Do You Have Cyber Insurance?
If So, Are You Actually Covered?
Cyber insurance used to be simple.
Buy a policy.
Pay the premium.
You are covered.
Not anymore.
In the last two years, insurers have rewritten the rules. Requirements are stricter. Claims are denied more often. Entire companies are being dropped from coverage because their cyber hygiene does not meet today’s standards.
Most CEOs do not realize how much the game has changed.
Today’s question is not
“Do you have cyber insurance?”
It is
“Would your insurance actually pay during an incident?”
Let’s break it down.
1. Your policy is only as good as your security controls
Insurance companies used to assume everyone had the basics in place.
Now they want proof.
They expect:
• MFA everywhere
• EDR (real monitoring) on every device
• Immutable backups
• A written incident response plan
• Vendor access controls
• Quarterly security reviews
• Proof of employee security training
• Verified offboarding procedures
If any of those are missing, your coverage can be denied.
Not reduced.
Denied entirely.
This is why many companies have a policy on paper but no actual protection in practice.
The fix:
Ask your provider to show you, in writing, which security controls are required for payout. Then verify each control is active, enforced, and documented.
2. If employees are not trained, your claim is already at risk
One untrained employee can sink your entire policy.
Insurers now require:
• Annual cybersecurity awareness training
• Phishing simulations
• Incident reporting procedures
• A documented plan for what to do when something “looks wrong”
If an employee clicks a malicious link, acts outside policy, or delays reporting an incident, insurers can argue that the company failed to meet the policy’s standards.
Common red flags insurers use to deny claims:
• “The employee was never trained.”
• “No record of cybersecurity instruction.”
• “No documented response steps.”
• “The business did not follow its own policy.”
Training is no longer optional.
It is an insurance requirement.
The fix:
Formalize training. Track completion. Run simulations. Keep records. Compliance is your protection.
3. Many companies will be dropped from coverage next renewal cycle
Insurers are tightening their criteria because they are paying out more than ever.
Here is what gets businesses dropped:
• Weak MFA enforcement
• Missing or outdated endpoint protection
• Backup systems connected to the network
• No documented offboarding
• Shadow IT or unknown accounts
• No quarterly IT auditing
• Inadequate vendor management
If your cyber hygiene does not meet the carrier’s new standards, you will not be renewed. This is happening everywhere, especially to fast-growing companies.
The scary part:
Most CEOs do not find out until they try to renew and are told, “You no longer qualify.”
The fix:
Ask your insurer for a pre-renewal cyber requirements checklist. Complete it before renewal season, not after.
4. Who would be your first call during an incident? It might not be who you think
It is simple, but most companies still get it wrong.
Many think the first call should be to their insurance carrier.
But that is like calling your insurance company before calling the fire department.
Do not do that.
Your first call must be to your IT provider or MSP.
They are the ones who can stop the threat, contain the damage, and prevent the attack from spreading.
Once the fire is under control, then comes the insurance.
Here is the correct call order:
Your IT provider or MSP (stop the threat, isolate systems, preserve evidence)
Your insurance carrier’s incident hotline (report the incident and activate coverage)
Your cyber attorney (guide communication, compliance, and liability protection)
Why this order?
Because if you call insurance first and no one is stopping the attack, you are losing minutes, and those minutes cost money, data, and downtime.
But if your IT team jumps into full remediation without insurance approval, you risk compliance issues or denied coverage.
So the rule is simple:
Stop the threat first.
Then communicate.
Then remediate.
The fix:
• Build a one-page Incident Response Call Sheet
• Put your IT provider at the top
• Train your team so no one panics
• Review it quarterly
During an incident, the first five minutes matter more than the next five hours.
Call the fire department first, then the insurance.
The Bottom Line
You may have cyber insurance.
But that does not mean you are protected.
Coverage today depends on:
• Controls you can prove
• Training you can document
• Procedures you follow
• The order of calls you make in a crisis
Cyber insurance is no longer a safety net.
It is a partnership with strict obligations.
The question every CEO needs to ask is simple:
If something happened today, would my policy actually pay out?
If you cannot answer with confidence, there is work to do.
Written by Hunter Hampton
The Cybersecurity Fly Guy — real-world insights for business leaders who want to stay protected, productive, and profitable.
If you found this helpful, subscribe to The Executive Cyber Brief, a weekly read that keeps decision-makers ahead of cyber risks without all the technical noise.
👉 Subscribe here: cybersecurityflyguy.substack.com
Next Week’s Topic:
“The Four Hidden Cyber Risks CEOs Never Hear About Until It Is Too Late.”