Most business owners treat cyber insurance like the fire extinguisher on the wall. It’s there. It’s paid for. If something goes wrong, it works.
That assumption is where the money gets lost.
Cyber liability policies aren’t like general liability. They’re conditional contracts. Almost every one of them requires you to maintain specific security controls the whole time the policy is active, not just on the day you signed the application. When a claim comes in, the carrier sends in a forensics team. The first thing they figure out isn’t how the attacker got in. It’s whether you were actually doing what you said you were doing.
If the answer is no, the claim gets cut down or denied. You paid premiums for years and now you’re covering the incident yourself.
The application is a legal document, not a form
Here’s how it usually falls apart.
An owner fills out a cyber insurance application in twenty minutes. One checkbox says something like “Multi-factor authentication is enforced on all remote access and privileged accounts.” He knows MFA is on for email. Checks the box. Moves on.
A year and a half later, an attacker gets in through a VPN account that never had MFA. It was a service account nobody remembered, set up by a vendor back in 2019. Ransomware locks the file server. The claim goes in for $400,000.
The forensics report names the entry point. The carrier pulls the application. The checkbox says MFA was enforced on all remote access. It wasn’t. Now nobody’s talking about coverage anymore. They’re talking about whether you misrepresented your business to get the policy.
That’s not a technology failure. It’s a paperwork failure with a technology cause, and it happens more than owners want to believe.
The four gaps carriers find most often
The same handful of controls get checked off and then quietly fall out of compliance.
Incomplete MFA. MFA on Microsoft 365 isn’t MFA on your environment. Remote desktop, VPN, firewall admin panels, backup consoles, and vendor accounts all count. Attackers know which one you forgot.
Backups nobody ever tested. Nearly every policy requires backups. Very few owners have ever run a restore. “The backup job shows green” and “we restored a server and it booted” are two different things. Attackers go after backup repositories first, because they know the difference even if you don’t.
Endpoint detection that’s really just antivirus. Applications ask about EDR. Legacy antivirus isn’t EDR. One matches signatures, the other watches behavior. If you checked the EDR box while running consumer-grade AV, the forensics report will say so.
Training that quietly stopped. Most policies require ongoing security awareness training. One all-hands session in 2023 doesn’t count as ongoing. Carriers ask for records. No records, no training.
None of this is exotic. All of it is fixable, but only before the incident.
Why mid-size companies get hit hardest
There’s a specific profile that falls into this gap. Big enough to have real data and real revenue. Not big enough to have a full-time security person.
Fifteen to two hundred employees. An IT provider running helpdesk and infrastructure. An insurance agent who sold a cyber policy as an add-on. Neither one is responsible for making sure the other one’s requirements are being met, because nobody ever assigned that job.
Your IT provider isn’t reading your policy. Your agent isn’t auditing your environment. And you’re assuming that between the two of them, somebody is.
Firms that work this problem directly, like the team at ABT Solutions who provide cybersecurity services in Oklahoma, tend to start with the liability conversation instead of the technology one. The tooling question comes second. The first question is what you already promised in writing, and whether it’s still true.
The audit you can run this week
You don’t need a consultant to start. You need an afternoon.
- Find your policy. The real document, not the certificate. Then find your original application.
- Read the conditions and exclusions. Write down every control you attested to or that’s required for coverage to kick in.
- Verify each one yourself. Don’t ask “do we have MFA?” Ask your IT provider for a list of every account with remote access and its MFA status. Have them restore a file from backup while you watch.
- Write down the gaps. Anything you can’t verify is a gap. Unverified and absent look the same to a carrier reviewing a claim.
- Close them or amend the policy. Both are fine. Leaving a known misstatement in place is not.
That last one is where owners freeze. If you find out you attested to something untrue, hoping nobody checks isn’t a plan. Carriers are running pre-binding scans and mid-term compliance reviews more and more. Fixing the record before a claim is a business decision. Fixing it after is a legal problem.
The part nobody wants to hear
Cyber insurance isn’t protection. It’s a financial product that pays out when you can prove you did the work.
The premium buys you a contract. The controls buy you the claim. Most businesses are paying for the first and assuming they got the second.
Go read your policy. It takes an hour, and it’s the best hour you’ll spend on security this year.
People also read this: The Boring Infrastructure Question Every Entrepreneur Should Be Asking
