Part 2 of 3.
A cyber insurance application is signed by the business owner, but answered by whoever holds the passwords. One Illinois manufacturer found out exactly what that gap costs.
A cyber insurance application asks a business owner to make specific factual assertions. Do you require multi-factor authentication. On which systems. Do you have endpoint detection. On how many devices. Do you have an incident response plan. Do you conduct security awareness training.
Most owners can't answer those questions from personal knowledge, and there's nothing shameful about that. So the questions get forwarded to the IT provider, the managed service provider, whoever holds the passwords. The answers come back. The owner signs.
That handoff is so ordinary that almost nobody examines it. It is also the single most consequential unexamined step in the small business insurance process, and this piece is about why.
The party that implements and operates your security controls should not also be the party that attests to their adequacy to a third party who is pricing risk based on that attestation.
That is not an accusation about anyone's competence or honesty. It's the same principle that stops a company from auditing its own financial statements, stops a contractor from signing their own building inspection, and stops a lab from certifying its own results. We accept it everywhere else without controversy.
It's worth being clear about what this argument is not. It is not "your MSP is doing a bad job." Most are doing what they were hired to do, often very well, frequently while understaffed. And a good MSP will recognize this argument immediately, because it's the argument their own insurers make about them.
The point is narrower and harder to escape: when the same party both builds the thing and grades it, the grade carries less information. Not because anyone lied, but because nobody was positioned to notice the gap between what was intended, what was deployed, and what is actually running today.
In March 2022, International Control Services (ICS), an electronics manufacturer in Decatur, Illinois, signed an application for a Travelers CyberRisk Tech policy. Among the representations was the company's use of multi-factor authentication. The policy incepted in April.
In May, ICS was hit by ransomware.
Travelers alleged that ICS “only used MFA to protect its firewall, and did not use MFA to protect any other digital assets.” In July 2022, the carrier filed in federal court in Illinois seeking to rescind the policy, arguing the misrepresentation "materially affected the acceptance of the risk."
On August 26, 2022, the parties stipulated to rescission, with judgment entered shortly afterward. ICS agreed to a judgment rescinding the policy. The stipulation declared the policy null and void from its inception, providing that "no insurance coverage shall be available to any person or entity under the policy for past, present, and future claims, suits, loss, costs, or expenses of any kind whatsoever" (Lockton analysis; Insurance Journal, August 30, 2022).
Sit with what that means. A business bought a policy. Paid the premium. Suffered exactly the kind of loss the policy existed to cover. And ended with nothing. Not a reduced payout, not a coverage dispute over a sublimit. The policy erased, retroactively, as though it had never existed.
And the failure that produced that outcome was not a security failure. The ransomware was ordinary. The failure was an attestation failure: a question about the scope of one control, answered inaccurately on a form.
That is the risk created by the handoff. Not fraud. Almost certainly nobody set out to deceive anyone. Just a gap between what someone believed was deployed and what was actually running, transmitted onto a legal document, signed by a person who had no way to check.
Underwriters have adapted, and the questions have gotten much harder.
Multi-factor authentication has become a baseline underwriting expectation rather than a differentiator. Effectively every applicant answers yes. When everyone reports a control, reporting it stops telling an underwriter anything. So the question moved from presence to quality and scope, and the evidence justifies the move.
Analysis linking self-reported controls to actual claims outcomes found that phishing-resistant MFA correlated with a 9% lower breach likelihood than MFA that isn't phishing-resistant (Marsh McLennan Cyber Risk Intelligence Center, August 2025). The same work found endpoint detection operates on a sliding scale rather than a switch: each 25% increase in EDR deployment across an organization's workstations correlated with a further 10% decrease in breach likelihood.
Which reframes the whole application. "Do you have EDR" is close to meaningless. "On what percentage of your endpoints, including the machines nobody has touched since the last hire left" is the question that predicts anything.
And a control you own but don't watch is not the same as a control. One carrier examining its own ransomware claims found that 60% of victims of the Akira ransomware group had leading EDR solutions deployed (At-Bay 2026 InsurSec Report). The tooling was purchased. It was on the application. It did not prevent the loss.
There's a pattern I encounter often enough to consider it typical. Ask a firm whether they have an incident response plan and the answer is yes. Ask to see it, and it turns out to live in one person's head: the IT director, the operations manager, whoever has been holding the organization together. They genuinely do know what to do. The plan is real in the only place it exists. But it isn't retrievable when that person is on vacation, unreachable, or the one whose account was compromised, and it isn't a document anybody else can follow at two in the morning. On the application, that answered as a yes.
If you want to know where to spend, the published evidence is unusually clear. Ranked by measured signal strength against claims data, the controls that matter most are network hardening, endpoint detection and response, logging and monitoring, security awareness training with phishing testing, and incident response planning (Marsh McLennan, 2025).
Two things on that list deserve particular attention from a smaller business.
Incident response planning ranks in the top five, and it is nearly free. Organizations running regular tabletop exercises and scenario drills were found to be 13% less likely to experience a material cyber event (same source). An afternoon, a conference room, and a set of realistic questions.
Tested backups change outcomes measurably. Recovery from backups rose to 66% of cases where data was encrypted, up 12 percentage points year over year (Sophos State of Ransomware 2026, surveying 2,158 IT and security leaders at organizations that were attacked). Note the word tested. A backup nobody has ever restored from is a hypothesis.
On the carrier side, the baseline expectations are consistent and public: multi-factor authentication, security awareness training, backups held both on-site and off-site with tested recovery, identity and access management, and data classification with least-privilege access (Coalition, cyber insurance requirements).
None of that is exotic. All of it is checkable by someone whose job is to check.
This is the work I do with clients and their brokers, and it's less mysterious than it sounds.
An independent cybersecurity readiness assessment works through the questions carriers actually ask on their applications, and establishes what the true answer is for your business. Not the intended answer, not the answer from the last time anyone looked. It produces three things:
What it explicitly does not do is replace your MSP. Your MSP implements. That's their job and they're set up for it. The assessment tells them precisely what to fix, and gives the owner a way to verify it actually got fixed, which is the piece that's usually missing.
I say the same thing to the MSPs I work with, and most of them agree once it's framed properly: it is difficult to audit your own work, and nobody should be asked to. Having an independent party document the gaps protects the MSP too. It converts an awkward conversation about what wasn't done into a shared, dated record of what was recommended and what the client chose.
Here's what I'd want a business owner to take from this, and it has nothing to do with insurance.
Done properly, this process leaves you holding documentation rather than assumptions. Deployment coverage figures. Dated training records with names on them. A restore that someone actually performed. An incident response plan that exists somewhere other than one person's memory.
That same evidence pack answers an underwriter's application. It satisfies a written-security-program obligation under HIPAA or the FTC Safeguards Rule. It answers the security questionnaire a larger client sends before awarding you work. One body of work, three payoffs, and the insurance conversation is just the one with a deadline attached.
The businesses that come through a renewal well aren't the ones with the biggest security budgets. They're the ones who knew what their answers were before anyone asked.
Also in this series: why a renewal increase in a falling market is a message about your business, and how much coverage you actually need.
Melissa Thornton is the founder of Cybersecurity Advisory Group, providing virtual CISO and fractional cybersecurity leadership to healthcare organizations, startups, and SMBs. Based in White Plains, NY, serving clients remotely nationwide. sales@cyberadvisor.tech · +1 914-517-0022
This article is provided for general informational purposes and does not constitute legal, insurance, or coverage advice. Policy terms vary by carrier; read your own form.
Connect with Melissa Thornton on LinkedIn
