A controller at a 140-person logistics firm signs a renewal application in March. One box asks whether multi-factor authentication protects all remote access. She checks "yes" because the IT vendor said so. In September, a threat actor enters through an unprotected legacy VPN account, encrypts the file servers and demands a ransom. The carrier's forensic team finds the VPN, pulls the application and sends a letter: the policy is void from inception.

That sequence is how most cyber insurance rescissions unfold. The coverage grant was never the problem. The signed paperwork that preceded it was.

This piece covers application warranties and no-known-loss letters, the two documents most often used to unwind a cyber policy. It explains how carriers use them after a claim and what you can do before you sign.

The High Stakes of Cyber Insurance Attestation

Buyers often treat a cyber application as an intake form, like a quote request or a credit check. Carriers treat it as part of the contract. Every answer you give becomes a statement the carrier relied on when it priced the risk, set the retention and agreed to issue the policy.

Public entities that buy cyber coverage see this stated plainly. One municipal renewal package notes that all application answers are treated as material representations upon which the policy is issued. Private commercial applications carry the same principle, often in a signature block that few people read closely.

The financial stakes show up after a loss. An analysis of claims data found that roughly 75% of closed cyber claims resulted in no payout, and carriers attributed a substantial share of those outcomes to application misrepresentations and inadequate security controls. Some closed claims never exceeded the retention, and others fell outside the coverage grant. A meaningful portion, though, failed because the insured's own attestation did not match the environment the forensic team found.

The perceived transaction is buying a policy. The contractual transaction is a set of sworn statements about your network, exchanged for a promise that depends on those statements being true. If the statements fail, the promise can fail with them.

The person signing therefore carries real weight. A CFO or owner who signs without verifying answers with IT is not completing paperwork. That person is making representations on the company's behalf that a carrier may later test against forensic logs.

Understanding Application Warranties and Representations

A cyber application usually has three layers: the questionnaire, any supplemental forms such as ransomware or funds-transfer questionnaires, and a signature section that ties them together. The signature section usually states that the answers are true, that the signer made reasonable inquiry and that the carrier will rely on them. Some forms add language making the application part of the policy itself.

That language is what turns a questionnaire into enforceable contract terms. Once incorporated, a "yes" about endpoint detection or offline backups carries the same legal weight as the insuring agreements.

The Difference Between a Warranty and a Representation

A representation is a statement of fact made to induce the contract. If it proves false, the carrier generally must show it was material, meaning the truth would have changed the underwriting decision. Many states also consider whether the insured intended to deceive, though standards vary considerably.

A warranty is stricter. It is a statement or promise the policy treats as a condition of coverage. In jurisdictions that enforce warranties strictly, a breach can defeat coverage whether or not it caused the loss. Many states have softened this by statute and treat most application answers as representations unless the policy clearly says otherwise.

Cyber forms increasingly blur the line through conditions precedent. A condition precedent might require that MFA remain in place on all email accounts throughout the policy period. That turns a point-in-time representation into a continuing obligation. If you disable MFA for one executive in month seven, a carrier may argue that coverage for a related loss never attached.

How Material Misrepresentation Voids Coverage

A material misrepresentation is a false statement that would have led the carrier to decline, price differently or attach different terms had it known the truth. Materiality is the hinge. A wrong employee count by three people rarely matters. A wrong answer about remote access controls almost always does.

When a carrier proves materiality, many jurisdictions allow it to treat the policy as void ab initio, meaning void from the beginning. Under that standard, a policy can be treated as if it never existed, and the insurer owes nothing on any claim. The carrier usually returns the premium. In that same dispute, the insurer's complaint asserted that "the policy was issued in reliance upon the truth and accuracy of the Application," which is close to the standard framing carriers use.

Good faith does not reliably protect you. Courts have permitted rescission where an inaccurate statement about security controls was unintentional, because the carrier's reliance, not the insured's state of mind, drove the outcome.

