Cyber Insurance Readiness: How Mid-Market Owners and Operators Get the Application Right and Avoid Coverage Surprises

Cyber Insurance Readiness: How Mid-Market Owners and Operators Get the Application Right and Avoid Coverage Surprises

2026-10-26

Takeaway: A cyber insurance application is a signed statement about your security, not a sales form. Answer it from evidence, close gaps before renewal, and read the exclusions and sublimits before you need them. A policy you can’t collect on is just an expensive receipt.

Lesson one: a “yes” you can’t back up can void the policy

In a complaint filed July 6, 2022 in federal court in Illinois, Travelers said its policyholder, International Control Services (ICS), had answered “yes” on its application and on a signed attestation that it required multi-factor authentication (MFA, a second login step beyond a password). The attestation covered email, remote access, and administrator access to directory services, backups, network equipment, and endpoints and servers. After a ransomware attack that began around May 25, 2022, Travelers alleged, its investigation found ICS used MFA only on its firewall.

ICS didn’t contest it. On August 30, 2022, with both sides agreeing, U.S. District Judge Colin S. Bruce rescinded the $1 million policy and declared it void from inception, with no coverage for past, present, or future claims. The order records the misstatements as Travelers’ assertion; what the parties stipulated to was the outcome.

Two details are worth noticing. The application was signed by ICS’s chief executive, so the business leader owns the answers. And Travelers’ attestation called those MFA uses “the minimum controls that must be in place in order to be eligible for a Cyber policy.” That’s one insurer’s 2022 form, but it’s a fair preview of what you’ll be asked.

Lesson two: read the exclusions before the attack, not after

War exclusions are the famous example. After the 2017 NotPetya malware infected more than 40,000 machines in Merck’s network, its insurers denied coverage under a “hostile/warlike action” exclusion in its all-risks property policies. The insurers argued “hostile” should be read in the broadest sense. On May 1, 2023, a New Jersey appeals court ruled for Merck, holding that the exclusion didn’t cover a cyberattack on a commercial accounting-software provider with no link to military action.

The market responded with clearer wording. Lloyd’s of London Market Bulletin Y5381 (August 16, 2022) requires standalone cyber policies written at Lloyd’s to exclude losses from state-backed cyberattacks, unless Lloyd’s agrees otherwise, from March 31, 2023 at inception or renewal. The National Association of Insurance Commissioners’ (NAIC) latest cyber insurance market report (2025 reporting year, released October 2026) says war exclusions have been “widely applied in cyber policies since 2023.” It adds that triggering one typically requires proving a link to a state-backed attacker, and that differing exclusion language across carriers is itself a source of coverage uncertainty.

War isn’t the only fine print. The U.S. Government Accountability Office’s May 2021 report on cyber insurance found that key terms like “cyberterrorism” lacked standard definitions. Brokers also told GAO that a policy with a $1 million total limit might carry a lower limit, such as $250,000, for social engineering and wire transfer attacks. That data is five years old, but it’s exactly the kind of sublimit to check line by line.

Know what kind of coverage you actually have

The NAIC report says U.S. domestic cyber policies in force rose 33% to 5.84 million in 2025. Most of those policies are endorsements, meaning cyber coverage added to another commercial policy, while dedicated primary cyber policies bring in about 64% of premium. The NAIC reads this as businesses bundling “modest amounts of cyber protection into other commercial lines.” Ask your broker which kind you have, and what the limits are.

A readiness checklist before renewal

  1. Get the application early. Ask your broker for the current form well before renewal, so fixes aren’t rushed.
  2. Give every question an owner and evidence. A screenshot, report, or configuration export. If the honest answer is “partly,” say so and explain, such as MFA on email but not on one legacy server.
  3. Start with the controls in the ICS attestation. MFA on email, remote access, and admin access to directory services, backups, network equipment, and endpoints and servers is a reasonable first list to verify.
  4. Close gaps before you sign, or disclose them. After an incident is too late to rewrite an answer.
  5. Read the policy, not just the quote. Look for war and state-backed exclusions, sublimits for social engineering and funds transfer fraud, and your retention (the insurance word for deductible). Ask whether you must use the insurer’s chosen incident response firms.
  6. Report material changes. The ICS application said the applicant “will notify Travelers of any material changes.” Yours likely says something similar.
  7. Keep the file. Save the signed application and the evidence behind each answer.

The bottom line

Cyber insurance works best as a backstop for real controls, not a substitute for them. Yellow Coop’s CISO work includes cyber insurance application support and a control gap list, plus a written incident response plan and a tabletop exercise with leadership. Let’s talk.

Sources