What Does Cyber Insurance Actually Cover, and What Gets You Denied?

Three Key Takeaways

• Cyber insurance covers the costs of an attack, but only if you qualify. Meeting the cyber insurance requirements for small businesses is now the price of admission for a policy that pays out when it matters most. You may be wondering what does cyber insurance actually cover. 
• Claims get denied for preventable reasons. Misrepresenting your security controls, letting them lapse or missing a basic safeguard like multifactor authentication can void a claim (and it happens far more often than owners expect).
• The right IT partner protects your coverage. A managed provider helps you meet insurer requirements, document your controls and keep them in place, so your policy holds up under scrutiny.

Cyber insurance has gone from a nice-to-have to a near-necessity for small businesses. One ransomware attack or data breach can cost hundreds of thousands of dollars in recovery, and a good policy can be the difference between bouncing back and closing your doors.

But buying a policy isn’t the same as being covered. Insurers have tightened their standards dramatically, and they’ll deny claims when a business fails to hold up its end of the bargain. In fact, of roughly 38,000 cyber insurance claims closed in 2024, only about one in four resulted in a payout.

Based on these statistics, you could be paying premiums every month and still be left holding the bill after an attack, simply because you did not meet a requirement buried in your policy. Understanding what cyber insurance covers, what gets claims denied and what insurers expect from you is essential to making sure your coverage is real when you need it.

So, What Does Cyber Insurance Actually Cover?

Cyber insurance helps cover the financial fallout of a cyberattack or data breach. Most policies fall into two buckets: first-party coverage for your own losses, and third-party coverage for claims made against you by others.

Typical policy coverage may include:

• Ransomware and extortion: Ransom payments, negotiation costs and recovery from a ransomware attack.
• Data breach response: Notifying affected customers, credit monitoring and forensic investigation to determine the cause of the breach.
• Business interruption: Lost income while your systems are down after an attack.
• Legal and regulatory costs: Defense costs, settlements and fines tied to a breach.
• Data recovery: The cost of restoring lost or corrupted data and systems.

Coverage varies widely from one policy to the next, so the specifics are crucial. Many policies also carry sublimits that cap payouts for certain incident types, such as a lower cap for ransomware than the overall policy limit, so it’s worth a close read of the fine print. What is consistent across the industry, though, is that insurers now expect you to actively reduce your risk before they’ll pay out.

What Gets a Cyber Insurance Claim Denied?

A denied claim is the worst-case scenario: You paid your premiums, you suffered an attack and the insurer refuses to cover it. Unfortunately, this happens more often than most owners expect. Industry analyses have found that roughly 27 percent of data breach claims and 24 percent of first-party claims faced exclusions that led to non-payment or only partial payment. The good news? The reasons are usually preventable. Claims are commonly denied because a business:

• Misrepresented its security posture on the application. If you attested that you had certain protections in place and you did not, the insurer can void or even rescind the policy.
• Let required controls lapse. Coverage often depends on maintaining safeguards throughout the policy period, not just on the day you signed up. Your application functions as a continuing warranty.
• Failed to meet a specific requirement, such as multifactor authentication, endpoint protection or regular backups.
• Was negligent, ignoring known vulnerabilities or failing to install critical patches.
• Missed a notification deadline, waiting too long to report the incident. Many policies require notification within 48 to 72 hours of discovery.

The single biggest denial trigger is a mismatch between what you claimed and what you had in place, especially around MFA. In the landmark 2022 case Travelers v. International Control Services, an insurer rescinded a policy and denied a ransomware claim after a forensic investigation found that MFA had not been enabled on a single server, despite the application stating that MFA was deployed across all systems. The court sided with the insurer, and the ruling has become a template that insurers apply industry-wide.

In our experience, the most painful denials come from simple, preventable gaps: a business believed it was compliant, but couldn’t prove its controls were in place and maintained. That gap between “we think we’re covered” and “we can document that we’re covered” is where an experienced IT partner earns their keep.

