The information on this website is general in nature and does not take into account your objectives, financial situation, or needs. Consider seeking personal advice from a licensed adviser before acting on any information.
Cyber insurance is one of the most valuable business covers available today, but it is also one of the most confusing to apply for. Many business owners expect it to work like other insurance types, where you provide basic details such as turnover, industry, and location, then receive a quote. Cyber insurance is different. It behaves less like a simple application and more like a risk interview.
This is because cyber insurance claims are often expensive, complex, and fast-moving. If an incident happens, the insurer may need to pay for IT specialists, legal support, data breach experts, customer notification costs, and business interruption losses. For that reason, the insurer needs to understand your cyber risk before they offer cover, and that’s where underwriting questions come in.
Underwriting questions are simply the insurer’s way of measuring risk. They help the insurer estimate how likely it is that a cyber incident will happen, how severe it could be, and how quickly your business could recover. The problem is that many of these questions include terms that business owners don’t use in everyday operations. Even businesses with strong IT support often struggle to answer quickly, because the person completing the form is not the same person who manages the technical systems. The result is a knowledge gap that slows down applications and causes frustration.
This article will guide you through the main types of questions cyber insurers ask, what those questions really mean, and how to approach them calmly and confidently.
Why cyber insurers ask so many questions
Unlike other policies where the risks are fairly consistent across businesses, cyber risk changes dramatically depending on how you operate. A small professional services company that stores client records and uses email all day can be a higher cyber risk than a larger company that has minimal data and fewer online systems. The insurer is not only looking at “size”; they’re looking at how exposed your systems are, how attractive your business is to attackers, and how prepared you are to recover if something goes wrong.
Insurers also know that many cyber incidents don’t start with a complex “hack.” Some of the most common claims begin with a simple email scam, a stolen password, or a staff member clicking a malicious link. That is why the underwriting process looks closely at everyday controls rather than just technical jargon.
The first category of questions: what your business does and how digital it is
The application usually begins with questions about your business profile. This includes your industry, your annual revenue, your number of employees, and sometimes whether you operate internationally. These questions help insurers understand the scale of your operations, but they also help estimate the potential financial impact of an outage.
You may also be asked how much of your business depends on online systems. For example, if your website takes bookings, if your point-of-sale runs through the internet, or if your staff cannot work without email access, then downtime becomes a major financial exposure. Cyber insurance is often designed to respond to this kind of interruption, so underwriters want to understand how reliant you are on technology.
The second category: what data you hold (and why that matters)
This is one of the most important parts of cyber underwriting, and it is where many business owners feel uncertain.
You may be asked whether you store personal information on customers, employees, or suppliers. Personal information generally means anything that identifies a person, such as name, date of birth, address, email, phone number, bank details, or identity documents. You may also be asked how many records you store. This does not need to be exact; insurers usually want a realistic estimate. Storing a few hundred records is very different from storing hundreds of thousands.
Underwriters may also ask whether you store sensitive data, such as health information or financial records. If your business deals with medical details, legal documents, or financial account information, the cost of a breach becomes much higher because the response often includes legal support and regulatory notification processes.
A simple way to think about it is this: the more data you hold, and the more sensitive that data is, the more costly it becomes if it is stolen, leaked, or locked up by ransomware.
The third category: the question you will almost certainly be asked - MFA
If there is one term you will see repeatedly in cyber insurance applications, it is MFA.
MFA stands for multi-factor authentication. In plain English, it means that logging in requires more than just a password. A password alone is considered “single factor.” MFA adds another step, usually a code sent to your phone, an authentication app prompt, or a device confirmation.
Underwriters ask about MFA because password theft is one of the most common ways criminals access business systems. If an attacker steals a password and there is no MFA, they can log in as if they were the user. If MFA is switched on, the stolen password alone won’t usually be enough.
Many cyber insurers now treat MFA as a baseline requirement. They often don’t just ask whether you have MFA; they ask where it is used. The most important areas are email systems, remote access, cloud services, and administrator accounts. If MFA is missing from email, this is a major red flag because email is often the gateway into everything else.
The fourth category: remote access and why underwriters worry about it
Insurers will commonly ask how your business handles remote access. Remote access means staff or contractors logging in to business systems from outside the office. This includes working from home, travelling, or accessing systems after hours.
A term that sometimes appears here is VPN. A VPN is a “virtual private network.” You can think of it as a secure tunnel between someone outside the office and the office network. It allows people to connect safely, rather than leaving systems open to the public internet.
Another term that appears here is RDP, which stands for Remote Desktop Protocol. This is a method of controlling a computer remotely. It’s useful, but if it is exposed to the internet without proper protection, it can be an entry point for cybercriminals. That is why insurers ask whether RDP is used, and if so, how it is secured.
