FIRST WORD
If your cyber insurance renews in the next few months, this one’s for you. The application asks what security you have in place, and your answers from last time may not reflect what’s true today.
This issue is about closing that gap before you sign again.
Every renewal season, we get calls from clients halfway through an application asking what a question really means, and the honest answer rarely fits in a checkbox.
One quick favor: if this landed in Gmail’s Promotions tab, drag it to Primary; in Outlook, move it to Focused so next week’s issue doesn’t get buried.
Chris Moore
Chief Vision Officer, Steelbrook Technology Group
Your Insurance Application Is A Promise
Why it matters: Cyber insurance applications ask direct questions about your security, like whether you use multifactor authentication where it matters. Your answers become part of the policy. If they’re wrong, your coverage can be at risk.
The case to know: In 2022, Travelers sued its customer, International Control Services, after a ransomware attack. ICS’s application said it used multifactor authentication to protect administrative access. Travelers said MFA protected only the firewall. ICS agreed to let the court rescind the policy, treating it as if it never existed.
What carriers ask about: Common questions cover multifactor authentication, endpoint detection and response, backups, security training, and whether systems are supported and patched.
The catch: An answer can be true when you sign it and wrong six months later. A new hire never gets set up for MFA, a laptop drops off monitoring, an old server never gets replaced.
What we recommend:
Before you answer, check each control against what’s in place today, not what was in place last year.
Go through the technical questions with whoever manages your IT.
If the honest answer is “mostly,” talk to your broker before checking “yes.”
The bottom line: Answer the application from what’s true today, not what you remember.
MYTH VS. REALITY
Three Things People Assume About Cyber Insurance Applications
Myth: “We have MFA, so we can check yes.”
Reality: MFA can be on for email and still missing on remote access, admin accounts, or older systems. That gap is exactly what the ICS case turned on.
Myth: “Our backups run every night, so we’re covered.”
Reality: Applications often ask whether you test backups and keep them separate from your main network. A backup that’s never been restored, or that ransomware can reach, may not match what you’re claiming.
Myth: “Last year’s answers are still good.”
Reality: People join and leave, devices change, and settings drift. Answers that were true at your last renewal may no longer be true.
Fraud Now Makes Up Half Of One Major Insurer’s Cyber Claims (October 2026)
What’s happening: At a recent industry conference, a Travelers executive said financial fraud and business email compromise now account for about half of the insurer’s cyber claims. Those claims rose 57% from the first half of 2025 to the first half of 2026.
The trap: Expecting an attack to look technical. Criminals increasingly get employees to hand over access or approve payments themselves, and AI makes impersonation more convincing.
The business takeaway: The panel's fix is low-tech: a verification step before money moves or access changes. If you set up a callback rule after our October issues, this is why it matters.
Check Your Answers Before You Sign
Pull your last cyber insurance application before your renewal, then go through it with whoever manages your IT:
Mark each answer as still true, partly true, or no longer true.
Fix what you can before renewal.
Flag anything you can’t fix to your broker before you sign.
Who it’s for: Owners and whoever signs the insurance application.
November 3, 1983: The Computer Virus Gets Its Name
A USC student named Fred Cohen had an idea for a program that could copy itself and spread to other computers. In a conversation with his advisor, Len Adleman, that day, they settled on a name for it: a “virus.”
The twist: Cohen’s program wasn’t the first of its kind. What made it matter is that he named the threat and studied it, which helped launch serious research into defending against it
Seeing us in Promotions or Other? Move this email to Primary or Focused so next week’s issue lands where you’ll see it.