No-Known-Loss Letters: The Final Gatekeeper

The application describes your controls. The no-known-loss letter, often called an NKLL or warranty letter, describes what you know. It states that the signer is unaware of any incident, circumstance or fact that could reasonably give rise to a claim.

Its function is mechanical. Carriers use it to close the gap between the date you completed the application and the date coverage binds. If something happened in those weeks, the letter is where you must disclose it.

When Carriers Require a Signed Statement

The NKLL most often appears in these situations:

• New business placements, especially when the quote is several weeks old by binding
• Limit increases, where the letter typically excludes known matters from the additional limit
• Lapsed or late renewals, where the carrier wants confirmation nothing occurred during the gap
• Moves to a new carrier, where prior acts coverage is extended
• Mid-term endorsements adding entities, subsidiaries or new coverage parts

The letter is often brief, sometimes a single page. Its length tells you nothing about its importance. A one-paragraph NKLL can carry as much rescission risk as a twelve-page application, because it addresses the exact category of facts carriers examine after a loss.

The risk is current. In a federal complaint filed in 2026, Philadelphia Indemnity Insurance Company v. JCFC, the insurer sought rescission based on alleged misrepresentations in both the application and the no-known-loss letter. Expect carriers to plead both documents together.

Defining 'Knowledge' of a Potential Cyber Claim

Knowledge is where most NKLL disputes turn. A claim does not arrive labeled. It starts as a help desk ticket, a vendor alert, a customer complaint about a strange invoice or a spike in failed logins.

Consider a 45-person accounting firm in Rochester. Three weeks before binding, an employee reports that a client received a payment-redirect email from a lookalike domain. IT resets a password and closes the ticket. The partner signing the NKLL never hears about it. Four months later, the client sues over a $180,000 misdirected wire.

Whether the firm "knew" depends on the letter's wording. Some forms limit knowledge to named officers, a CEO, CFO, general counsel or CISO. Others impute knowledge held by any employee. Some ask for actual knowledge; others ask whether a reasonable person would expect a claim. If your letter imputes knowledge broadly, the closed ticket may be enough.

Before signing, ask your IT lead and outsourced provider for a written summary of incidents, alerts and unusual activity since the application date. That inquiry protects you, and many signature blocks already state that you made it.

Comparing Application Integrity vs. Policy Rescission

Not every inaccurate answer leads to rescission. Carriers can respond along a spectrum, and the response usually tracks the severity and relevance of the gap.

The difference between the first row and the fourth is often a single conversation before binding. Disclosing that 12% of your users still lack MFA might raise your retention or add a ransomware sublimit. Hiding it can leave you uninsured for every claim during the policy period, including ones unrelated to MFA.

That asymmetry should shape how you approach the application. A disclosed weakness becomes a priced, defined term. A concealed weakness becomes a defense the carrier can raise later, and it may surface only after the loss, when you have no leverage.

Common Pitfalls in the Cyber Underwriting Process

Most rescission risk comes from a short list of questions. They involve controls that change frequently, are owned by someone other than the signer and are easy to describe optimistically. The two below appear most often in coverage disputes we review.

One newer category deserves attention. Commentary from 2026 describes a developing duty of disclosure around "silent AI", where undisclosed AI tools that change a company's risk profile may support rescission. If your team has connected a generative AI tool to client data or production systems since your last application, disclose it, even if the form does not ask directly.

Overstating Multi-Factor Authentication (MFA) Adoption

MFA questions rarely ask a single thing. A typical supplemental asks separately about email, remote access, privileged accounts, cloud consoles, backup systems and third-party vendor access. A "yes" to all six means every account in each category is protected, not most of them.

Common gaps we see include:

• Service accounts exempted because MFA broke an integration
• Legacy VPN or RDP access left open for one vendor or a single remote site
• Executive exceptions granted for convenience and never revoked
• Domain admin accounts protected by password only
• Push-only MFA where the form asks about phishing-resistant methods

If you operate in New York, NYDFS Part 500 now requires MFA for remote access and privileged accounts at covered entities. Financial services firms in Buffalo or Manhattan face both a regulatory and an underwriting consequence for the same gap. Run an access report before signing, not after.

