Cyber insurance can be vital to small businesses. The Association of British Insurers reported that £197 million was paid out by participating insurers to help UK businesses recover from cyber incidents in 2024. Malware and ransomware accounted for more than half of those claims.
It’s worth remembering though that cyber insurance is not a shortcut around cyber security.
It is not a magic safety net that will always pay out regardless of what was written on the application form.
…and that is where some businesses could run into trouble.
The uncomfortable question
When you apply for cyber insurance, you are usually asked questions about your security controls.
Questions such as:
Do you use multi-factor authentication?
Do you have endpoint detection and response?
Are backups taken regularly?
Are backups disconnected or protected from ransomware?
Do you test restores?
Do you patch critical systems?
Do you train staff to spot phishing?
Do you use email filtering?
These are not throwaway questions – they help the insurer decide whether to offer cover, what terms to apply and what premium to charge.
That means your answers need to be accurate. Not roughly right. Not “we plan to”. Not “we think our IT provider probably does that”. Accurate.
Why this matters
Under the Insurance Act 2015, commercial policyholders have a duty to make a fair presentation of risk. In simple terms, the insurer needs to be given enough accurate information to understand the risk it is being asked to insure.
The Financial Ombudsman Service explains that, where an insurer finds information was misrepresented when a policy was taken out, the insurer may argue it would have acted differently had it been given the true answers. Depending on the circumstances, that can lead to a claim being declined, settled proportionately, restricted, or the policy being voided.
This does not mean every mistake automatically invalidates a policy. It does mean the answers matter.
A Financial Ombudsman decision involving Hadron quotes the Insurance Act 2015 remedies. If a qualifying breach was deliberate or reckless, the insurer may avoid the contract and refuse all claims. If the breach was not deliberate or reckless, the outcome depends on what the insurer would have done had the risk been presented fairly. In some cases, that can still mean avoiding the contract and refusing claims. In others, it can mean applying different terms or reducing the amount paid.
That is the important point for small businesses. The risk is not just having a cyber incident. The risk is having a cyber incident and then discovering that the business cannot prove the controls it said it had.
Cyber insurers do ask about these controls
This is not theoretical. UK cyber insurance application forms ask detailed questions about security controls.
DUAL’s cyber proposal form reminds applicants that they have a duty to make a fair presentation of risk. It says failure to disclose a material circumstance may, in some circumstances, allow the insurer to avoid the policy from inception, meaning claims would not be paid. It also says the duty applies before cover is placed, when it is renewed and when it is varied.
The same DUAL form asks about email filtering, multi-factor authentication for Office 365, endpoint detection and response, security operations capability, MFA for all remote access, MFA for privileged accounts, weekly backups, disconnected or protected backups, restore testing and patching within 30 days.
CFC’s UK cyber application asks how backups are stored, how often they run, how they are secured and how often restore testing is carried out. It also asks whether EDR is used, whether it is deployed on all endpoints, whether MFA protects remote access, cloud resources and email, and whether phishing simulations and email filtering are in place.
Beazley’s cyber application asks whether MFA is required for remote access and web-based email, what email security controls are in place, how often phishing training is carried out, whether company devices are protected with anti-virus, anti-malware or endpoint protection, whether critical data is backed up, and whether critical patches are actively managed and installed across internet-facing systems.
Chubb’s UK cyber proposal form goes even further in places. It asks what percentage of users remote access controls apply to, including standard employees, contractors, vendors and privileged users. It asks for exceptions. It also asks about ransomware-safe backup strategies, annual restore tests, EDR/MDR/XDR coverage percentages and whether alerts feed into a SIEM or similar system.
So if a business says “yes” to these questions, it needs to know what “yes” actually means.
Where businesses can get caught out
The problem is often not dishonesty. It is assumption.
Someone fills in the proposal form and answers “yes” to MFA, but MFA only applies to some users.
Or it covers Microsoft 365, but not remote access.
Or staff accounts are protected, but admin accounts are not.
Or a third-party supplier still has access without MFA.
The business answers “yes” to backups.
But no one has checked whether the backup has worked recently.
Or the backup is connected to the same environment the attacker could reach.
Or restores have never been tested.
The business answers “yes” to endpoint protection or EDR.
But old laptops, servers, remote devices or new starters are missing from coverage.
The business answers “yes” to patching.
But there is no record showing when critical updates were applied.
This is what I mean by slippage.
A control may have existed when the insurance was arranged, but over time the business changes. New users are added. Devices are replaced. Suppliers are given access. Licences lapse. Backups fail. Admin accounts multiply. Exceptions become normal.
By renewal, the original answer may no longer reflect reality.
Are UK cyber claims definitely being denied because of this?
This is where we need to be careful. There is strong UK evidence that insurers can avoid policies or decline claims where information given during the insurance process was inaccurate or incomplete.
For example, in one Financial Ombudsman decision involving UKI, the policy was avoided, premiums were retained and an outstanding claim was declined after the insurer said cover would not have been offered had there been a fair presentation of risk.
In another commercial insurance decision, ERGO avoided a business policy and refused to pay a theft claim after it said material facts had not been disclosed on the proposal form. The Ombudsman recorded that ERGO considered this a qualifying careless misrepresentation which entitled it to avoid the policy, decline the claim and refund the premium.
Those examples are not cyber control cases.
So it would be wrong to claim that UK cyber insurers are routinely denying claims because businesses let MFA, EDR or backups slip.
The safer and more accurate point is this:
If your cyber insurance application says you have certain controls in place, and those answers are wrong, incomplete or no longer true at renewal, the insurer may have grounds to challenge, reduce or refuse a claim depending on the facts.
That is a serious enough risk on its own.
Cyber insurance should be part of the plan, not the whole plan
Cyber insurance can help with incident response, recovery costs, business interruption and specialist support.
But it works best when it sits alongside good cyber hygiene.
That means:
Knowing where MFA is enabled.
Knowing which devices are protected.
Knowing whether backups are working.
Testing restores.
Keeping evidence of patching.
Reviewing admin accounts.
Checking supplier access.
Recording exceptions.
Updating your broker or insurer when something material changes.
The UK Government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses reported experiencing a cyber security breach or attack in the previous 12 months. Phishing remained the most common type of breach or attack by far.
So the issue is not whether cyber risk exists. It does.
The issue is whether your business can recover from an incident and show that the information given to your insurer was accurate.
A practical check before renewal
Before renewing cyber insurance, ask yourself:
Can we prove MFA is enabled where we said it is?
Are all users, admins and remote access routes covered?
Do we know which devices have endpoint protection or EDR installed?
Are backups completing successfully?
Are backups protected from ransomware?
When did we last test a restore?
Do we have evidence of patching?
Have we documented exceptions?
Has anything changed since last year’s application?
Has anyone checked the answers with the people who actually manage the systems?
This does not need to be complicated.
But it does need to be deliberate.
Cyber insurance is not just about buying a policy.
It is about being able to stand behind the answers you gave.
If you say you have MFA, make sure you do.
If you say backups are tested, make sure they are.
If you say devices are protected, check the list.
If you are not sure, do not guess.
Because after a cyber incident, the worst time to discover a gap is when your business is already under pressure and your insurer starts asking questions.
Cyber insurance can be a useful safety net.
But only if the net is actually there.
