9 Min. Read Time<\/p>\n
Over 40 percent of companies that report a cyber damage incident receive no payout. 72 percent of small and medium-sized enterprises are completely uninsured. And premiums are rising again by 15 to 20 percent after two years of decline. At the same time, underwriting is becoming more technical than ever: Insurers no longer check if MFA exists, but whether it is implemented comprehensively. The distinction between coverage and rejection is decided by five concrete controls.<\/strong><\/p>\n Key Takeaways<\/p>\n Five years ago, cyber underwriting consisted of a questionnaire with 20 yes\/no questions. Today, it’s a technical assessment. Insurers like Munich Re, Allianz, and Zurich work with specialized service providers that scan the actual security situation, not just the claimed one. More on this in the article on Cyber Insurance<\/a>.<\/p>\n Specifically, insurers check: How many accounts have MFA enabled (not 80 percent, but 100 percent)? Are all endpoints covered by EDR (not just managed ones, but also BYOD)? Are backups regularly tested for recoverability (not just created)? Is there an incident response plan that was tested in a tabletop exercise in the last 12 months?<\/p>\n The consequence: Companies that claim to have controls in place during the application process, but don’t actually implement them, risk having their claims denied in the event of a loss. The insurer checks after the incident whether the stated controls were actually active at the time of the attack. If they weren’t, the policy is void.<\/p>\n 1. MFA on all accounts and systems.<\/strong> Not just for admins, not just for VPN access. For every user, on every identity system. The distinction between “MFA exists” and “MFA is consistently enforced” is the decisive point in underwriting. Phishing-resistant MFA (FIDO2, hardware tokens) is increasingly preferred over SMS or app-based MFA.<\/p>\n 2. EDR on all endpoints.<\/strong> Continuous monitoring across all endpoints, with active response capability. Not just detection, but isolation and remediation. CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne are the most frequently accepted solutions. Antivirus alone is no longer recognized.<\/p>\n 3. Immutable backups with documented restore test.<\/strong> Backups that cannot be encrypted or deleted by ransomware. Air-gapped or cloud-isolated. And proof that restoration is regularly tested. A backup without a restore test is not a backup.<\/p>\n 4. Tested incident response plan.<\/strong> An IR plan in a file cabinet is not enough. Insurers demand proof of a tabletop exercise in the last 12 months. Who is responsible? How is it escalated? When is the insurer informed? Most policies require notification within 24 to 72 hours after discovering an incident.<\/p>\n 5. Documented patch management.<\/strong> Critical patches within 14 days. Documented exceptions with risk acceptance. Automated vulnerability scanning as proof. Insurers increasingly check Mean Time to Patch (MTTP) as a KPI.<\/p>\n \n“Insurers have evolved from blanket actuarial models to technical underwriting that assesses how controls actually work. The question is no longer whether MFA exists, but whether it is consistently enforced.” The European cyber insurance market was estimated at 1.51 billion US dollars in 2025 and is expected to grow to 5.47 billion US dollars by 2034 (17 percent CAGR). The German market alone is expected to reach 2 billion Euro, driven by NIS2 compliance requirements<\/a> and growing awareness after high-profile attacks on German companies.<\/p>\n But the coverage ratio is alarmingly low. Over 70 percent of companies in Germany, France, Italy, and Spain are uninsured. The figure is even worse in the mid-market. Many companies shy away from premiums or fail underwriting: without MFA, EDR, and backups, there is no policy.<\/p>\n The DACH market has a peculiarity: regulatory density (NIS2, DORA, KRITIS-Dachgesetz) drives demand. Companies that fall under NIS2 need the controls that insurers demand anyway. Cyber insurance<\/a> thus becomes a byproduct of NIS2 compliance<\/a>: those who are compliant get insurance, those who are not compliant get neither.<\/p>\n By 2026, new exclusions will emerge that CISOs need to be aware of. Insurers are increasingly introducing AI-specific clauses: damages caused by Shadow AI (unauthorized AI tool usage) can be considered gross negligence if no AI usage policy exists. AI-generated deepfake attacks are explicitly excluded by some policies.<\/p>\n Other typical exclusions in 2026: war and state-sponsored attacks (the demarcation is disputed), systematic cloud outages of a hyperscaler (“systemic risk”), known and unpatched vulnerabilities (after the patch deadline has expired, they are no longer covered by insurance), and voluntary ransom payments without prior consultation with the insurer.<\/p>\n For CISOs, this means: read the policy carefully. Not just the coverage amount, but the exclusions. A typical mistake: companies purchase a cyber policy and assume that ransomware payments are covered. In many policies, this is only the case if the insurer is involved before payment and the payment is explicitly approved.<\/p>\n The five mandatory controls are not only a prerequisite for coverage. They also determine the premium. Companies that have demonstrably implemented all five measures pay 50 to 60 percent less than companies without these controls.