A denied cyber insurance renewal almost always comes down to one of five gaps: unenforced MFA, partial EDR coverage, backups nobody has actually tested, no written incident response plan, or proof an underwriter can’t verify. Fix those, then reapply.
Insurers never used to check much. A short form, an honest “yes” next to multi-factor authentication, and a policy cleared underwriting for most small businesses without much friction. Not anymore. That changed fast. Renewal notices landing in 2026 are showing up with more questions attached, not fewer, and a policy that sailed through last cycle is getting flagged this time around.
The National Association of Insurance Commissioners tracks this every year. Its 2025 Cybersecurity Insurance Market Report found U.S. cyber premiums actually fell for the first time on record in 2024, down 7% to $9.14 billion. Claims frequency jumped nearly 40% in the same stretch, with almost 50,000 claims reported. Cheaper premiums. Tighter gates. Both, at once. That combination is exactly what catches small businesses off guard at renewal.
We help clients pass these reviews for a living, so weigh that as you read this. Bias noted. The checklist below still works whether you fix it yourself, hand it to whoever runs your IT now, or bring it to us.
Why Insurers Are Suddenly Saying No
Coalition, one of the larger cyber insurers by policy count, found that business email compromise and wire fraud accounted for 58% of the incidents in its 2026 Cyber Claims Report, ahead of ransomware. Not close. Ransom demands themselves still climbed, up 47% to an average over $1 million when an attack lands, though the same report found 86% of businesses hit refused to pay outright.
Insurers used to take your word for it. Not anymore. What changed underneath all of this is the gap between a control existing and a control actually running everywhere, all the time, on every account.
Small businesses get a shorter version of this scrutiny than large companies do. The Government Accountability Office has documented cases where insurers ask smaller applicants as few as four underwriting questions, compared with site visits and interviews for bigger accounts. Shorter doesn’t mean easier to bluff through, though. It isn’t. It means the handful of things they do ask about get checked harder, not skipped. That’s most of what we walk through in a cybersecurity review before a client goes back to their broker, whether they’re renewing a fifth policy or shopping for their first one.
The Five Things That Actually Sink a Renewal
Every insurer’s questionnaire looks a little different on the surface. Not underneath. The underlying checklist barely varies. A state-run cybersecurity office in Indiana publishes a version of the actual underwriting questions carriers ask small businesses, and five items show up on nearly every one of them.
| Control | What the Underwriter Actually Checks | Where Small Businesses Usually Fail |
|---|---|---|
| MFA | Enforced, not optional, on email, remote access, admin accounts, and cloud apps like Microsoft 365 | Turned on for most staff, skipped on a shared admin login or the owner’s own account |
| EDR | Deployed and actively reporting on every endpoint, servers included, not just laptops | Installed during a sales demo on workstations, never extended to the file server |
| Backups | Full and incremental, isolated copies, plus a documented restore test | Jobs run and report success; nobody has restored an actual file from one in over a year |
| Incident response plan | A written plan naming real roles and contacts | No written plan exists, or it names a vendor that hasn’t held the contract in two years |
| Documentation | Screenshots, console exports, and dated reports proving controls are live | Nothing on file, so an honest “yes” on the application can’t be backed up with evidence |
Coalition has flagged one pattern specifically worth repeating here. The most common story behind a denied claim usually isn’t a missing tool. It’s a tool that was live somewhere and dark everywhere else. An EDR agent that stopped checking in three weeks earlier. A license that only ever covered workstations because nobody remembered servers needed a separate SKU. Partial counts as absent, as far as an underwriter is concerned.
“Attested” vs. “Verified”
For years, the application itself was the proof. Check a box, sign it, done. That era is over. Underwriters increasingly want the kind of evidence an auditor would ask for, not a signature: screenshots of enforced MFA policies, EDR console exports showing every device checking in on schedule, a dated log from an actual backup restore test.
Misrepresenting a control, even by accident, is easier to do than most owners assume. An owner who genuinely believes MFA is “on” because IT enabled it for the main office three years ago, without realizing four new hires since then were never enrolled, has technically misrepresented the application. Insurers can rescind coverage retroactively over that gap. Not just deny the renewal. Rescind the whole policy. Sometimes after a claim has already been filed.
This isn’t a gotcha insurers invented for fun. It’s underwriting catching up to how these claims actually get paid, mostly through business email compromise and funds transfer fraud rather than the dramatic ransomware scene most owners picture first.
The 90-Day Reapplication Timeline
Fixing five gaps sounds bigger than it usually is, as long as there’s runway before the renewal date. Compress the same work into two weeks and it gets expensive, rushed, or both.
- 90 days out. Audit MFA and EDR coverage across every device and account, including admin and service accounts most owners forget exist.
- 60 days out. Run and document an actual backup restore. Confirming the job completed isn’t the same test.
- 45 days out. Write or update the incident response plan, naming real people at your current provider, not a vendor from two contracts ago.
- 30 days out. Collect the evidence: screenshots, console exports, and policy documents, before the broker has to ask twice.
- 2 weeks out. Have someone outside your own team review the package before it goes back to the underwriter.
What We Check Before a Client Reapplies
VJNetworks has run managed IT for small businesses across the Tri-State area for over 20 years, mostly for companies with 5 to 60 employees that don’t have a security team of their own to lean on. When a client’s renewal is coming up, the review covers the same five items from the table above, checked the way an underwriter checks them. Not the way a sales pitch describes them.
We benefit if this feels like a lot to manage alone. Fair enough. It’s also true that most of what’s on that checklist is good practice with or without a renewal attached to it, the same baseline we’d recommend to a client who never touches a cyber policy in their life.
If EDR turns out to be the gap, our breakdown of why ransomware targets small businesses now covers why insurers weight it so heavily in the first place. And if the honest answer is that your current provider can’t produce any of this documentation on request, here’s how to evaluate one before you sign anything, insurance renewal or not.
A free assessment walks through the same five checks in about an hour. No sales pitch. Just a written list of what’s actually enforced versus what only looks that way on paper. Bring your renewal questionnaire to the call. It’s a faster way to find the gap than waiting for the underwriter to find it first.
Before You Reapply
Does having MFA turned on for most of the office count, or does it have to be everyone?
Is EDR really required, or does good antivirus still pass?
We have backups. Does that automatically check the box?
How far ahead should we actually start on this?
What happens if the renewal gets denied a second time?
Does finishing this checklist guarantee approval?
A free assessment checks MFA, EDR, backups, and documentation against what your renewal will actually ask for, and hands you a written checklist to bring back to your broker. No obligation, no sales pitch.