Cyber insurance is no longer a broad, accessible product. Insurers have tightened requirements significantly following large-scale ransomware events. In 2026, businesses that cannot demonstrate baseline security maturity are refused coverage or face exclusions that void claims.
The question is not just 'do you have cyber insurance?' — it's 'will your policy pay out?' That depends on whether the controls you attested to during underwriting are actually in place.
These controls are now commonly required as part of cyber insurance underwriting. Misrepresenting any of them can void your policy.
Enabled means users have the option to use MFA. Enforced means they cannot log in without it. Insurers now distinguish between these — and claims have been disputed where the breached account had MFA 'available but not required.'
Insurers require backups that are usable in a ransomware scenario — not just that backups exist.
Microsoft 365 does not provide backup in the insurance-required sense. A third-party backup solution (Veeam, Acronis, Datto) is required.
The plan must cover:
The plan must be accessible without a working computer. Store a printed copy off-site or in a personal cloud account — not on the company tenant that may be compromised.
De4sec provides a structured engagement to prepare businesses for underwriting and ensure claims will be honoured.
De4sec provides hands-on implementation, not just advice. Book a free discovery call — we assess your current environment against this guide at no cost, no obligation.