Businesses sometimes don’t know whether they “use RDP.” Many do without realising it, because it can be enabled by IT support for remote troubleshooting. This is a very common example of where insurers ask a technical question that business owners are not expected to answer alone.
The fifth category: backups, and the question insurers really want answered
Most businesses will say they have backups. Cyber insurers will typically go further, because they want to know whether the backups will actually work during a ransomware incident.
Underwriting questions often focus on how backups are stored and whether they are tested. Backup testing simply means proving that files can be restored. It is surprisingly common for businesses to have backups running for months or years without having tested that they can successfully restore systems in a real emergency.
You may also see the term “offline backups” or “immutable backups.” Offline means the backup is separated from the main system so it cannot be infected or encrypted at the same time. Immutable means the backup cannot be edited or overwritten, even if a criminal gains access. These features matter because ransomware attackers often try to encrypt backups as well as live systems.
If insurers understand that your backups are reliable and protected, it significantly reduces the likelihood of a large loss, because it means your business may be able to restore without paying a ransom.
The sixth category: security tools, patching, and software updates
Underwriters commonly ask what security software you run on computers and servers. Some forms mention antivirus, which most people know. Others mention EDR, which is less familiar.
EDR stands for Endpoint Detection and Response. The simplest way to understand EDR is this: it is a more advanced form of protection that not only blocks known threats, but also looks for suspicious activity and helps detect intrusions early. If antivirus is a lock on the door, EDR is more like an alarm system that can identify when something unusual is happening inside.
Underwriters also ask about patching. Patching means installing updates that fix known security vulnerabilities in software. Cybercriminals frequently exploit outdated systems because the weaknesses are public knowledge and easy to target. This is why you may be asked how quickly you install updates, and whether you still use systems that are no longer supported.
Older unsupported systems are often referred to as “end-of-life.” End-of-life means the vendor no longer provides security updates. Insurers care about this because unsupported systems become easier to compromise over time.
The seventh category: incident response, and what you would do if something happened
It is common to be asked whether you have an incident response plan. This sounds intimidating, but it does not mean you need a complex 100-page manual. An incident response plan is simply a documented process that outlines what happens when an incident occurs.
Underwriters care about this because the first few hours after a cyber incident are critical. A business that knows who to call, how to isolate systems, and how to communicate with customers can reduce losses significantly. A business that scrambles without direction often experiences longer downtime and higher costs.
Insurers may ask whether you have access to external IT support, whether you work with a managed service provider, and whether you have ever practised or rehearsed response steps.
The eighth category: staff behaviour and preventing scams
A major part of cyber underwriting focuses on human risk. Many businesses are surprised by this, because they assume cyber insurance is only about hackers. In reality, some of the most expensive cyber incidents involve social engineering. Social engineering is simply the technical term for tricking people. This includes phishing emails, fake invoices, impersonation phone calls, and payment redirection scams.
That’s why insurers often ask whether you provide cyber awareness training to staff. They may ask whether you run phishing simulations. They may also ask about payment verification procedures, such as whether staff must confirm bank detail changes through a second method.
These questions are not designed to catch you out. They are designed to measure whether a simple human mistake could lead to a large financial loss.
Why you should not answer cyber underwriting questions alone
One of the most important things business owners should understand is this: you are not expected to know all of these answers from memory.
Cyber underwriting questions are often best answered in collaboration with your IT provider or managed service provider. If you have outsourced IT, you likely have stronger controls than you realise, but you may not know the exact details. The fastest and most accurate path is often to complete the application with your broker while your IT provider helps confirm the technical components.
This also reduces the risk of unintentionally answering incorrectly, which can create problems later. Insurance applications are important documents, and accuracy matters. If you are unsure, it is better to say you will confirm with IT than to guess.
The real benefit: these questions show you what cyber risk actually looks like
Even though cyber proposals can feel confronting, they can also be valuable. They highlight the controls that truly reduce cyber losses. They show where insurers are focusing risk. They reveal what cybercriminals exploit most often. And they can even give you a roadmap for strengthening your business, not just “buying a policy.”
In many cases, the goal is not to prove you are perfect. The goal is to show that you are prepared, that you manage access responsibly, that you can restore your business if systems go down, and that you have sensible safeguards in place.
Final thought: cyber insurance is easier when you’re prepared
If you approach cyber insurance the same way you approach your accounting or legal responsibilities, it becomes far less intimidating. The insurer is not asking you to be a cybersecurity expert. They are simply looking for evidence that cyber risk is being taken seriously and managed appropriately.
When you understand what the questions really mean, cyber insurance becomes less like a confusing technical interrogation and more like a practical process for ensuring your business is protected in a modern risk environment.
Published: Friday, 16th Jan 2026
Author: Paige Estritori
The bit about not guessing on MFA/RDP answers is spot on, I’ve seen owners assume “IT has it covered” and then realise nobody’s actually checked remote access settings before applying for cyber insurance.