<\/p>\n Additional premium reducers: Network segmentation<\/a> (limits the blast radius of an attack), DNS layer protection (filters threats before they reach the network), regular penetration tests (at least annually, documented), and a SOC or Managed Detection and Response (MDR) service.<\/p>\n The most cost-effective strategy: establish NIS2 compliance as a basis (the controls overlap by 80 percent with insurance requirements), then purchase the policy. Companies that first purchase insurance and then implement the controls pay high premiums and risk having their claims denied.<\/p>\n A cyber insurance policy is not a replacement for security. It is a safety net in case security fails. But this net has holes: 40 percent of claims are rejected, and the requirements are increasing annually. For DACH companies, the combination of NIS2 compliance and cyber insurance is the most pragmatic approach: the same controls meet both requirements. The five mandatory measures (MFA, EDR, immutable backups, tested IR plan, and patch management) are non-negotiable. Without them, there will be no coverage or compliance in 2026. With them, premiums decrease by up to 60 percent. The math is simple.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n For a company with 50 to 500 employees: 3,000 to 25,000 Euro annual premium for a coverage amount of 1 to 5 million Euro. The exact premium depends on industry, revenue, IT security level, and claims history. Companies with demonstrably strong controls pay at the lower end of the range.<\/p>\n<\/details>\n Yes. If controls stated during underwriting (e.g., MFA implemented company-wide) were not active at the time of the attack, the insurer can deny coverage. This also applies if known vulnerabilities were not patched within the agreed timeframe. The policy is not a blank check, but is subject to conditions.<\/p>\n<\/details>\n In many policies, yes, but only under certain conditions: the insurer must be involved before payment, and the payment must be approved. Independent payments without consultation can void insurance coverage. Some insurers exclude ransom payments entirely. The clause must be reviewed before signing.<\/p>\n<\/details>\n Healthcare, financial services, and critical infrastructure have the highest premiums because they are the most attractive targets for attackers and have the strictest regulatory requirements. Manufacturing and logistics companies are also more affected in 2026 due to increasing OT security incidents.<\/p>\n<\/details>\n No. Insurance is a financial risk transfer, not a technical protection. It covers costs after an incident (forensics, legal advice, notifications, business interruption). It doesn’t prevent the incident. Moreover, without technical controls (MFA, EDR, backups), there’s no insurance policy. Security is a prerequisite for insurance, not the other way around.<\/p>\n<\/details>\n PAM: Why Admin Accounts Are the Biggest Entry Point<\/a><\/p>\n NIS2 in Germany: What Companies Need to Know<\/p>\n Shadow AI: When Employees Use ChatGPT<\/p>\n More from the MBF Media Network<\/p>\n Source title image: Pexels \/ Mikhail Nilov (px:7734589)<\/p>\n","protected":false},"excerpt":{"rendered":"Over 40 percent of companies that report a cyber damage incident receive no payout. 72 percent of small and medium-sized enterprises are completely uninsured. And premiums are rising again by 15 to 20 percent after two years of decline. At the same time, underwriting is becoming more technical than ever: Insurers […]","protected":false},"author":55,"featured_media":5603,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyber insurance","_yoast_wpseo_title":"Cyber Insurance 2026: What Insurers Really Check and What CISOs Must Prepare For","_yoast_wpseo_metadesc":"Cyber insurance 2026: Avoid claim denials with stronger security prep\u2014learn what insurers audit and how CISOs can secure coverage. Read now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5604"],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-7759","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":9,"wpml_language":"en","wpml_translation_of":5604,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7759"}],"version-history":[{"count":9,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7759\/revisions"}],"predecessor-version":[{"id":19597,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7759\/revisions\/19597"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5603"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
From questionnaire to technical review: How underwriting works in 2026<\/h2>\n
The 5 Controls that Decide Coverage or Rejection<\/h2>\n
\nSecureAIT, Cyber Insurance Requirements 2026<\/cite>\n<\/p><\/blockquote>\nDACH Market: Underinsured and in Flux<\/h2>\n
AI Exclusions and New Coverage Gaps<\/h2>\n
Premium Optimization: What Really Drives the Price<\/h2>\n
Conclusion<\/h2>\n
Frequently Asked Questions<\/h2>\n
What does cyber insurance cost for mid-sized businesses?<\/strong><\/summary>\n
Can the insurer retroactively deny coverage in the event of a claim?<\/strong><\/summary>\n
Is ransomware payment insured?<\/strong><\/summary>\n
Which industries pay the highest premiums?<\/strong><\/summary>\n
Is Cyber Insurance Enough as a Security Strategy?<\/strong><\/summary>\n
Read More<\/h2>\n