Jeff CadyWhy insurers are asking harder questions
A cyber incident is now an ordinary business loss, and insurers price it that way.
attacked small businesses closed
Nearly one in five small businesses hit by a cyberattack went on to file for bankruptcy or close.
average loss per claim
The average cyber insurance claim in 2024, across one insurer’s policyholders.
of claims were email fraud
Business email compromise and fake payment requests, the kind of loss any office can suffer.
had to improve to qualify
Of mid-sized organizations surveyed improved their defenses to qualify for cyber coverage.
Sources: Mastercard small business cybersecurity survey, 2025; Coalition 2025 Cyber Claims Report; Sophos cyber insurance survey of 5,000 organizations, 2024.
What the application will ask
Wording varies by insurer, but most small-business cyber applications come back to the same controls. These are the ones that most often decide the price, or whether a policy is offered at all.
Multi-factor authentication
On email, remote access and every administrator account, including your IT provider’s.
Backups ransomware can’t reach
At least one offline or immutable copy, and a restore actually tested in the last year.
Endpoint protection
Endpoint detection and response on every computer and server, not just some of them.
Remote access closed to the internet
No remote desktop or admin ports open to the world.
Payment verification
A call-back rule before anyone sends money or changes bank details.
Patching and email security
Critical updates applied promptly, and email filtering with SPF, DKIM and DMARC.
A plan for the bad day
A written incident response plan with your insurer’s hotline in it, tested at least once a year.
Trained staff
Annual security training and phishing tests, with records to show for them.
What you get
Insurers increasingly check answers against evidence and against what they can see of you from the internet. Everything here is built so each “yes” on your application can be backed up.
- The question map. Every question underwriters ask, answered for your business. A “yes” counts only when there is dated proof behind it; anything else is marked “yes, not proven” until it is.
- Coverage counts, not impressions. “MFA on admin accounts” becomes “12 of 12 admin accounts”, and “EDR everywhere” is checked against your device list, so partial coverage shows up before the insurer finds it.
- An outside-in check. We look at your business the way insurers’ scanners do: email protection records (SPF and DMARC), exposed remote access, certificates and known breaches, and reconcile it with your answers.
- An evidence request for your IT provider. A dated list of exactly which exports and screenshots to send, so the proof comes from the systems themselves.
- An evidence binder. The proof for each answer, dated and filed, ready if an underwriter or a claims adjuster asks. Evidence older than 90 days is flagged for a refresh.
- A fix-before-you-apply plan. Gaps and unproven answers ranked by how much they matter to an insurer, each with an owner and a date before your renewal.
- A controls summary for your broker. One or two pages your broker can use to place your coverage, listing only what is proven, confirmed by you. An evidence schedule is added at the end: it indexes your proof by reference number without sending the sensitive files themselves, so you can produce any item if asked.
Packages
Fixed prices, so you can approve it without another meeting.
- Interview with you and your IT provider
- Outside-in check of what insurers see
- Evidence request to your IT provider, and a dated evidence binder
- Question map and ranked fix plan
- Controls summary for your broker
- 30-minute readout
- Everything in the Readiness Report
- 10 hours of remediation help over 60 days, with your team or IT provider
- Updated broker summary and evidence binder once gaps are closed
- Saves $550 against booking separately
- Re-check 60 to 90 days before renewal
- Fresh evidence and outside-in check
- Updated question map and broker summary
- Included with any vCISO retainer
Deposit of 50% by card to start, balance invoiced on delivery · Renewal Refresh renews yearly; cancel any time before renewal · Extra remediation hours $325/hr · Fee credited, up to one month’s retainer, toward a retainer signed within 30 days
How it works
- Free call. 30 minutes: your renewal date, your broker, and what the last application asked.
- Week one. We run the outside-in check, walk through the questions with you, and send your IT provider a dated evidence request.
- Week two. Evidence is reviewed and filed. You get the question map, the fix plan, the evidence binder and a draft broker summary, with a readout.
- Before you apply. Your team closes the gaps, with my help on the Ready to Apply package, and the summary is updated for your broker.
What this is, and isn’t
I don’t sell insurance and I can’t promise coverage, terms or a price; your insurer decides. What I do is help you answer the application truthfully and well. A wrong answer can give an insurer grounds to deny a claim later, so we close gaps rather than paper over them, and we keep the proof. Evidence shows a control was in place on the date it was collected; keeping it current is part of the renewal refresh. I guide; your team or IT provider makes the changes.
Not sure where you stand?
The free Readiness Check covers many of the same controls insurers ask about and gives you your top five fixes.