The tick box that decides your claim: why your cyber insurance form isn't a formality

Summary

• 47% of UK businesses have some form of cyber insurance, mostly as part of a wider policy [1]
• 22% of businesses don't know whether they have cyber insurance [1]
• 47% of businesses require any form of two-factor authentication [1]
• 34% have a policy to apply security updates within 14 days [1]
• £197m paid by insurers to UK businesses for cyber claims in 2024, up 230% on 2023 [2]

The first four figures come from the Cyber Security Breaches Survey 2025/2026 [1]. The last comes from the ABI [2], whose data covers a sample of the UK market.

Insurance pays out. Whether it pays you in full depends on whether your answers were right.

The proposal form is not paperwork for the broker. It is how your business describes its risk to the insurer, and the law sets a standard for that description.

What the law says

For business insurance in the UK, the rules sit in the Insurance Act 2015 [3]. Four parts of it matter here.

Four provisions every director should know

• The duty of fair presentation (section 3). Before cover starts, the business must give the insurer a fair presentation of the risk. Every material statement of fact must be substantially correct.
• What the business is taken to know (section 4). A company knows what its senior management and the people arranging its insurance know. It also ought to know what a reasonable search of information available to it would have revealed.
• When the insurer has a remedy (section 8). Only where the insurer shows that, without the error, it would have declined the risk or written it on different terms.
• What the remedy can be (Schedule 1). If the error was deliberate or reckless, the insurer can avoid the policy and keep the premium. Otherwise it depends on what it would have done: avoid the policy and refund the premium, apply the terms it would have set, or reduce the claim in proportion to the premium it would have charged.

Two further points work in the policyholder's favour. Section 9 stops insurers turning proposal-form answers into warranties through "basis of the contract" clauses. Section 11 can stop an insurer relying on a broken risk-control term if the breach could not have increased the risk of the loss that actually happened.

The practical result is simple. An inaccurate answer rarely leaves you with nothing, but it can leave you with less than you expected. The difference comes off your balance sheet.

This is general information, not legal advice. Your policy wording and your broker's advice take precedence.

Why the gaps are partial

The gaps we look for first are rarely total. A business that has never heard of two-factor authentication usually knows it. The risk sits with the business that has it on staff mailboxes and assumes that covers everything.

The national picture shows how common partial coverage is. The Cyber Security Breaches Survey [1] found that 74% of businesses back up data via a cloud service, but only 25% have a formal incident response plan. It also found that 73% restrict admin rights, while fewer than half require two-factor authentication anywhere.

Certification helps, but it does not answer every question on the form. Cyber Essentials [5] covers five technical areas, and its update rule requires critical and high-risk fixes within 14 days, as IASME explains [6]. Backup and recovery are not among the five areas. A certificate on the wall does not prove you can restore your data.

The question is not "do we have it?" It is "where don't we have it?"

A note on statistics

A figure claiming that 82% of denied cyber claims involved missing MFA has circulated widely, attributed to the insurer Coalition. Coalition has since said the figure is incorrect and that it has never published claims-denial data, as reported in October 2026 [4]. We have not used it. The argument here rests on the law and on official UK statistics.

The five checks

We use five questions to test a proposal form before it is signed. Each one is a question the board can ask without technical knowledge. The answer should be evidence, not a belief.

1. Multi-factor authentication

• Question for the board: Does MFA cover every administrator account, every remote access route and every service account, not just staff email?
• What good looks like: A current report showing MFA enforced across all accounts, with any exceptions listed, approved and justified.
• Warning sign: The answer is "yes" but nobody can show the report, or administrator accounts are excluded "for convenience".

2. Endpoint protection

• Question for the board: Is every device protected, including servers, and is someone acting on the alerts?
• What good looks like: A coverage report that matches the asset list, and a named person or provider responding to alerts.
• Warning sign: Laptops are covered but the server in the back office isn't, or alerts go to an inbox nobody reads.

3. Backups

• Question for the board: When did we last restore from backup, and how long did it take?
• What good looks like: A dated restore test with recovery times recorded. We recommend at least once a year.
• Warning sign: Backups exist but have never been restored, or the backups sit on the same network an attacker could reach.

