,

6 Tips for Meeting Cyber Insurance Requirements in 2026

Brandon Long
Updated
cyber insurance

Short answer: Cyber insurers now expect six controls before they offer or renew coverage: multi-factor authentication with tight control of admin accounts, monitored endpoint detection and response, fast patching and hardened remote access, offline or immutable backups that are restore-tested, a rehearsed incident response plan, and ongoing security training. Inaccurate application answers can void a policy.

Cyber insurers no longer accept a simple yes on security. Applications now ask how far each control reaches: which logins require multi-factor authentication, what share of devices run endpoint detection, how fast critical patches go in and how often backups are restored in a test. A ransomware supplement from AXIS asks all of these questions, and one from Admiral asks most of them.

Claims data explains the focus. In At-Bay’s 2026 InsurSec Report, remote access services were the entry point for 87% of ransomware claims in 2025. Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches began with an exploited vulnerability, and in Coalition’s 2026 Cyber Claims Report email compromise and funds transfer fraud made up 58% of claims. The original five tips still hold, but insurers now probe privileged access and backups just as closely, so the list has six.

1. Enforce multi-factor authentication (MFA) and lock down admin accounts

The AXIS application asks whether MFA covers remote access, critical data and vendor access, which second factor is used, whether a privileged access management (PAM) tool is in place and how many accounts hold domain admin rights. CISA’s phishing-resistant MFA fact sheet calls FIDO/WebAuthn and PKI-based methods the gold standard and warns that SMS codes and push prompts can be phished or bypassed. Marsh’s analysis of claims and self-assessment data found PAM among the five controls most strongly linked to fewer incidents, yet one of the least implemented.

Key steps:

  • Require MFA on email, VPN and other remote access, cloud admin consoles, backup systems and vendor access, with no exemptions.
  • Move administrators to phishing-resistant methods such as security keys or passkeys first.
  • Separate admin accounts from everyday accounts and remove local admin rights from workstations.

2. Run endpoint detection and response (EDR) everywhere, with 24/7 monitoring

Marsh says insurers expect EDR across servers and laptops as a minimum, and applications ask what share of endpoints and servers it covers. The tool alone is not enough: At-Bay reports that 60% of Akira ransomware victims had a leading EDR product and were still compromised, while no At-Bay managed detection and response (MDR) customer filed an Akira claim in 2025.

Key steps:

  • Deploy EDR on every workstation and server, with automatic blocking turned on.
  • Back it with round-the-clock monitoring from an internal security team or an MDR provider.

3. Scan for vulnerabilities, patch fast and harden remote access

Insurers still expect regular vulnerability scanning, but they now ask about speed. The AXIS application asks for a critical patch target, in bands from under 24 hours to more than seven days, and whether end-of-life software or internet-facing Remote Desktop Protocol (RDP) is present. Exploited vulnerabilities were the top root cause of ransomware for the third year running in Sophos’s State of Ransomware 2025. At-Bay advises replacing on-premise VPN appliances with cloud-based remote access or, until then, fully patching them and enforcing MFA on VPN logins.

Key steps:

4. Keep offline or immutable backups and test restores

Downtime drives the cost of ransomware: At-Bay found that claims with business interruption averaged $510,000, against $168,000 without. Applications ask whether backups are offline, immutable and protected by MFA and separate credentials, and how often a full restore is tested. The CISA #StopRansomware Guide recommends offline, encrypted backups of critical data with regular integrity tests.

Key steps:

  • Keep at least one copy of critical data offline or immutable, separated from the main network.
  • Run full restore tests on a schedule and record the results against your recovery time objectives.

5. Write and rehearse a formal incident response plan (IRP)

The Admiral application asks directly whether the incident response plan covers business continuity during a ransomware attack. CISA recommends exercising the plan regularly, having the chief executive approve it in writing and keeping an offline copy. The plan should also cover payment fraud: At-Bay reports that when it was notified within three days, policyholders recovered some funds 70% of the time.

Key steps:

  • Include ransomware and funds-transfer-fraud playbooks, plus the insurer’s breach hotline.
  • Run a tabletop exercise at least once a year and update the plan afterward.

6. Make security awareness training continuous, with phishing tests

Coalition found that 71% of funds transfer fraud claims resulted directly from social engineering. The AXIS form asks how often phishing simulations run and for the click and reporting rates of the latest one.

Key steps:

  • Train all staff at least annually, with extra focus on finance teams and executives.
  • Require call-back verification on a known number before any change to payment details.

Do insurers check your answers?

They can, and application answers become part of the policy. In 2022 Travelers sued after a ransomware attack at International Control Services, whose CEO-signed application said MFA protected privileged access; the investigation found MFA only on the firewall. The parties agreed to a judgment rescinding the policy. Keep evidence ready, such as MFA policy reports, EDR coverage reports and restore-test logs, and describe partial controls honestly with a date to close the gap.

Frequently asked questions

What security controls do cyber insurers require in 2026?

Most applications ask about MFA, privileged access, endpoint detection and response, patching and remote access, backups, incident response planning and security training. They now ask how far each control reaches, not only whether it exists.

Is any form of MFA enough for cyber insurance?

Any MFA is better than none, but applications ask which method is used and where it applies. CISA describes FIDO/WebAuthn and PKI-based MFA as the gold standard, because SMS codes and push prompts can be phished or bypassed.

Is antivirus enough, or do insurers expect EDR?

Marsh says insurers expect endpoint protection and EDR across servers and laptops as a minimum. At-Bay found that many Akira ransomware victims were compromised despite having a leading EDR product, so 24/7 monitoring matters as well.

What backup setup do insurers look for?

Applications ask whether backups are offline or immutable, protected by separate credentials and MFA, and tested by full restores. CISA recommends offline, encrypted backups of critical data with regular tests.

What happens if a cyber insurance application overstates security controls?

The insurer can seek to rescind the policy. In 2022 Travelers and International Control Services agreed to a judgment rescinding a cyber policy after the insurer found MFA was used far less widely than the application stated.

Sources