Inaccurate Backup and Recovery Time Objectives

Backup questions ask whether copies are offline or immutable, how often they are tested and how quickly you can restore critical systems. These answers drive business interruption pricing and waiting periods directly.

A manufacturer with 60 employees and no in-house IT may state a 24-hour recovery time because the managed service provider quoted it. If the first full restore test happens during an actual ransomware event and takes 11 days, the stated objective becomes evidence. The carrier may argue that it priced business interruption based on a recovery capability that did not exist.

Answer with tested numbers. If you have never performed a full restore, say so, and schedule one before renewal.

The Legal Consequences of a Rescinded Policy

Rescission does more than deny one claim. It removes the contract entirely, and the consequences extend well past the incident that triggered it.

First, you lose every insuring agreement at once. Breach response costs, forensic fees, regulatory defense, notification expenses, extortion payments and third-party liability all revert to your balance sheet. A ransomware event involving protected health information can carry forensic, legal, notification and regulatory costs that exceed the annual revenue of a small practice.

Second, you lose defense. Many cyber forms include a duty to defend or reimburse defense costs for privacy class actions and regulatory proceedings. Without the policy, you retain and pay your own counsel while defending against the carrier's rescission action at the same time.

Third, contractual obligations can fail downstream. If client contracts require you to maintain cyber or technology E&O coverage, a rescinded policy may place you in breach of those agreements. This is a breach-of-contract exposure, a failure to perform a promised obligation, separate from any negligence claim alleging you fell below the standard of care in protecting data.

Fourth, future placements become harder. Applications routinely ask whether coverage was ever rescinded or declined. Answering "yes" narrows the available markets and typically raises retentions for several renewal cycles.

The carrier generally returns premium, but that refund is negligible against an uninsured loss. If the stakes justify it, you can contest rescission, often arguing lack of materiality, waiver or ambiguity in the application. That fight occurs while you are already absorbing the loss.

Common Questions About Cyber Insurance Applications

Can my cyber insurance be canceled after I file a claim? Rescission differs from cancellation. A carrier that finds a material misrepresentation may treat the policy as void from the start, which can apply even after a claim is filed.

What if I answered a question wrong by accident? Many courts focus on whether the wrong answer was material to the carrier's decision, not whether you intended to mislead. Correct errors in writing as soon as you find them, ideally before binding.

Does my broker fill out the application for me? A broker can help you interpret questions, but you sign the attestation. The carrier relies on your signature, so verify each answer with the person who actually manages the control.

What counts as a "known loss" on the letter? It depends on the letter's wording, but it can include incidents, alerts, suspicious emails or complaints that could reasonably lead to a claim. When unsure, disclose it.

Do I have to tell my carrier if our security changes mid-policy? If the policy includes conditions precedent or continuing warranties, removing a control can affect coverage. Notify your broker before disabling MFA, changing backup providers or adding AI tools connected to sensitive data.

Is it better to disclose a weakness even if it raises my premium? In most cases, yes. A disclosed gap becomes a priced term, while a concealed gap can become grounds for denying every claim.

Protecting Your Business Through Radical Transparency

The application and the no-known-loss letter are not formalities that precede coverage. They form the foundation it rests on. When your answers match your environment, the policy form responds according to its terms. When they do not, a carrier may argue that no policy ever existed, and the loss falls on you.

The practical steps are straightforward. Route every security question to the person who owns that control. Pull access and backup reports before signing. Request a written incident summary before you execute the NKLL. Disclose gaps and AI usage, then negotiate the terms that result.

Bloc Cyber works at this level: reviewing the application, supplementals and policy form together so your attestations and coverage grant align before binding. If you are preparing a first cyber placement or a renewal, request coverage and have a specialist walk through the form with you. Accurate answers cost less than a contested claim.