Financial Risk Insurance Reality

June 2026  ·  8 min read

Your Cyber Insurance Policy Has a Secret. 40% of Claims Get Denied. Here's What Voids Yours.

71% of CFOs believe their cyber insurance policy covers most attack-related losses. The data says otherwise. 40% of claims are denied. 27% of data breach claims hit exclusions that result in no payout or partial payout. The coverage you're paying for may not be the coverage you'll receive — and the reasons are buried in the policy language most SMB owners have never read.

---

Cyber insurance was supposed to be the safety net. The post-breach survival plan. The thing that meant a $254,000 average attack cost didn't necessarily mean $254,000 out of pocket. And for businesses that understand exactly what their policy covers, maintain the controls their policy requires, and report incidents within the required window — it often is.

For businesses that don't, it isn't. And the gap between those two categories is larger than most CFOs, owners, and IT managers realize until the moment they file a claim and discover the answer is no.

40%

of cyber insurance claims are denied — rising to more than 40% in 2026

The most common reasons: missing or undocumented MFA, late incident notification, security controls that lapsed after policy inception, and exclusion clauses the policyholder didn't know existed. Not fraud. Not misuse. Administrative and technical failures that void coverage at exactly the moment it's needed most.

The 40% figure captures the full picture — denials, partial payouts, and claims that hit sublimits. The more specific numbers are equally alarming: 27% of data breach claims and 24% of first-party claims hit exclusions that resulted in no payment or partial payment. And 82% of denied claims involved organizations that lacked MFA — not because MFA was excluded from their policy, but because their policy required MFA and they either didn't have it fully implemented or couldn't prove they did.

71% of CFOs wrongly believe their cyber insurance policy covers most attack-related losses — the expectation gap is enormous Verticomm / Insurance industry surveys 2026

17% of all claim denials in 2025 happened for one reason: the business reported the incident too late — typically waiting days instead of the required 24–48 hours Intelecis / Insurance claims analysis 2025

73% of small businesses fail their cyber insurance assessments — facing outright denial or premiums up to 300% higher than the market rate AlphaCIS 2026

The most dangerous scenario isn't being denied coverage at underwriting. It's being approved, paying premiums for months or years, suffering a breach — and then discovering at claim time that the coverage doesn't apply because of a control that lapsed, a clause you didn't know existed, or a notification window you missed by 12 hours. The Survival Math post in this series put the average SMB breach cost at $254,000. A denied insurance claim means that $254,000 is entirely out of pocket — after paying premiums for the coverage that was supposed to prevent it.

The seven reasons claims get denied — and how to close each one

1

Missing or partial MFA — the single biggest denial driver

82% of denied claims · Most preventable

82% of denied cyber insurance claims involved organizations without MFA fully implemented. Not without MFA at all — without MFA fully implemented. Most policies require MFA on every email account, every VPN connection, every remote access gateway, every cloud platform, and every administrative account. "Most accounts" is not compliant.

A municipality had an $18.3 million ransomware claim denied explicitly because MFA was not implemented across all systems at the time of the attack — despite having it active on most accounts. The one server without MFA was the entry point. The carrier denied the entire claim. Most does not mean all.

How to close this gapAudit every account and system for MFA enforcement today. Document the audit with screenshots. Ask your IT provider for written confirmation of MFA coverage. When you renew your policy, the MFA question requires an accurate, verifiable answer. "We have MFA on most accounts" is a misrepresentation.

2

Material misrepresentation on the application

34% of all denials · Avoidable

34% of all cyber insurance claim denials involved applications where the business answered security questions optimistically, and post-breach investigation revealed stated controls were not in place. The application warranty is a binding legal document. Every "yes" that isn't documentably accurate is a potential denial trigger.

How to close this gapBefore applying or renewing, audit your actual security posture against every question on the application. Be specific and truthful. If MFA rollout is 80% complete, say "80% complete" not "yes." Carriers who underwrite knowing your gaps cannot later claim misrepresentation. Carriers who discover gaps after a breach will.

3

Late notification — the 24–48 hour window most businesses don't know exists

17% of denials · Clock starts immediately

17% of all cyber insurance claim denials in 2025 happened for a single reason: the business waited too long to notify their insurer. Most policies require notification within 24 to 72 hours of discovering a breach — not after you've confirmed the scope, not Monday morning when the IT team is back. From the moment of discovery.

How to close this gapFind your insurer's breach notification number right now and save it in your phone and your incident response plan as the first item. The moment you suspect a breach, call your insurer before assessing the damage. This 30-second preparation can prevent a claim denial worth hundreds of thousands of dollars.

