What Cyber Insurers Are Asking for in 2026

A few years ago, a cyber insurance application was mostly a self-reported questionnaire. That era is over. Carriers now ask for evidence: screenshots, policy documents, configuration exports. Businesses that can't produce it are increasingly seeing non-renewals or sharply reduced coverage, not just a higher quote.

The controls carriers are standardizing around

• Multi-factor authentication enforced for 100% of users, with admin accounts specifically on phishing-resistant MFA, not just “we have MFA turned on somewhere.”
• Separate privileged/admin accounts with just-in-time elevation, rather than daily-use accounts that also carry admin rights.
• Endpoint detection and response (EDR) on every device. Traditional antivirus alone no longer satisfies most applications.
• Email security with Safe Links/Safe Attachments in blocking mode, plus DMARC enforcement on your domain.
• Immutable, offline backups with documented, tested restores, not just a backup job that's assumed to be working.
• A patching cadence: critical vulnerabilities addressed within 14 days, high-severity within 30.
• Centralized log retention of at least 12 months with active monitoring, not logs sitting unreviewed on individual devices.
• Network segmentation separating admin access from general user traffic.
• A documented incident response plan, tested via a tabletop exercise at least annually.
• Annual security awareness training with quarterly phishing simulations.

What's at stake

The gap between businesses that can show these controls and those that can't is showing up directly in premiums and coverage. One documented case involved a business that fixed four specific gaps in its control set before renewal and saw only a 4% premium increase year-over-year. A comparable business that couldn't demonstrate the same controls was non-renewed outright. Its replacement coverage cost 47% more, with reduced ransomware sub-limits on top of the higher price.

Where this usually goes wrong

It's rarely one glaring gap. It's more often a handful of controls that were “mostly” in place: MFA everywhere except one legacy system, backups that run nightly but haven't had a real restore test in over a year, an incident response plan that exists as a document nobody's walked through. Insurers increasingly ask for proof, and “mostly” doesn't hold up to a documentation request.

This is a large part of what our Compliance & Insurance Readiness work covers: going through your environment against what carriers are asking for now, before that gap shows up on a renewal application instead of in a conversation with us first.