A cyber insurance application in 2026 looks nothing like the one-page questionnaire carriers circulated five years ago. Underwriters now require documented proof that specific technical controls are in place before they will even quote a policy, and gaps in those controls can result in outright denial or exclusionary endorsements that gut your coverage at claim time. For small and mid-market companies with 10 to 500 employees, the stakes are high: a single ransomware event can cost six or seven figures, and a policy that does not respond because you failed to meet security prerequisites is worse than no policy at all. The five controls that appear on virtually every carrier's checklist are multi-factor authentication, endpoint detection and response, immutable backups, email filtering, and privileged access management. Understanding what each control requires, how carriers verify compliance, and where companies most often fall short is the difference between a policy that pays and one that fights you. This guide covers those cyber insurance security requirements in detail so you can approach your next renewal or first-time placement with confidence rather than guesswork.

Why Insurers Now Demand Specific Cybersecurity Controls

The relationship between cybersecurity posture and insurability has changed fundamentally since 2023. Carriers absorbed billions in ransomware losses between 2020 and 2023, and the market responded by tightening underwriting standards rather than simply raising premiums. The result is a baseline set of technical controls that are no longer suggestions: they are conditions of coverage.

The Shift from Optional to Mandatory Requirements

Before 2023, most cyber insurance applications asked whether you had antivirus software and a firewall. Carriers treated the application as a risk-scoring exercise, and a weak answer might increase your premium without disqualifying you. That era is over. Carriers now require specific technical controls as binding conditions, and failure to implement them can void coverage retroactively if a breach investigation reveals noncompliance.

This shift reflects real loss data. Claims involving organizations without MFA, for example, are dramatically more expensive to resolve. Underwriters have moved from subjective risk assessment to binary compliance checks: either the control exists and can be verified, or the application is declined.

How Security Maturity Impacts Your Policy Premiums

Premium pricing in 2026 is directly tied to the depth of your security program. Two companies in the same industry with identical revenue can see premiums differ by 40% or more based on which controls they have deployed and how well those controls are documented. Organizations running EDR solutions and maintaining tested backup protocols experience significantly lower claim costs, which carriers reward with lower rates.

Your security maturity also affects available limits. A company with all five core controls in place may qualify for $5 million in limits, while a company missing two of them might be capped at $1 million with higher retentions. The investment in controls often pays for itself through premium savings within the first policy term.

The Core Five: Mandatory Technical Requirements

Every major cyber insurance carrier in 2026 evaluates applicants against five categories of technical controls. Missing even one can trigger a declination or a restrictive endorsement that narrows your coverage.

Multi-Factor Authentication (MFA) and Privileged Access Management (PAM)

MFA is the single most scrutinized control on any cyber insurance application. Carriers want to see it enforced on all remote access points, email platforms, VPN connections, and administrative consoles. Roughly 65% of global small-to-medium businesses still do not use any form of multi-factor authentication, which means the majority of SMBs are either uninsurable or paying steep surcharges.

PAM works alongside MFA by restricting who holds administrative privileges and how those privileges are used. Carriers ask whether you enforce least-privilege principles, whether admin accounts are separated from daily-use accounts, and whether privileged sessions are logged. A company where every IT staff member has domain admin credentials on their daily workstation is a red flag that underwriters will not overlook.

The practical requirement: deploy MFA across all user accounts (not just admins), implement a PAM solution that vaults and rotates privileged credentials, and maintain audit logs that prove both controls are active.

Endpoint Detection and Response (EDR) vs. Traditional Antivirus

Traditional signature-based antivirus is no longer sufficient for cyber insurance qualification. Carriers specifically ask whether you run an EDR platform, and many application forms distinguish between "antivirus" and "EDR" as separate line items. The distinction matters because EDR provides behavioral analysis, real-time threat hunting, and automated response capabilities that legacy antivirus cannot match.

An EDR solution monitors every endpoint for suspicious behavior patterns, not just known malware signatures. It can isolate a compromised machine from the network in seconds, contain lateral movement, and provide forensic telemetry that accelerates incident response. Carriers value this because faster containment directly reduces claim severity.

If your organization still relies on traditional antivirus, expect your application to be flagged. Most carriers will either decline coverage or attach an endorsement excluding ransomware, which defeats the primary purpose of carrying the policy.

Immutable Backups and Advanced Email Filtering

Immutable backups are backups that cannot be altered, encrypted, or deleted by any user or process, including an attacker who has compromised your admin credentials. Carriers require this because ransomware operators routinely target backup systems first. If your backups can be encrypted alongside your production data, the carrier knows you will have no choice but to pay the ransom, and the carrier will bear that cost.

The standard now includes air-gapped or immutable backup copies stored offsite, tested restoration procedures documented at least quarterly, and retention periods long enough to recover from an attack that goes undetected for weeks. A backup strategy that has never been tested is, from an underwriting perspective, the same as having no backups.

Email filtering is the other half of this equation because email remains the primary attack vector for ransomware and business email compromise. Carriers expect advanced filtering that goes beyond basic spam blocking to include URL sandboxing, attachment detonation, impersonation detection, and DMARC/DKIM/SPF enforcement. A basic spam filter does not satisfy this requirement.

Comparing Coverage Readiness and Security Levels

Companies operating at the "minimum" column will struggle to obtain coverage at any price. The "adequate" column represents the threshold most carriers require, while the "comprehensive" column earns preferred pricing and broader limits.

Navigating the Cyber Insurance Application Process

The application itself is where many companies stumble. Misunderstanding a question or overstating your security posture can have serious consequences at claim time.

Common Pitfalls in Self-Attestation Forms

Most cyber insurance applications rely on self-attestation, meaning you are certifying under oath that specific controls are in place. The most common mistake is answering "yes" to a control that is only partially deployed. If you have MFA on email but not on VPN access, the accurate answer is "no" or "partial," not "yes."

Carriers investigate control attestations during claims. If a breach investigation reveals that you certified MFA was in place but it was not enforced on the compromised access point, the carrier may deny the claim entirely. At Bloc Cyber, we review application questions with clients line by line before submission because a single inaccurate attestation can invalidate coverage when you need it most.

Another frequent error is conflating planned controls with implemented ones. "We are rolling out EDR next quarter" does not satisfy a question asking whether EDR is currently deployed. Answer based on what is in production today.

Preparing for Third-Party Vulnerability Scans

Many carriers now conduct external vulnerability scans as part of the underwriting process, and scan results can directly affect your quote or eligibility. These scans typically check for open ports, unpatched software, expired SSL certificates, and exposed remote access services like RDP.

Run your own external scan before submitting an application. Address critical and high-severity findings first. Common issues that trigger underwriting concerns include exposed RDP (port 3389), end-of-life operating systems visible on public-facing infrastructure, and missing patches on web servers. Fixing these before the carrier scans you avoids delays and prevents unfavorable terms.

Keep documentation of remediation efforts. If a vulnerability existed and was patched, having a timestamped record shows the carrier that your security program is active and responsive.

Frequently Asked Questions About Cyber Requirements

Your Next Steps for Compliance and Coverage