4

Controls that lapsed after policy inception

Ongoing obligation · Most overlooked

Many businesses meet their insurer's security requirements at underwriting and then let them drift — an employee leaves and their account stays active, MFA gets disabled on one system, a vendor's access doesn't get removed. Policy language typically requires controls to be maintained throughout the policy period, not just at inception.

How to close this gapTreat your insurance policy like a compliance obligation. Quarterly review of the five controls from Post #44 in this series. Document each review — the documentation is your evidence that controls were maintained when the carrier investigates.

5

The war and nation-state exclusion

16% of denied claims · Growing risk

Nation-state exclusions were invoked in 16% of denied claims in 2025. After the NotPetya attacks in 2017, multiple insurers denied coverage to major corporations on grounds that the attack was an "act of war." Distinguishing between a state-sponsored cyberattack and a criminal one is virtually impossible in practice — and the burden of proof falls on the policyholder.

How to close this gapAsk your broker explicitly: does our policy contain a war or nation-state exclusion, and what is the triggering standard? Lloyd's of London now requires explicit exclusion of state-backed attacks in many policy forms. If your policy has this language, understand exactly what it means and whether a narrowing endorsement is available.

6

Prior acts and retroactive date exclusions

The dwell time problem

Cyber insurance operates on a claims-made basis. Many policies contain a retroactive date — if the breach originated from a compromise that existed before that date, the claim may be denied even if the damage occurred during the active policy period. Attackers frequently maintain access for months before deploying ransomware specifically because of this dynamic.

How to close this gapWhen switching carriers, request the longest retroactive date available — ideally back to your business founding. When renewing with the same carrier, confirm the retroactive date carries forward. A gap between policies — old policy ends June 30, new policy starts July 1, breach began June 29 — can leave you entirely uncovered.

7

Sublimits that cap the actual payout far below the policy limit

The fine print · Most misunderstood

A $1 million cyber policy does not mean $1 million for every scenario. Most policies sublimit ransomware payments to $100,000–$250,000, cap business interruption at 30–60 days, limit BEC losses to $25,000–$50,000, and exclude regulatory fines entirely. The average SMB attack costs $254,000 — but the actual payout may cover a fraction of that figure.

How to close this gapRequest a sublimit schedule from your broker — a table showing the specific cap for each category of coverage. Compare each cap against the actual cost components documented in our Survival Math post. If the sublimits don't cover realistic incident costs, negotiate higher limits at renewal or document the gap as accepted uninsured exposure.

The AI exclusion deserves specific mention because it's the newest and least expected denial trigger. Policies issued in 2025 and 2026 increasingly include language excluding coverage for incidents involving AI — even tangentially. If the phishing email that initiated the breach was AI-generated, some carriers are now disputing coverage. Given that 82.6% of phishing emails in 2026 contain AI-generated content, this exclusion could apply to the majority of phishing-initiated breaches. Read your policy's AI language before your next renewal.

What good cyber insurance actually looks like — and what it costs to qualify

The picture isn't entirely bleak. Businesses that implement and document the right controls pay 18–22% less in premiums and file 73% fewer claims than the industry average. The relationship between security posture and insurance outcomes is measurable, direct, and documented. Good security doesn't just reduce breach risk — it reduces insurance cost and claim denial risk simultaneously.

The controls that move the needle most for insurers are the same five controls in Post #44 of this series: MFA fully enforced and documented, credential monitoring, vendor access hygiene, external attack surface management, and a tested incident response plan. The median annual premium for an SMB with these controls in place: $1,740. The median for an SMB without: denied or quoted at 300% higher.

The Veriti Spottr CyberScore is built around exactly the controls that cyber insurers require. MFA enforcement, credential exposure, external attack surface, and access hygiene are all measured in the Exposure and Security Posture components. A CyberScore report gives you documented evidence of your security posture — the same evidence an insurer's underwriter is looking for when assessing your application and the same evidence that defends your claim if an incident occurs.

The three things to do before your next renewal

• Read your exclusions page. Not the summary. The actual policy language covering war exclusions, retroactive dates, sublimits, notification requirements, and security control requirements. If you can't locate it, ask your broker to walk you through it line by line.
• Request a sublimit schedule. Ask your broker for a table showing every specific coverage cap. Compare each cap to the realistic cost of an incident. If the gap is significant, negotiate higher sublimits at renewal or document the uninsured exposure as an accepted risk.
• Audit your controls against your application. Every question on your cyber insurance application is a coverage condition. Run the five-control checklist from Post #44. Document the results. If anything doesn't match what you attested to at underwriting, correct it before the next renewal — not after a breach.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Document your security posture before your insurer does. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com