BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving Toronto and organizations across North America  ·  Last updated August 28, 2026

Key Takeaways

• Cyber insurance underwriting has fundamentally changed since 2020. Applications that were approved with minimal security evidence now require detailed control attestations, third-party assessments, and in some cases independent verification.
• The controls that have the most impact on premium pricing are MFA across critical systems, EDR deployment, tested backup and recovery, incident response plan testing, and privileged access management.
• A cybersecurity posture assessment conducted before renewal gives the organization third-party evidence of its security programme strength, the most credible input an underwriter can evaluate.
• Coverage terms, including sublimits, coinsurance requirements, and exclusions, matter as much as premium. Organizations that have not had their coverage structure reviewed by a specialist adviser may have coverage gaps they are unaware of.
• The security investment required to improve renewal terms is almost always less than the incremental premium cost of presenting without those controls documented.

Why Cyber Insurance Has Become Harder to Obtain and More Expensive

The cyber insurance market changed fundamentally in 2020 and 2021, when ransomware losses reached levels that made underwriters re-examine the assumptions their pricing models were built on. Loss ratios in cyber insurance exceeded 70 percent across the industry during this period, and several insurers exited the market or significantly reduced their capacity. Those that remained responded with stricter underwriting requirements, higher premiums, lower limits, and new exclusions that shifted more risk back to the insured.

The stricter underwriting requirements are now standard. Applications that previously asked whether MFA was in place now ask for specific deployment percentages, confirmation of privileged account coverage, and attestation that remote access requires MFA. Applications that previously accepted self-attestation of security controls now request third-party assessment reports, penetration test results, and SOC 2 reports as supporting evidence. Organizations that cannot produce this evidence are either declined or priced as high-risk accounts with commensurately high premiums.

The differentiation in premium pricing between organizations with mature security programmes and those without has widened significantly. An organization that can demonstrate MFA on all critical systems, EDR deployment across all endpoints, tested incident response procedures, quarterly vulnerability scanning, and a documented security programme managed by a named security leader is a materially different risk from one that cannot. Underwriters are pricing that difference explicitly, and the spread between the best and worst rates for similar organizations is now substantial.

What Controls Have the Greatest Impact on Renewal Terms?

Multi-factor authentication on email, remote access, and administrative accounts is the single control that has the greatest impact on cyber insurance underwriting. Credential theft and account compromise are the entry point for the majority of ransomware and BEC attacks that generate insurance claims. Underwriters have learned that MFA enforcement on these specific systems dramatically reduces the frequency of large losses. Organizations that cannot confirm MFA on all remote access are routinely declined or surcharge-rated.

Endpoint detection and response deployment across all company-owned devices is the second most frequently evaluated control. Traditional antivirus does not satisfy this requirement. Underwriters are specifically asking for EDR platforms that provide behavioural detection, isolation capability, and forensic logging. The ability to isolate a compromised endpoint before ransomware spreads laterally is a demonstrable loss-reduction capability that underwriters price.

Tested backup and recovery is evaluated both for its existence and for the quality of the test. Backups that are not isolated from the primary network can be encrypted along with production systems in a ransomware attack. Backups that have not been restoration-tested may not actually be recoverable. Underwriters want attestation that backups are offline or immutable, that restoration has been tested within the past twelve months, and that recovery time objectives are defined and achievable. Organizations that cannot answer these questions with specific evidence are priced for the ransomware recovery scenario they are most vulnerable to.

How Armour Cybersecurity’s Advisory Prepares Organizations for Renewal

Across the 260+ organizations Armour Cybersecurity protects in 52+ industries, the pattern at renewal is consistent: the organizations that present third-party validation and documented controls are quoted materially better terms than those that self-attest, even when the underlying security programmes are similar. Armour Cybersecurity’s Cyber Insurance Advisory service addresses the renewal process from two directions: ensuring that the organization’s security programme is presented to underwriters in the most favourable and accurate light, and ensuring that the coverage structure the organization obtains is actually appropriate for its risk profile.

On the programme presentation side, the advisory service helps organizations complete insurance applications with specific, evidence-backed responses rather than general attestations. An application that states that MFA is enforced on all remote access systems, as documented in the attached IT configuration report and the most recent SOC 2 audit evidence, is a more credible submission than one that checks “yes” without supporting evidence. Armour works with organizations to identify the evidence that exists, generate the evidence that is missing, and structure the application response to reflect the actual strength of the security programme.

