Cyber insurance underwriting: what underwriters look for

Every cyber insurance application lands on the desk of one person with one hard question: if this business gets hit, how bad will it be? That person is the underwriter, and their answer shapes your cover, your terms and your price.

Cyber insurance underwriting sounds technical, but the logic is simple. The underwriter wants to know how likely an attack is, and how much damage it would do. In this guide I explain, as a broker, what underwriters look for, why some answers slow everything down, and how to present your business so the review goes smoothly.

What cyber insurance underwriting means

The underwriter works for the insurer. Cyber insurance carriers each employ underwriters who decide which risks to accept and on what terms. Each carrier has its own appetite, its own forms and its own rules, so the same business can get different results from different insurers.

Most underwriting reviews follow these steps:

1. Read the application form and the answers to the security questions.
2. Look at the business profile: sector, revenue, staff, data and countries.
3. Check the business from the outside, for example its website and email setup.
4. Ask questions about any answer that is unclear, missing or worrying.
5. Decide: offer cover, offer cover with conditions, or decline.

For example, a recruitment agency with 30 staff applies for cover. The underwriter sees that it holds thousands of candidate CVs with personal details. That raises the stakes of a data breach, so the underwriter looks harder at how the agency protects that data.

The controls underwriters look for first

Underwriters focus on the controls that stop the most common attacks, or that limit the damage when one gets through. Many application forms ask yes or no questions about these:

• Multi-factor authentication (MFA). A second step at login, such as a code on a phone. Underwriters often ask about email, remote access and admin accounts separately.
• Offline or immutable backups. Copies of your data that an attacker cannot change or delete.
• Tested restores. Proof that you can bring your data back from those backups.
• Endpoint detection. Software on laptops and servers that spots and stops suspicious activity.
• Patching. Installing security updates quickly, especially for systems on the internet.
• Email filtering. Tools that block phishing emails and harmful attachments.
• Privileged access control. Tight limits on who holds admin rights.
• Staff training. Regular lessons on spotting phishing and scams.
• An incident response plan. A written plan for who does what when an attack happens.
• Payment verification. A call-back check before anyone pays a new or changed bank account.

For example, a logistics company with 120 staff can answer yes to all ten. The underwriter can then move quickly. The same company with no MFA on remote access will face more questions, because remote access is a common way in for ransomware.

Our MFA checklist and backup and restore checklist explain what underwriters usually accept as proof for two of the most important controls.

Why one "no" can slow everything down

On some application forms, a single "no" refers the whole application to an underwriter for review. The form stops being a quick check and becomes a manual review.

Here is what can follow a referral:

1. The underwriter asks why the control is missing and what you do instead.
2. They ask when you plan to put the control in place.
3. They decide how the gap changes the risk.
4. They may offer cover with a condition, a higher excess or a lower limit for some types of claim. Some insurers decline.

The outcome varies by insurer and by the gap. For example, a dental practice answers "no" to offline backups. The underwriter may ask for the practice to set them up within 60 days as a condition of cover. Another insurer might simply decline. Your broker can tell you how different carriers tend to treat each gap.

A "no" is still better than a wrong "yes". If you claim a control you do not have, the insurer may question your claim later. Answer honestly, and explain what you do have.

What underwriters check besides your answers

In cyber insurance underwriting, your answers are only part of the picture. Underwriters also look at:

• Your outside view. Many insurers scan your internet-facing systems. They look for things like open remote desktop ports, out-of-date software and weak email security records.
• Your sector and size. Some sectors hold more sensitive data or depend more on their systems. Revenue and staff numbers help set the size of the possible loss.
• Your data. Card payments, health records and large customer lists all raise the stakes.
• Your suppliers. If an IT provider runs your systems, its security matters too.
• Your history. Past incidents and claims, and what you changed afterwards.

For example, an online shop says it patches every month. The insurer's scan finds an old version of its shopping cart software on the internet. The underwriter will ask about the gap between the answer and the scan. Fix what a scan would find before you apply.

How to present your business well to underwriters

A clear, complete application makes the underwriter's job easier. It also gives you the best chance of a fair result. Follow these steps:

1. Answer each question precisely. Say which systems a control covers. For example: "MFA is on for all email accounts and our VPN."
2. Attach evidence. Screenshots, reports and policies show the underwriter your answers are true. Our evidence pack checklist lists what they ask for most.
3. Explain any gaps. Describe what you do instead and when the full control will be ready.
4. Show a plan with dates and owners. A dated plan tells the underwriter you take the gap seriously.
5. Check the whole form before you send it. Our application readiness checklist helps you spot missing answers.

PrismX shows you an insurer's view of your answers before you submit, so you can see which ones may raise questions. It then builds a signed submission pack with a sha256 fingerprint, so the underwriter can see the pack has not changed since you signed it. PrismX prepares the risk information. The insurer still decides on eligibility, pricing and cover. For more on the quoting stage, read how to get a cyber insurance quote faster.

Good cyber insurance underwriting rewards clear answers backed by evidence. If you want your business ready for its next underwriting review, book a pilot conversation with us.