff
• Email filtering and authentication

Each of those is a yes-or-no question with a real answer, and the insurer can ask you to prove it after an incident.

MFA Is the One They Will Not Bend On

Of every control on the list, multi-factor authentication is the one insurers treat as non-negotiable, and for good reason. The majority of business email compromise and ransomware intrusions start with a stolen password. MFA is what closes that door even when the password is already in the attacker’s hands.

An insurer will often decline to write the policy at all if MFA is not in place on email and remote access. Not raise the premium. Decline.

The Attestation Problem

Here is where businesses get hurt. The application asks you to attest that these controls are in place. Someone checks the boxes, often without confirming each one is actually true across the whole environment.

Then an incident happens. The insurer investigates, finds that MFA was enabled for some accounts but not the one that got compromised, and points to the attestation. The claim is reduced or denied because the policy was issued based on information that turned out to be wrong.

You were paying premiums the whole time. You just were not actually covered.

What to Do Before You Sign

A renewal is a useful forcing function. Before you attest to anything:

• Confirm MFA is on every email account, not most of them
• Confirm remote access and admin accounts require MFA
• Verify your backups are tested and not reachable from a compromised admin account
• Make sure the person filling out the form actually knows the answers, rather than guessing

Final Thoughts

Cyber insurance is still worth having. The point is not to avoid the questions but to make the answers true before you sign your name to them. The harder truth: getting to yes on every line costs time and sometimes money, and the renewal deadline rarely leaves enough of either. That is exactly why this is worth starting before the form lands.

If you are looking at a renewal and not certain your answers would survive a claim investigation, that is the gap worth closing first.