Will our cyber insurance actually pay? What to check before renewal

It pays when five things are true: the controls you said you had on the application were actually running when the incident happened; you notified the carrier within the window the policy sets; you used the carrier's approved counsel, forensics, and negotiators, or got permission not to; the loss isn't carved out by an exclusion, and the state-backed-attack exclusions are the one to read; and the sub-limits and waiting periods on the coverage you need (ransomware, business interruption, data restoration) are large enough to matter. Most disputes I've read about come down to the first one. The application is a warranty. If MFA was "enabled everywhere" on the form and wasn't, the rest of the policy may not matter.

The application is the policy

Carriers now ask detailed questions about controls: multi-factor authentication on remote access and email, offline backups, endpoint detection, privileged account management, patching cadence. The answers are what they price. When a claim comes in, the forensic report will show what was actually in place, and if it contradicts the application, the carrier has grounds to deny or rescind. The research piece I wrote on this makes the point in full: the evidence has to match the running controls, not the intended ones (see Cyber Insurance Evidence Must Match the Running Controls). Before renewal, have someone outside the team that filled in the form verify each answer against the environment. Treat it like a financial attestation, because it is one.

Notification and vendor conditions

Policies require prompt notice, often within days of discovery, and many require you to use panel vendors for legal, forensic, and ransom negotiation work. Organisations that call their own favourite firm first, run up costs, and then notify the carrier a week later find that the costs aren't covered and the claim is contested. Write the carrier's notification deadline and the panel list into the incident response plan, on the first page. I've put the wider notification map in Who do we have to notify after a breach; the insurer is usually the first call after counsel.

Exclusions: read the war clause

Since 2023, Lloyd's has required standalone cyber policies written in its market to exclude losses from state-backed cyber attacks that significantly impair a state's essential services or security, with the exclusion's wording and the attribution process spelled out in the policy (Lloyd's, 2022). Other carriers have followed with their own versions. The practical issue isn't whether your attacker is a government; it's how attribution gets decided and by whom, and whether an attack by a criminal group with alleged state links could fall inside the clause. Ask your broker to walk through the specific wording with a realistic scenario. "We'd never be a target of a state" is not a risk assessment.

Other exclusions to check: unencrypted devices, failure to maintain the controls attested to, prior known incidents, contractual penalties, and losses caused by infrastructure outages outside your control.

Ransom payments: coverage with conditions

Many policies cover extortion payments, but only with the carrier's consent, after sanctions screening, and through approved negotiators. The U.S. Treasury's sanctions office has warned that insurers and response firms facilitating a payment to a sanctioned party may themselves violate sanctions, which is why carriers insist on the screening (Office of Foreign Assets Control, 2021). Paying first and claiming later is the surest way to pay twice. The decision structure for payments is a separate question I've written up in Should we pay the ransom, and who decides?.

Limits, sub-limits, and the market behind them

The headline limit is rarely what you'd get for the loss that worries you. Ransomware, business interruption, data restoration, and regulatory fines often carry sub-limits well below the policy limit, plus waiting periods before interruption cover starts. The market has been tightening for years: a federal review found insurers raising premiums, cutting limits for high-risk sectors, and policyholders unsure what terms like "cyberterrorism" covered (U.S. Government Accountability Office, 2021). Pricing and terms have moved since then, but the structure hasn't: the carrier's appetite shapes your coverage, and you should know where the ceilings are before you need them.

Five checks before you renew

1. Verify every control answer on the application against the live environment, by someone independent of the person who filled it in.
2. Put the notification deadline and panel vendors into the incident plan and confirm the people on call know them.
3. Have the broker explain the state-backed-attack exclusion against a scenario that resembles your most likely attacker.
4. List the sub-limits and waiting periods for the three losses you most fear, and compare them to a realistic estimate of each.
5. Confirm the ransom-payment conditions and who inside your organisation is authorised to engage the carrier's process.

What I'd do next

Do the first check this month. If the application and the environment disagree, fix the environment or fix the application before renewal; either is better than finding out at claim time. If you'd like an independent verification of your attested controls, which is what carriers increasingly expect anyway, request a briefing. More on this cluster is in Executive leadership.