Quick Summary
A cyber insurance claim denied after an incident often traces back to one thing: a gap between what you declared at renewal and what was actually running on the day of the attack. Insurers now require detailed, evidence-backed answers on every application, and when those answers don’t match, even by mistake, the claim can be reduced or refused. Knowing what your insurer expects before you ever file is the clearest way to keep your claim from ending that way.
If you run a small or mid-sized business in Calgary and carry cyber insurance, you probably expect it to work like your other policies: something goes wrong, you file a claim, and the insurer writes a cheque. Trond Aarflot, Director of Technology and Operations at Ironclad TEK, regularly hears business owners say that in the worst case, they close their doors, but at least they get their money back. “But that’s not really what’s happening,” he says.
The City of Hamilton learned this the expensive way. After ransomware knocked out much of its network in February 2024, its cyber insurer declined about $5 million in claims because multi-factor authentication hadn’t been fully rolled out. Recovery costs reached $18.4 million, and taxpayers absorbed it.
Hamilton had a dedicated IT department and still came up short. A business where IT is one person’s side job has even less margin, and smaller organizations draw attackers precisely because their defences are often thinner.
So, should a small business skip cyber insurance? For most, no. The gap that sank Hamilton’s claim, between what it declared and what was actually in place, is one a business can close. Ironclad TEK doesn’t sell insurance, but through the renewals we support, we see where those gaps usually open up. Here’s what to understand about claim denials, the cyber conditions in general business policies, and the six controls insurers want documented before a claim is filed.
Why Having Cyber Insurance Doesn’t Guarantee a Payout
Home and auto insurance set the wrong expectation. If hail dents your truck, an adjuster confirms the damage and the payout follows. Nobody asks you to prove you parked in the garage every night for the past year.
Cyber insurance works differently. The insurer prices your policy on the security controls you say you have and treats those answers as conditions of coverage, which has made applications far more demanding. “It used to be a five-point form,” Trond says. “Now it’s four to five pages, probably two days of work, and they want evidence. They want proof that you’re doing these things.”
Those answers come back into play the moment you file. Trond has heard the pattern described plainly: insurers “come in, and they’re very helpful, and they inevitably find a reason not to pay.” After an incident, a forensic team reconstructs how the attacker got in, and the insurer compares those findings against your application. If you ticked “yes” to MFA on all remote access and investigators find a VPN account without it, the insurer has grounds to reduce or refuse the claim.
Cyber Insurance Claim Denied Over an Honest Mistake?
Most business owners never realize their setup has drifted from what they told their insurer. A setting gets switched off during a software migration, a new hire’s account is created without MFA, or a backup job reports success for months while failing to capture the files that matter. As Trond puts it, “Sometimes it’s not malicious. You maybe didn’t do it correctly. And then they’re like, yep, no, we’re not paying.” You can believe your setup is in order and still be wrong on the one day that counts.
How Often Cyber Insurance Claims Go Unpaid
How often claims go unpaid is harder to pin down than you might expect. Canada doesn’t publish a national breakdown of cyber claim outcomes, so the closest benchmark comes from U.S. regulators. The National Association of Insurance Commissioners found that 28,555 of the 38,496 U.S. cyber claims closed in 2024 ended without any payment, roughly three in every four.
That number includes claims that fell below the deductible, claims the policyholder withdrew, and incidents the insurer handled through its own response services. Insurers such as Coalition argue that many of those closures reflect help delivered without a cash settlement. Still, filing a claim and receiving a cheque are two separate outcomes, and in 2024 most U.S. claims ended without one.
Two Policy Details That Can Shrink or Sink Your Payout
Even when a claim is approved, two details in your policy can reduce what you receive or block it entirely. The first is the sublimit. Your policy’s headline limit, say $1 million, rarely applies evenly to every type of loss. Funds transfer fraud, where a criminal convinces your staff to pay a fake invoice or change banking details, is often capped separately at $50,000 to $100,000. A single redirected supplier payment can exceed that cap, leaving you to cover the difference.
The second is timing. Most policies require you to notify the insurer within a set window after you discover an incident, and late notice can give the insurer a reason to deny coverage. Coalition also reports that prompt reporting often decides whether an incident stays manageable or grows into a costly claim. If your team tries to contain an incident internally before calling the insurer, the damage has more time to spread, and you risk missing the reporting deadline.
Even Regular Business Insurance Is Starting to Expect Cyber Controls
If you’ve never bought a standalone cyber policy, you might assume these requirements don’t apply to you. Trond sees that assumption regularly, but cyber requirements are increasingly showing up in traditional business insurance too.
The numbers back him up. Insurance works when premiums cover claims and expenses with room left over, and in cyber, that math is moving the wrong way. The National Association of Insurance Commissioners reported that U.S. cyber claims rose almost 40% in 2024 while premiums fell about 7%. Insurers are responding by looking harder at the security controls behind every policy they write.
At your next renewal, that scrutiny might show up as a new cyber exclusion, questions about multi-factor authentication and backups, or a cyber endorsement with its own conditions and a lower limit than a standalone policy. Read those changes closely, because failing to meet them could affect whether a loss is covered.
Six Controls Cyber Insurance Underwriters Expect You to Prove
Whether your cyber coverage comes from a standalone policy or conditions in your business policy, insurers ask about the same six areas, although requirements vary by insurer and policy. What’s changed is that a “yes” on the form is often no longer enough. Insurers increasingly want evidence that each control was in place and enforced across every account and device at the time of an incident. Hamilton’s MFA rollout, for example, covered only some departments, and those gaps contributed to the denial of its claim.