A cybersecurity posture assessment conducted before the renewal application provides the third-party validation that underwriters increasingly require. An assessment report from Armour Cybersecurity, showing the organization’s maturity scores across all control domains, the controls in place, and the improvement actions underway, gives the underwriter an independent professional opinion of the organization’s security programme strength. This is meaningfully more credible than self-attestation.

Armour 360 as the operational managed service provides the ongoing security management that underwriters want to see is genuinely in place. An organization that can confirm that its endpoints are covered by a managed EDR service, that its email is protected by a managed filtering and authentication service, and that its environment is monitored by a security operations team is presenting evidence of an operating security programme, not a paper one. Armour 360 clients renewing cyber insurance are able to reference the managed service as an active control rather than an aspiration.

A breach readiness assessment provides the incident response testing evidence that underwriters evaluate under the tested response capability requirement. A breach readiness assessment report showing that the organization has an incident response plan, that the plan was tested against realistic scenarios, and that identified gaps from the test were remediated is the evidence that closes this section of the application. For organizations that have a plan on paper but have never tested it, the readiness assessment provides both the test and the remediation roadmap.

Compliance readiness assessment and certification produce the SOC 2 or ISO 27001 reports that some underwriters accept as a comprehensive substitute for multiple individual control attestations. An organization with a current SOC 2 Type II report is presenting evidence from an independent CPA firm that its security controls were operating effectively over the observation period. This is the strongest possible evidence of security programme quality for underwriting purposes, and it directly impacts pricing. Armour’s compliance readiness engagement prepares organizations for that certification.

What About Coverage Structure, Not Just Premium?

Premium is the most visible number in a renewal, but coverage structure determines what actually gets paid when a claim occurs. Many organizations discover at claim time that their policy has sublimits on specific loss categories that are lower than their actual losses, that their coverage excludes certain attack types that are now standard in the threat landscape, or that their coinsurance requirements mean they bear a larger share of the loss than they understood. Recent industry reporting found that roughly one in four cyber claims met a policy exclusion that reduced or eliminated the payout, which makes the structure review as important as the price.

Armour’s Cyber Insurance Advisory service reviews the coverage structure as part of the renewal engagement, identifying sublimits on ransomware payments, business interruption coverage, social engineering fraud, and regulatory fines that may be inadequate for the organization’s actual risk exposure. The advisory produces specific recommendations on coverage structure that the organization can use in negotiations with its broker before the renewal binds.

Frequently Asked Questions

Our premium has doubled at renewal. Is this normal?

Premium increases of 20 to 50 percent at renewal have been common across the cyber insurance market in recent years. Increases of 100 percent or more for organizations that cannot demonstrate specific security controls have also occurred. The question is whether the increase reflects market conditions or a specific assessment of your organization’s risk profile. Armour’s advisory identifies which controls are driving the premium and what implementing them would cost versus the premium savings at the next renewal.

What if our insurer is requiring a third-party security assessment before renewal?

This requirement is becoming more common for larger policy limits and for organizations in sectors with high loss frequency. Armour Cybersecurity’s cybersecurity posture assessment is structured to produce the report format that insurers and their appointed assessors use. If the insurer has appointed a specific assessment firm, Armour can prepare the organization for that assessment by conducting a pre-assessment gap review that identifies and closes the findings that would otherwise surface in the formal assessment.

Should we shop our renewal to other insurers?

Comparing terms across multiple insurers at renewal is standard practice and often produces better outcomes than renewing with the incumbent without comparison. Armour’s advisory includes market guidance on which insurers are most competitive for the organization’s risk profile and industry. The security programme documentation that Armour helps prepare for renewal is portable across insurer applications.

The Bottom Line

Rising cyber insurance premiums are not a fixed cost. They are a price on demonstrated risk, and organizations that document MFA, endpoint protection, tested backups, tested incident response, and third-party validation consistently earn better renewal terms than those that self-attest. The work of preparing that evidence almost always costs less than the premium penalty of presenting without it, and it closes coverage gaps that would otherwise surface at claim time. Armour Cybersecurity helps organizations prepare with programme documentation, third-party validation, and coverage structure review through its Cyber Insurance Advisory service.