{"id":7964,"date":"2026-08-04T13:37:52","date_gmt":"2026-08-04T13:37:52","guid":{"rendered":"https:\/\/basesolutionsllc.com\/?p=7964"},"modified":"2026-08-04T13:37:52","modified_gmt":"2026-08-04T13:37:52","slug":"5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover","status":"publish","type":"post","link":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/","title":{"rendered":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Cyber insurance is not the safety net it used to be. Coverage that once relied on a signed application is now conditional on specific controls being in place at the\u00a0time\u00a0of an incident. Firms are discovering, only after a breach, that the answers on the form and the environment behind them did not match.<\/span>\u00a0<\/span><\/p>

That mismatch is where claims fail. Insurers now check the detail, and the detail is where partial implementations show up.<\/span>\u00a0<\/span><\/p>

Why the rules have changed<\/strong>\u00a0<\/span><\/h3>

This shift has been building for a few years. Claim volumes climbed sharply through 2023 and 2024, ransomware losses pushed several carriers into the red, and the industry walked away from the\u00a0honor\u00a0system it used to run on. Underwriters now come with\u00a0detailed technical questionnaires that require documented evidence, and adjusters compare the answers on the application to what was in the environment when the incident happened.\u00a0<\/span>Marsh McLennan’s analysis of cyber controls<\/span><\/a>\u00a0has quantified how much specific hygiene practices reduce breach likelihood, and\u00a0insurers are underwriting off that data, and self-attestation on the application form no longer carries the weight it did. When a claim gets denied post-breach, the reason is usually specific. A control the applicant said was in place was not, and the missing piece is often where the intrusion happened.<\/span>\u00a0<\/span><\/p>

For\u00a0<\/span>law firms, accounting practices, and other regulated businesses across the DMV<\/span><\/a>, the underwriting standards behind coverage are unlikely to loosen again. Here are five hygiene areas where the denials most often show up.<\/span>\u00a0<\/span><\/p>

1. MFA everywhere, not just email<\/strong><\/h5>

Multi-factor authentication moved from best practice to policy condition around 2022, and by 2024 it appeared on\u00a0almost every\u00a0application questionnaire. Insurers now\u00a0require\u00a0more than just a yes-or-no response. Post-breach investigators check whether MFA was in place on email, on VPN, on remote desktop, on cloud admin consoles, and on privileged accounts, and a single unprotected login path is enough to deny. Verizon’s\u00a0<\/span>Data Breach Investigations Report<\/span><\/a>\u00a0has for years found stolen credentials to be one of the top\u00a0initial\u00a0access vectors, which is why carriers keep tightening what qualifies as MFA coverage across email, VPN, remote desktop, cloud admin consoles, and privileged accounts.<\/span>\u00a0<\/span><\/p>

If someone mapped every login route into your firm’s systems this afternoon, could you name the ones without MFA in front of them?<\/span>\u00a0<\/span><\/p>

2. Patch cadence<\/strong><\/h5>

Insurers now ask how quickly critical patches move from vendor release into production, especially on anything internet-facing. Marsh’s data links a seven-day patch window on high-severity vulnerabilities to a measurable drop in incident probability, and that window has become\u00a0an underwriting benchmark. Firms that treat it as a stretch goal often struggle to produce the timestamps a claims adjuster will ask for later.<\/span>\u00a0<\/span><\/p>

When the last critical patch was released, how long did it take to reach every server and every laptop?<\/span>\u00a0<\/span><\/p>

3. Backups you can prove work<\/strong><\/h5>

Every firm has backups. Few can produce the results of a recent restore test. Insurers know the difference, because ransomware groups target backups directly, and CISA’s\u00a0<\/span>#StopRansomware guidance<\/span><\/a>\u00a0has for years told organizations to\u00a0maintain\u00a0offline, encrypted backups and to regularly test the availability and integrity of those backups in a disaster recovery scenario. Underwriters now ask when the last full restore test happened, and adjusters ask to see the log.<\/span>\u00a0<\/span><\/p>

When was the last time someone at your firm did a full restore, timed it, and wrote down what worked and what did not?<\/span>\u00a0<\/span><\/p>

4. Endpoint detection<\/strong><\/h5>

Traditional antivirus has\u00a0largely dropped\u00a0out of underwriting requirements at the mid-market level. Endpoint detection and response,\u00a0which watches for suspicious\u00a0behavior\u00a0across the fleet, catching activity that signature-based tools miss, is what most carriers expect to see\u00a0<\/span>deployed across the entire fleet<\/span><\/a>. Where it is missing from a subset of endpoints, or where the deployment covers office machines but not the laptops used outside the office, that is often where the intrusion happens.<\/span>\u00a0<\/span><\/p>