Cyber Insurance Requirements for Small Business

Insurers have raised the bar on their requirements, with applications that read like a security audit. Carriers now verify what you attest to, sometimes with external scanning, rather than taking your word for it. While every carrier is different, most now expect small businesses to have a core set of protections in place before they’ll issue or renew a policy. Common requirements include:

• Multifactor authentication (MFA) on email, remote access, cloud consoles and administrator accounts. This is now close to universal, and its absence is the most-cited reason for denial. Coalition’s 2024 Cyber Claims Report found that 82 percent of denied claims involved organizations that lacked properly implemented MFA across their environment. It’s also highly effective: Microsoft has found that MFA blocks 99.9 percent of account-compromise attacks.
• Endpoint detection and response (EDR) to secure and monitor every device, on workstations and servers alike. Traditional antivirus no longer qualifies with most carriers. G6, for example, secures and monitors each device in your fleet so your team can work from anywhere with endpoint and cloud security in place.
• Regular, tested backups, ideally following the 3-2-1 rule (three copies, two media types, one offsite) with documented restore tests, so you can recover without paying a ransom. Typically, a dependable backup and disaster recovery plan is required.
• Employee security awareness training to reduce the phishing and human-error risks behind most breaches.
• A patch management process to keep systems current and close known vulnerabilities.
• An incident response plan so you can act quickly and meet reporting deadlines.

If it sounds like a lot, it can be. But every control an insurer asks for is one that lowers your real risk of an attack. Working with a managed IT and cybersecurity provider covers both at once, since the steps that qualify you for coverage are the same ones that keep you secure.

How an IT Partner Helps You Qualify and Stay Covered

Navigating these requirements alone is tough, especially for a small business without a dedicated security team. That’s where an IT partner like G6 IT comes in. A strong provider will assess your current environment against insurer expectations, implement the controls you’re missing and document and maintain them over time.

This documentation is more important than most owners realize. When a claim is filed, the insurer will want proof that your safeguards were in place and working, not just that you answered “yes” on an application. A provider that proactively monitors your systems and maintains records of your security posture logs the exact evidence you need when filing a claim. G6 IT, a veteran-owned provider with CJIS compliance and experience in regulated industries, helps businesses reduce risk, maintain compliance and keep their coverage intact.

Getting Clear: What Does Cyber Insurance Actually Cover

Cyber insurance is a critical safety net, but it’s not a substitute for good security — and it won’t pay out if you haven’t met your obligations. Understanding what your policy covers, what could cause a claim denial and what insurers require is the first step. The next step: ensuring those requirements are met and maintained day in and day out.

If you’re unsure whether your business meets today’s cyber insurance requirements for small business, or whether your current protections would hold up to a claim, it may be time for an expert review. Reach out to G6 IT for a no-obligation assessment of your technology environment and find out where you stand before an attack (or an audit) puts your coverage to the test.

Frequently Asked Questions

Is cyber insurance required for small businesses? 

While it’s not legally required in most cases, it is increasingly expected by clients and partners (and some contracts will mandate it). Even when it’s not required, however, the financial protection it offers makes it a smart investment.

Why do insurers require multifactor authentication? 

Multifactor authentication is one of the most effective ways to stop unauthorized access, even when a password is stolen. Because compromised credentials are behind so many breaches, insurers see MFA as a baseline control and often will not issue a policy without it. Partial MFA is treated much like no MFA, so it needs to be enforced on every account and system.

Can a cyber insurance claim really be denied? 

Yes. Claims can be denied if a business misrepresented its security controls, let required safeguards lapse or failed to meet a specific policy requirement. Courts have upheld denials even when the misrepresentation was unintentional and even when the gap did not directly cause the breach, which is why maintaining and documenting your protections is so critical.

How can a small business meet cyber insurance requirements affordably? 

Partnering with a managed IT and cybersecurity provider is often the most cost-effective route. Instead of hiring an in-house security team, you gain access to the tools, expertise and monitoring needed to meet insurer requirements for a predictable monthly cost.