1. MFA on Email, Remote Access, and Admin Accounts
Multi-factor authentication requires users to prove their identity in two or more ways, such as entering a password and approving a prompt in an authentication app. Insurers commonly expect it on all email accounts, remote access connections (such as VPNs and remote desktops), and accounts with administrative privileges.
What to document: Which accounts and systems are covered, whether MFA is mandatory, and any exceptions. When MFA is optional, some users leave it off, and those accounts become the gaps an investigator finds.
2. Endpoint Detection and Response (EDR)
EDR software monitors laptops, desktops, and servers for suspicious activity, such as a program trying to encrypt large numbers of files. Depending on the setup, it can alert your security team or isolate a device to contain an attack. Traditional antivirus mainly looks for files already known to be malicious, while EDR also watches for suspicious behaviour.
What to document: Which devices are protected, including servers, and who monitors and responds to alerts, including nights and weekends. Many smaller businesses rely on a managed provider or a 24/7 security operations centre (SOC) for that coverage, and insurers want to know someone acts when an alert fires.
3. Backups with a Dated Restore Test
Backups let you recover after ransomware or another disruptive incident, as long as the copies are intact and usable when you need them. Insurers want backups that attackers can’t easily alter or delete, such as immutable backups, which are locked against changes for a set retention period, or air-gapped backups, which are kept separate from your network. A “successful” backup report confirms the job ran. A restore test confirms you can recover.
What to document: Your backup schedule, how backups are protected, and the date and outcome of your most recent restore test.
4. A Written Incident Response Plan
An incident response plan spells out what your team does when a cyberattack hits: who makes decisions, who to contact (including any outside IT or security provider), how to contain affected systems and restore them from backup, when to notify your insurer, and how to communicate with employees, customers, and other affected parties.
What to document: The current plan, key contacts, your insurer’s incident hotline and notification deadline, records of each exercise (date, attendees, and gaps identified), and any incident reports from your monitoring provider. Keep it somewhere your response team can find it quickly during an incident.
5. A Defined Patching Schedule
Patching means installing the security updates vendors release to fix known vulnerabilities. Without a consistent process, outdated systems leave openings attackers can exploit. Internet-facing equipment, like firewalls and VPN appliances, needs particular attention because a flaw there can expose your whole network.
What to document: Your patching policy, deadlines for applying updates based on severity, and reports showing which systems are current. Include how you track overdue patches and handle exceptions.
6. Security Awareness Training with Records
Training teaches your staff to recognize phishing emails, fraudulent invoices, and impersonation attempts. Attackers often target people to gain access or trick employees into transferring money, and human error remains one of the most common ways breaches start. That’s why insurers commonly ask how you train staff to spot and report suspicious activity.
What to document: Completion records, dates, and results from simulated phishing exercises, if you run them. Attendance alone doesn’t show whether employees know how to respond, so track recurring gaps and follow up with extra training where needed.
Keep Your Controls Current Between Renewals
Treat these six controls as a working checklist you revisit through the year. New employees join, devices get added, software changes, and security settings drift. A control that was in place at renewal may no longer cover you a few months later.
Set a regular review, close any gaps you find, and keep dated records of what was in place. If an incident happens, those records show the insurer what protections you had at the time. Requirements vary by policy, so use your insurer’s application and policy wording as the final reference.
Frequently Asked Questions About Cyber Insurance
What’s the difference between cyber insurance and general business insurance?
General business insurance typically covers physical-world risks such as bodily injury and property damage. Cyber insurance covers losses from digital incidents, which can include breach response, ransomware recovery, business interruption, and customer notification costs. Standard business policies often exclude cyber losses unless a cyber endorsement adds coverage, and that endorsement usually carries narrower terms and lower limits than a standalone policy.
Does good security make it easier to get cyber insurance?
Yes. Insurers commonly ask for proof of safeguards such as multi-factor authentication (MFA), endpoint detection and response (EDR), and protected backups, and strong controls can improve both your chances of approval and your premium. Documenting those controls at application and renewal also reduces the risk of a mismatch that could complicate a future claim.
Should a small business still get cyber insurance if claims often go unpaid?
For most small businesses, yes, as long as the policy sits alongside solid security controls. The National Association of Insurance Commissioners reported that roughly three in four U.S. cyber claims closed in 2024 ended without a payment. That figure includes claims below the deductible and claims policyholders withdrew, so it doesn’t mean three in four were denied. Answer the application accurately, know your policy’s limits and exclusions, and keep the required safeguards in place all year. Insurance covers the financial fallout. Prevention and preparation keep that coverage payable.
Can an insurer deny a claim over an honest mistake?
Yes. If your actual security controls don’t match what you declared on your application or renewal, the insurer may reduce or refuse the claim, even if the mismatch was unintentional. For example, a business might report MFA on all accounts when a few remain unprotected. After an incident, the insurer compares the application with what its investigators find. Outcomes depend on the policy wording and applicable law, and accurate applications backed by documented controls reduce this risk.
Know What Your Policy Expects Before You Need It
Cyber insurance can absorb a serious financial blow, but only when your controls, your application, and your incident reporting all hold up. Given how many U.S. cyber claims closed without payment in 2024, the time to learn what your policy requires is before you file.
The businesses most at risk are often the ones that completed the renewal and then left their controls alone until the next one. If your protections no longer match what you declared, your claim can be challenged, and the full cost of an incident lands on your business. To see what that could mean, look at what a breach can cost a business your size.
If you’re unsure whether your current setup would stand up to your insurer’s renewal questions, book a no-pressure conversation with Ironclad TEK. We’ll talk through the safeguards your insurer asks about, how they’re documented, and any gaps, so you know what needs attention first.
