A few years ago, buying cyber insurance meant filling out a one-page form and cutting a check. Those days are over. Today, insurers treat your renewal application like a security audit — and if your controls don’t measure up, they’ll either price you out or decline coverage entirely. Worse, if you attest to controls you don’t actually have and then file a claim, the insurer can deny it.
If your Buffalo business or dental practice is heading into a renewal this year, here’s exactly what underwriters are looking for — and what to fix before the questionnaire lands on your desk.
Why underwriters suddenly got strict
Insurers paid out heavily on ransomware claims over the last several years, and they responded the way any business would: by tightening the rules. Instead of pricing risk blindly, carriers now require applicants to prove they have specific defenses in place. The logic is simple — the controls below are the ones that most reliably stop or contain an attack, so insurers want to see them before they take on your risk.
The result is that cyber insurance has quietly become a checklist. Meet the checklist and you get reasonable coverage at a reasonable price. Miss it and you’re looking at higher premiums, big coverage exclusions, or a flat “no.”
The controls insurers now require
1. Multi-factor authentication (MFA) everywhere
MFA is now almost universally required, and it’s usually the first question on the application. Insurers don’t just want it on your email — they want it on remote access (VPN and remote desktop), cloud applications, and especially administrator accounts. “We have MFA available but it’s optional” doesn’t cut it; underwriters want it enforced. A single admin login protected only by a password is exactly the gap ransomware crews look for.
2. EDR on every endpoint
Traditional antivirus is no longer enough to satisfy most carriers. They want Endpoint Detection and Response (EDR) — software that watches for suspicious behavior, not just known virus signatures, and can isolate a compromised machine before an attack spreads. And they want it on every workstation and server, not just a few. The one unprotected laptop is usually where trouble starts.
3. Immutable, restore-tested backups
Backups are your last line of defense against ransomware, so insurers scrutinize them closely. The expectation is backups that are encrypted, kept offline or immutable (so attackers can’t delete or encrypt them too), and — critically — tested. It’s not enough to say backups are running. You need to know they’ll actually restore, because a backup you’ve never tested is just a hope. For dental and healthcare practices, this overlaps neatly with the data-protection expectations already baked into HIPAA.
4. Security awareness training
Most breaches still start with a person clicking something they shouldn’t. Carriers increasingly ask whether you run regular security awareness training and simulated phishing tests for staff. For a small office where everyone touches email, this is one of the cheapest, highest-return controls you can put in place — and it’s a box the underwriter wants checked.
5. A tested incident response plan
Finally, insurers want to know you have a plan for the day something goes wrong: who gets called, how systems get isolated, how you communicate, and how you recover. A written, tested incident response plan signals that a breach won’t turn into chaos — and it’s increasingly a line item on the application.
The trap: your application is a legal document
Here’s the part that catches businesses off guard. The security questionnaire you sign is an attestation — a legal statement about your environment. If you check “yes, MFA is enforced everywhere” to get the policy, and then a claim reveals that MFA was never actually turned on for the account that got breached, the insurer can deny the claim on the grounds that you misrepresented your controls.
In other words, the goal isn’t to pass the questionnaire. It’s to make your real environment match what you’re attesting to — so that if you ever have to file a claim, your deployed reality holds up. The cheapest cyber policy in the world is worthless if the claim gets denied.
What this means for a Buffalo small business
If you’re a small business or a dental practice in the Buffalo area, none of this requires an enterprise budget — but it does require someone to actually implement and document it. The controls above are the same ones we recommend regardless of whether you carry cyber insurance, because they’re simply good security. The insurance requirement just gives you a deadline and a reason to stop putting it off.
The practices that struggle at renewal are usually the ones running a patchwork of old antivirus, optional MFA, and backups nobody has tested. The ones that sail through have these controls managed and documented — often by an IT partner who can also produce the evidence (screenshots, logs, policy documents) underwriters increasingly ask for.
How to get ready before your renewal
Start 30 to 60 days before your application or renewal date. That gives you time to close gaps instead of scrambling. A practical sequence:
- Enforce MFA on email, remote access, cloud apps, and every admin account — not just where it’s convenient.
- Deploy EDR to every workstation and server, and confirm nothing was missed.
- Make backups immutable and encrypted, then run an actual test restore and keep the record.
- Roll out security awareness training and a simulated phishing test for staff.
- Write down (and tabletop-test) a simple incident response plan.
- Gather the evidence — screenshots, logs, and policies — so your answers on the questionnaire are honest and provable.
Answer the questionnaire consistently and honestly, and back every “yes” with something you can show. That’s what keeps both your premium and your future claim on solid ground.
The bottom line
Cyber insurance in 2026 rewards businesses that have already done the security basics and penalizes those that haven’t. The controls insurers demand — enforced MFA, EDR everywhere, tested immutable backups, staff training, and an incident response plan — aren’t hoops to jump through. They’re the difference between a bad day and a business-ending one.
If you’re not sure how your current setup would score on an underwriter’s questionnaire, that’s worth finding out before the renewal notice arrives. We help Buffalo-area businesses and dental practices close these gaps and produce the documentation to prove it. Get in touch and we’ll walk through where you stand.