The cyber insurance application used to be a page of yes/no boxes. Do you use multi-factor login? Yes. Do you have backups? Yes. The trouble is that those answers become part of the policy — and if a claim investigation finds the reality didn’t match, the carrier has grounds to deny the claim or void the policy outright.
That isn’t hypothetical. In 2022, Travelers asked a federal court to rescind a $1 million cyber policy after a ransomware attack on International Control Services, saying the application claimed multi-factor login protected administrative access when it only covered the firewall. ICS agreed to the rescission. Since then, carriers and brokers have increasingly moved from asking whether a control exists to asking for evidence. Here’s what to gather, control by control, about 90 days before your renewal date — early enough to fix a gap rather than explain it.
Before collecting anything, ask your broker for the application you signed last year and the carrier’s current security questionnaire. Every carrier words its questions differently, and the wording matters: “MFA for all remote access” is a different promise from “MFA for email.” Go through each answer and ask, “Could we prove this today?” Anything you can’t back up is either something to fix before renewal or something to answer more carefully this time.
What good looks like: a renewal folder with one section per question, each holding a dated screenshot or report and a one-line note on who checked it.
This is the control carriers look at hardest, because so many claims start in the inbox. Coalition’s 2026 Cyber Claims Report found that business email compromise and funds transfer fraud together made up 58% of the incidents it saw in 2025. Evidence that holds up shows coverage, not a setting. In Microsoft 365, the Entra admin center’s authentication methods activity report lists every user and whether they’re set up for multi-factor login; export it, along with a screenshot of the policy that enforces it. Then cover the other doors: remote access, the backup console, and every admin account, including the ones your IT provider uses.
Applications now commonly ask whether you run endpoint detection and response (EDR) — software that watches for suspicious behavior, not just known viruses — and on what share of devices. Pull a report from the EDR console showing how many devices are protected, and compare it with your actual count of computers and servers. Three laptops that never got the agent is a common finding, easy to fix in June and hard to explain after a claim. Be ready to say who reviews the alerts and how quickly.
“We patch regularly” is a checkmark. Proof is a compliance report from your management tool showing what percentage of devices are current on operating system and critical updates, and when the last cycle ran. Include the firewall and other network gear, whose firmware is often skipped. If something can’t be patched — an old PC running a piece of equipment, say — write down why and how it’s kept off the main network.
Expect questions about whether backups are kept separate from your network, whether an attacker could delete or encrypt them, and when you last tested a restore. Gather 30 days of backup job history, a screenshot of the retention and immutability settings (immutable copies can’t be changed or deleted for a set period), and a short record of your latest restore test: what was restored, how long it took, and who did it. If you’ve never tested a restore, do one now.
For security awareness training, export completion records and, if you run phishing simulations, the latest results. For the incident response plan, the document alone isn’t enough; note when it was last reviewed, confirm the names and phone numbers in it are current, and keep notes from the last time you walked through it as a tabletop exercise. Make sure the plan says to call the carrier’s claims hotline first, since many policies expect you to use the carrier’s approved response firms.
If your controls are already in place, none of this means buying anything new — it’s mostly exporting reports and taking dated screenshots, usually an afternoon or two of work for a small office. What it does is surface gaps while you still have three months to close them, and make sure every yes on the application is one you can prove. If something isn’t finished, tell your broker plainly; “in progress, done by August” is far safer than a yes that falls apart during a claim.
Renewal coming up? Book a free 30-minute consult and we’ll go through your application question by question against what’s actually configured — and tell you honestly which answers hold up and which need work first.
Business email compromise doesn’t look like hacking. There’s no dramatic breach, no malware, often no sign anything is wrong until the money is gone. It’s the quiet scam where someone convinces an employee to send a payment or change bank details — and it’s one of the most expensive cybercrimes there is. The FBI’s 2024 Internet Crime Report put BEC losses at $2.77 billion in a single year, and nearly $8.5 billion from 2022 through 2024, second only to investment fraud. What’s striking is how unsophisticated the attacks usually are. They win on psychology, not technology.
There are two main flavors, and the second is far more dangerous. Impersonation is the obvious one: an email that looks like it’s from your CEO or a vendor — a lookalike domain, a slightly-off display name, a free account set up to match. “I’m in a meeting, can you send a wire before end of day? I’ll explain later.” It works only if you don’t look closely.
Account takeover is the costly one, because there’s nothing to spot. The attacker has actually gotten into a real mailbox — usually through a phishing page that harvested a password on an account with no MFA. Now they’re reading real conversations, learning how your business talks, seeing which invoices are in flight. Then they slip into a genuine thread and redirect a real payment to their own account. The email is legitimate. It comes from the right person’s real address. That’s why it works. A common pattern: the attacker sets a hidden inbox rule that hides certain replies, waits for an invoice, then emails the customer “updated banking details” from the real account and deletes the traces. The business finds out when the vendor calls asking where their money is.
BEC targets the one thing no firewall protects: a person doing their job under normal pressure. The requests look routine and exploit authority (“the CEO asked”), urgency (“before the bank closes”), and the simple fact that most people don’t verify a payment request that appears to come from someone they trust. There’s no malicious attachment to catch and no bad link to block — the email is often completely clean, sometimes because it’s genuinely coming from a real, compromised account.
The defenses are concrete and layered. No single one is enough; together they stop the large majority of attempts.
Speed matters enormously. If a fraudulent payment goes out, contact your bank immediately and ask them to recall the wire — the FBI’s recovery team was able to freeze funds in a majority of cases where victims reported quickly. Then report it at ic3.gov. Hours count; after a day or two the money is usually gone for good.
BEC isn’t a problem you can buy your way out of with one product. It’s one essential control (MFA), one essential habit (verify payments out of band), and a handful of email settings most businesses have never switched on. Put those together and you’ve closed the door that billions of dollars walk out of every year.
Not sure whether your email is configured to catch this? Book a free 30-minute consult and we’ll review your setup for the specific gaps BEC exploits.
This article discusses financial fraud. If your business has already experienced a suspected fraudulent transfer, contact your bank immediately and report it at ic3.gov — time is the single biggest factor in recovering funds.