If a laptop belonging to someone at your firm was compromised outside of working hours, would anyone know before the next business day?<\/span>\u00a0<\/span><\/p>

5. A documented IT policy<\/strong><\/h5>

Insurers ask to see the written document itself.\u00a0They want to see the file that sets out who has access to what, how new starters are onboarded and leavers offboarded, how incidents get reported and to whom, and how often the environment is reviewed. Firms without one increasingly find that a claim gets challenged even when the underlying security held up, because the paperwork the policy\u00a0required\u00a0simply did not exist.<\/span>\u00a0<\/span><\/p>

If your broker asked for your written IT policy on a call tomorrow, would there be a document to send, or would it need to be pieced together first?<\/span>\u00a0<\/span><\/p>

The question that matters\u00a0<\/strong><\/h3>

These questions are diagnostic in intent. Asking them is what closes the distance between what a policy assumes and what a firm can prove. That distance has grown as carriers moved further toward evidence-based underwriting, and it is likely to keep growing.<\/span>\u00a0<\/span><\/p>

The next piece in this series will cover the practical side of these questions and what firms can do to close them. Until then, a\u00a0<\/span>thorough look at what is running across the firm’s environment<\/span><\/a>\u00a0is often the fastest way to find out.<\/span>\u00a0<\/span><\/p>

If a claim landed on your desk tomorrow, and an adjuster began asking the questions above, would your policy pay out?<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Cyber insurance is not the safety net it used to be. Coverage that once relied on a signed application is now conditional on specific controls being in place at the\u00a0time\u00a0of an incident. Firms are discovering, only after a breach, that the answers on the form and the environment behind them did not match.\u00a0 That mismatch […]<\/p>\n","protected":false},"author":23,"featured_media":7966,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","_auhfc":[],"footnotes":""},"categories":[35,38],"tags":[],"class_list":["post-7964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-it-strategy"],"yoast_head":"\n5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover<\/title>\n<meta name=\"description\" content=\"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover\" \/>\n<meta property=\"og:description\" content=\"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/\" \/>\n<meta property=\"og:site_name\" content=\"BASE Solutions LLP\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-04T13:37:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Atul\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Atul\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover","description":"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_GB","og_type":"article","og_title":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover","og_description":"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.","og_url":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/","og_site_name":"BASE Solutions LLP","article_published_time":"2026-08-04T13:37:52+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png","type":"image\/png"}],"author":"Atul","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Atul","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#article","isPartOf":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/"},"author":{"name":"Atul","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#\/schema\/person\/c5ecb71674eb1faff93ab0e0e14e9aca"},"headline":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover","datePublished":"2026-08-04T13:37:52+00:00","mainEntityOfPage":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/"},"wordCount":892,"publisher":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#organization"},"image":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#primaryimage"},"thumbnailUrl":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png","articleSection":["Cybersecurity","IT Strategy"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/","name":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover","isPartOf":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#website"},"primaryImageOfPage":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#primaryimage"},"image":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#primaryimage"},"thumbnailUrl":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png","datePublished":"2026-08-04T13:37:52+00:00","description":"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.","breadcrumb":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#primaryimage","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png","contentUrl":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2026\/08\/Featured-Image-1-4.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/5-cyber-hygiene-gaps-that-insurers-are-starting-to-refuse-to-cover\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/basesolutionsllc.com\/staging\/6761\/"},{"@type":"ListItem","position":2,"name":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover"}]},{"@type":"WebSite","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#website","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/","name":"BASE Solutions LLP","description":"","publisher":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/basesolutionsllc.com\/staging\/6761\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#organization","name":"BASE Solutions LLP","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#\/schema\/logo\/image\/","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2024\/03\/Logo-Footer-1.svg","contentUrl":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-content\/uploads\/2024\/03\/Logo-Footer-1.svg","width":193,"height":53,"caption":"BASE Solutions LLP"},"image":{"@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/basesolutionsllc.com\/staging\/6761\/#\/schema\/person\/c5ecb71674eb1faff93ab0e0e14e9aca","name":"Atul","url":"https:\/\/basesolutionsllc.com\/staging\/6761\/blog\/author\/atul\/"}]}},"_yoast_wpseo_title":"5 Cyber Hygiene Gaps That Insurers Are Starting to Refuse to Cover","_yoast_wpseo_metadesc":"Cyber insurers now audit the environment behind the application. Five hygiene areas where partial implementation is stopping payouts at claim time.","yoast_noindex":false,"_links":{"self":[{"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/posts\/7964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/comments?post=7964"}],"version-history":[{"count":0,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/posts\/7964\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/media\/7966"}],"wp:attachment":[{"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/media?parent=7964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/categories?post=7964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/basesolutionsllc.com\/staging\/6761\/wp-json\/wp\/v2\/tags?post=7964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}