Marsh's Global Insurance Market Index for the second quarter of 2026 reports that cyber insurance rates declined by 4%, "the twelfth consecutive quarter of declines." A soft market does not mean an easy application. Underwriters still ask about the controls that matter in a claim, and At-Bay's 2026 InsurSec Report says remote access services were the entry point for 87% of the ransomware claims it saw in 2025.
What's affected
Forms differ, but the questions cluster around a handful of controls. Here is what they usually ask and the evidence that backs a truthful answer.
| Typical question | Evidence to have ready |
|---|---|
| MFA on email, remote access and admin accounts? | Identity provider policy export, list of exceptions |
| Remote access exposed to the internet? | Firewall or VPN inventory, patch status |
| Endpoint detection on all devices? | Coverage report from your EDR console |
| Backups offline or immutable, and tested? | Restore test log with dates |
| Critical patches applied within what time? | Patch policy and last quarter's ticket data |
| Written, tested incident response plan? | The plan and the last tabletop notes |
| Security training and phishing tests? | Completion records |
| Do you use end-of-life software? | Software inventory |
| How many personal records do you hold? | Data map or estimate method |
What to do now
- Ask your broker for the application early and read every question, including the definitions. "MFA" on a form may mean phishing-resistant MFA, or all users, or only privileged ones.
- Answer with what is true today, not what is planned. If a control covers 80% of devices, say so and give the date for the rest.
- Collect the evidence in the table before you submit, and keep a copy of the signed form with it.
- Name one person who owns the answers, and have an engineer check each technical claim.
- Ask your broker how an inaccurate answer would affect a claim. Applications are part of the contract.
- Fix the commonly weak spots first: remote access exposure, MFA exceptions and untested backups.
- Keep your incident plan in line with the policy's notice requirements. Many policies expect prompt notice and may require approved forensics or counsel.
Why it matters
A well-prepared application is mostly an exercise in knowing your own environment. If you can produce a restore test log, an MFA export and a patch report in an afternoon, you can also answer enterprise customer questionnaires faster, which is the other place these same questions appear.
Treat each "no" as a to-do item, not a failure. An honest "not yet, completing by date" is better than a "yes" you cannot support when a claim is filed.
Quick check
Why give honest partial answers?
Because the application forms part of the insurance contract, and a claim can turn on whether the answers were accurate. Partial coverage with a dated plan is something you can support.