4. Patching

• Question for the board: Are critical updates applied within 14 days, and can we prove it?
• What good looks like: A patch report against the Cyber Essentials 14-day standard, with exceptions tracked.
• Warning sign: "We patch regularly" is the only evidence, or some systems can't be patched and nobody has recorded why.

5. Incident response

• Question for the board: Do we have a written, tested plan, and does it state our policy's notification deadline?
• What good looks like: A plan exercised in the last year, naming who calls the insurer's helpline and when.
• Warning sign: Nobody knows the notification deadline, or the plan lives on a system that would be down in an incident.

Five questions for your next board meeting

1. Who completed our last cyber insurance proposal form, and what evidence did they check?
2. Do we know which of our answers are evidenced and which are beliefs?
3. Has anything changed since renewal that we should tell our insurer about?
4. When is our next renewal, and have we booked a controls review 60 to 90 days before it?
5. Does everyone who might spot an incident know to raise it straight away, so we meet the policy's notification deadline?

Conclusion

Cyber insurance does pay. The ABI [2] reports £197m paid to UK businesses in 2024. But the policy is only as strong as the description of risk it was written on.

Some businesses have no cover at all. JLR reportedly had no cyber policy in place when it was attacked in 2025, according to The Register [7]. For those that do have cover, the form is where protection is won or lost, long before any incident.

Security is the outcome, not a solution. Here, the outcome depends on the board knowing that what it declared is what it runs.

Who in your business checks the insurance form against what's actually in place?

Glossary

• Duty of fair presentation. The legal duty on a business to describe its risk accurately to an insurer before cover starts, under the Insurance Act 2015.
• Endpoint detection and response (EDR). Software on laptops, desktops and servers that detects suspicious activity and helps responders contain it.
• Multi-factor authentication (MFA). Signing in with something more than a password, such as a code from an app or a security key. Two-factor authentication is the most common form.
• Proportionate reduction. An insurer's right to pay only part of a claim, in line with the higher premium it would have charged had it known the true risk.
• Proposal form. The questionnaire a business completes when it applies for or renews insurance.
• Restore test. A planned exercise to recover systems or data from backup, to prove the backup works and measure how long recovery takes.
• Service account. An account used by software or systems rather than a person, often with high privileges.
• Warranty. In insurance, a promise by the insured that something will or will not be done, or that a fact is true. Breach can suspend cover until it is remedied.

Further reading

From CyberCQR

• The breach you can't patch: JLR one year on. Our briefing on cyber risk that starts in a customer's systems, and the insurance gap it exposes.
• Identity and Access Management: Top 10 Must-Do Actions. The identity controls to put in place first, from phishing-resistant sign-in to admin accounts.
• Ransomware Preparedness: 10 Actions Before an Attack. Including tested, isolated backups and the restore test the insurer will ask about.

External

• NCSC, Cyber Essentials overview
• Insurance Act 2015, Explanatory Notes
• DSIT, Cyber Security Breaches Survey 2025/2026

References

1. Department for Science, Innovation and Technology and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
2. Association of British Insurers, Nearly £200 million paid in cyber claims to help UK businesses recover, November 2025. https://www.abi.org.uk/news/news-articles/2025/11/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover/
3. UK Parliament, Insurance Act 2015 (c. 4), sections 3, 4, 8, 9, 11 and Schedule 1, as revised. https://www.legislation.gov.uk/ukpga/2015/4/contents
4. FairsOnline, Coalition: Cyber Insurer Paid $315M in Claims in 2025, Rebuts Myths, 17 October 2026. https://www.fairsonline.org/coalition-cyber-insurer-paid-315m-claims-2025-rebuts-myths
5. National Cyber Security Centre, Cyber Essentials: overview, checked 19 October 2026. https://www.ncsc.gov.uk/cyberessentials/overview
6. IASME, Cyber Essentials Myth Busting, 12 May 2022. https://iasme.co.uk/articles/cyber-essentials-myth-busting
7. The Register, Cyber insurers paid out over twice as much for UK ransomware attacks last year, 11 November 2025. https://www.theregister.com/2025/11/11/ransomware_surge_fuels_230_increase/