We get some version of this question most weeks: “If we’ve done the security work, do we still need cyber insurance?” The short answer is yes, but the more useful answer is how the two actually relate to each other, because it affects both your premiums and whether a claim gets paid.
They solve different problems
Security controls reduce the likelihood of an incident. Insurance covers the cost when one happens anyway: incident response, legal obligations, business interruption, and in some cases ransom negotiation. Being well secured doesn’t make you immune to a breach; it makes one less likely and usually less severe when it happens. You still want cover for the scenario where it happens regardless.
Your security posture affects the policy, not just the price
Every cyber insurance application now includes a security questionnaire, and it’s not a formality. Insurers ask specific, checkable questions:
- Is multi-factor authentication enforced on email and remote access?
- Are backups tested, and how often?
- Is there a documented incident response plan?
- Are admin privileges restricted?
These map almost directly onto the Essential Eight. Answer “no” to enough of them and you’ll either pay a higher premium, get a reduced coverage offer, or in some cases get declined outright.
The part that actually catches businesses out
The bigger risk isn’t the premium. It’s the claim. Insurers have increasingly relied on exclusion clauses tied to security failures. If an incident happens through a control you told the insurer was in place but wasn’t (MFA that was configured but not enforced, backups that were scheduled but never tested), a claim can be reduced or denied on the basis that you misrepresented your risk. Being honestly not aligned and priced accordingly is a better position than claiming alignment you can’t substantiate.
What this means practically
Before you renew or apply for a cyber policy:
- Know your actual answers to the standard questionnaire items, not your assumed answers.
- Fix the gaps that are cheap to fix (MFA and backup testing usually fall into this category) before applying, since they move the premium the most.
- Keep evidence. “We have MFA” is weaker than being able to show when it was enabled and where it’s enforced.
Essential Eight alignment and cyber insurance aren’t competing priorities. Alignment is what makes the insurance conversation shorter, cheaper, and more likely to actually pay out when you need it to. If you’re not sure where your business would land on that questionnaire today, that’s exactly what our security audits are for.