April 2022. An electronics manufacturer in Decatur, Illinois buys a cyber policy from Travelers. About 150 employees. $1 million in coverage.
1 question on the application matters more than the rest. It asks whether the company requires multi-factor authentication for administrative or privileged access. The company answers yes, and a separate MFA attestation goes in with the application. The CEO signs, along with a person responsible for network and information security.
The next month, ransomware.
The company files a claim. Travelers’ investigators find what, according to Travelers, the paperwork never said... MFA protected the firewall and nothing else. The attack had gone after servers with no MFA.
Travelers sued on July 6. On August 30, 2022, both sides agreed to an order rescinding the policy and declaring it void from inception.
Void from inception. In practice, the policy never existed.
The thing... That was 2022, the hard market, and you might assume it’s history. The market has moved. The trapdoor hasn’t.
Insurers aren’t getting stricter. The market is getting softer, and that’s the trap.
Marsh’s Global Insurance Market Index, released July 23, 2026, put global cyber insurance rates down 4% in the second quarter, the twelfth consecutive quarter of declines. Marsh says US cyber rates have been falling since the second quarter of 2023. The pace of the cuts has slowed, moving toward more stable pricing. One caveat from the people who reported it: Marsh’s index skews toward larger accounts, so your own quote may not look like the headline.
Cheap. Competitive. Easy to say yes to. And honestly, that’s the danger. When cover is easy to buy, the application starts to feel like a formality.
It isn’t. Back in 2022, coverage lawyer Scott Godes of Barnes & Thornburg said the hard market had emboldened carriers to use the nuclear option of rescinding coverage. Rules differ by state, and I’m not a lawyer, so take the legal question to one. But the principle holds. Your answers are statements of fact, and the insurer gets to test them at the worst possible moment... after the loss.
The questionnaire, decoded: what each question is really testing
Today the application runs to dozens of pages. Carriers word things differently, but the technical content is consistent. Here’s what each block is really testing, and the evidence you should be able to produce. If you can’t produce it, don’t say yes.
MFA... The question isn’t “do you have it.” It’s where. Underwriters look for MFA on remote, email and admin access. Evidence: an enforcement policy export, plus a list of accounts not covered. The target for that list is zero. Partial MFA is the ICS story.
EDR on every endpoint and server... That includes the server running the old finance application nobody wants to touch. Evidence: the EDR console’s coverage report, compared against your asset inventory.
Backups... Immutable and restore-tested. Evidence: your last restore log. A job that runs nightly is not a tested backup.
Incident response plan... A documented plan that has been run through a tabletop exercise. Evidence: the signed plan and the last tabletop report.
Email authentication... SPF, DKIM and DMARC, with DMARC set to reject. Evidence- your public DNS records. Anyone can check them, including the carrier.
Privileged access, patching, vendors... Privileged access management, patch management with SLAs, and vendor risk management complete the first eight controls underwriters check. Evidence: access reviews, patch reports, a vendor list.
Payment verification... An analysis of published carrier forms says Corvus asks whether you confirm bank-detail changes with the requester over a separate channel before sending money. Evidence: a written procedure. This one isn’t a tool. It’s a phone call.
Exposed services... The same analysis says Beazley asks directly whether RDP or remote-access tools are exposed to the internet. Evidence: an outside view of your own network.
Then they check you from the outside
Wait — the questionnaire isn’t the only input. Security analysts reviewing the published carrier forms note that the underwriter may see your external exposure before reading a single answer. Gallagher Re, the reinsurance broker, studied this. It found external scanning data is particularly good at flagging the worst 20% of risks, which were materially more likely to suffer a claim, and that it shows whether insureds apply their security policies in practice.
Read the last part again. In practice. The scan doesn’t care what you wrote.
If you want your answers checked against what an outside scan sees before an underwriter does it for you, that’s a pre-submission review-www.snippipedia.com/contact
What you’re actually insuring against (it’s mostly not ransomware)
Coalition’s 2026 Cyber Claims Report, drawn from more than 100,000 policyholders and published in March 2026, found business email compromise and funds transfer fraud made up 58% of claims in 2025. Ransomware was about one claim in five. It was the costliest type, averaging $269,000, and initial ransom demands rose 47%. Seventy percent of ransomware claims involved double extortion, encryption plus stolen data.
Hmm. Now look at the questionnaire again. Coalition also found that 52% of funds-transfer fraud claims began as business email compromise. So the most boring lines on the form, MFA on email and a callback before money moves, sit underneath the most common claims. I’d rank your fixes by that, not by what scares you most.
Your biggest risk probably isn’t a movie hacker. It’s a convincing email and a hurried finance lead.
The 2026 change nobody put on your questionnaire... AI exclusions
This is the genuinely new part, and it isn’t about your cyber policy. Since January 1, 2026, Verisk’s ISO has circulated three generative-AI exclusion endorsements for commercial general liability policies, forms CG 40 47, CG 40 48 and CG 35 08, and carriers have been filing to adopt them with state regulators. Berkley went further, introducing an absolute AI exclusion across its D&O, E&O and fiduciary liability products. AIG told the Illinois regulator it had no plans to implement its exclusions immediately, and exclusions take effect at renewal.
2 honest caveats. The Cloud Security Alliance’s reading is that the three ISO forms are narrower than their wide adoption suggests. They are also optional endorsements, not automatic. And what I could verify concerns liability lines, not cyber forms, so read your cyber policy for itself rather than assuming either way.
What to do: ask your broker to list every endorsement on every policy that mentions artificial intelligence or generative AI. Look for form numbers starting with CG 40, and carrier-specific forms such as Berkley’s PC 51380. Then ask where a claim arising from your own AI feature, a chatbot or an agent, would land. If the answer is “I’m not sure,” that’s the gap. Our piece on how those features get attacked is at /articles/prompt-vs-sql-injection
Before you sign or renew: 5 moves
Let the person who runs the controls answer, and make the person who signs read every answer...Brokers warn that executives filling out the form may not be the people most familiar with the organization’s MFA practices, and misunderstandings follow.
Attach evidence to every yes... EDR coverage reports, MFA enforcement policies, backup restore logs. A yes with no evidence is a maybe.
Fix first, then attest... An incident you disclosed and fixed is an underwriting conversation, while one the carrier discovers later becomes a rescission argument. I’d apply the same logic to gaps.
Test from the outside... Carriers ask about penetration testing, and the answer feeds underwriting. Some want a test completed within the last 12 months. The forms treat an internal vulnerability scan and a penetration test as different controls, so answer them separately. Check your own public IPs for exposed remote access while you’re at it.
Start 90 days out... Begin about 90 days before the renewal date and reconcile every answer with evidence.
The one thing to take away
A cyber policy is only as good as the proof behind your answers on the day you sign.
Waiting costs more than acting. Rates are soft, the forms feel friendly, and nothing in that environment warns you that the check comes after the loss. By then the scan, the forensics and your own signature are all on the table, and you can’t change any of them.
If you want someone to run your answers against what an outside view of your business shows, send the technical section of your application or renewal questionnaire through www.snippipedia.com/contact and we’ll scope a pre-submission evidence review around it. Strip the financials first.
This is security guidance, not legal or insurance advice. Ask your broker and a coverage lawyer how rescission works in your state.