Cyber Insurance Underwriting Is Quietly Changing and Many SMBs Are Unprepared

Cyber insurance may still be competitively priced, but behind the scenes, carriers are becoming dramatically more selective about who they are willing to insure and what security controls they now expect before binding coverage.

For insurance agents and agencies serving commercial clients, this shift is creating both a challenge and a major opportunity. Small and midsize businesses that once viewed cyber insurance applications as routine paperwork are now facing increasingly detailed underwriting scrutiny around cybersecurity controls, employee behavior, vendor access, cloud systems, and incident response readiness.

The message from carriers is becoming clearer every quarter: organizations that cannot demonstrate basic cyber hygiene may struggle to secure affordable coverage, face reduced limits, or be declined entirely.

For agencies willing to guide clients through these changes, the evolving cyber market may become one of the strongest relationship-building opportunities in commercial insurance today.

Cyber Underwriting Has Quietly Changed

Only a few years ago, many cyber applications focused heavily on revenue size, industry class, and broad operational questions. Today, carriers are asking much deeper technical questions because cyber losses continue to escalate across nearly every industry segment.

Ransomware attacks, vendor breaches, social engineering losses, cloud outages, and business email compromise claims have forced insurers to reevaluate how they assess cyber risk. Underwriters increasingly want proof that insureds are actively managing security controls rather than simply checking boxes on an application.

The shift is especially noticeable among small and midsize businesses that historically believed they were too small to attract cybercriminals. In reality, many attackers now specifically target SMBs because they often lack dedicated IT teams and mature security controls.

“Cybercriminals are no longer just targeting large corporations. Small businesses have become some of the most vulnerable and profitable targets in the marketplace.”

National Cybersecurity Alliance

The Five Areas Drawing the Most Attention From Carriers

Underwriters are increasingly focusing on a handful of recurring weaknesses that appear repeatedly in cyber claims investigations. Agencies that understand these concerns are better positioned to help clients prepare before applications ever reach underwriting.

Multi Factor Authentication Is Becoming Mandatory

Multi factor authentication, commonly known as MFA, has rapidly moved from a recommended safeguard to an expected baseline requirement.

Many carriers now require MFA for:

• Remote access systems, email platforms, administrative accounts, cloud applications, and financial transaction approvals

Businesses still relying solely on passwords are increasingly viewed as high-risk accounts. Some underwriters are specifically verifying whether MFA is universally enforced or only partially implemented.

Vendor Access Has Become a Major Exposure

Third-party vendors now represent one of the fastest-growing areas of cyber concern. Attackers frequently compromise smaller vendors first, then use those relationships to gain access into larger organizations.

Carriers increasingly want to know:

How many outside vendors have system access? Are vendors using MFA? Are vendor permissions reviewed regularly? Can access be quickly terminated after a contract ends?

Businesses that cannot clearly answer these questions may encounter additional underwriting scrutiny.

Employee Training Is No Longer Optional

Human behavior continues to drive many cyber claims. Phishing emails, fraudulent payment requests, and social engineering attacks remain among the most common causes of financial loss.

As a result, carriers increasingly expect policyholders to conduct recurring employee cybersecurity awareness training.

Some underwriters are even asking how frequently employees receive training and whether phishing simulations are conducted internally.

Cloud Dependency Is Raising New Questions

Cloud platforms have simplified operations for many businesses, but they have also introduced concentration risk.

A single outage involving a cloud provider, payroll platform, accounting system, or software vendor can suddenly disrupt thousands of businesses simultaneously.

Underwriters increasingly want to understand whether businesses maintain backups, contingency plans, and operational redundancies if cloud services become unavailable.

Documentation Gaps Are Creating Problems

One growing issue in cyber underwriting is the gap between what businesses believe they are doing and what they can actually document.

Many organizations verbally confirm they have cybersecurity protocols in place, yet lack written policies, employee records, vendor agreements, or formal response procedures.

In the event of a claim, missing documentation can create serious underwriting and coverage complications.

Why This Matters So Much for Insurance Agencies

For agencies, these changes are about far more than simply completing cyber applications.

Commercial clients are increasingly overwhelmed by cybersecurity terminology, evolving compliance expectations, and growing concerns about ransomware and data breaches. Many business owners simply do not know where to start.

That creates an opportunity for agencies to position themselves as practical advisors rather than transactional policy sellers.

Agencies that proactively educate clients on underwriting expectations can strengthen retention, improve submission quality, reduce remarketing issues, and deepen long-term relationships.

The Market Is Rewarding Prepared Businesses

Despite tighter underwriting standards, the broader cyber market remains competitive for businesses that demonstrate strong controls.

Well-prepared accounts are often securing:

Better pricing, broader terms, improved capacity, and smoother renewals.

Meanwhile, organizations with weak controls are increasingly facing difficult renewal conversations, restrictive terms, sublimits, or higher deductibles.

This widening gap between prepared and unprepared insureds is likely to continue as carriers refine underwriting models and claims data.

“Cyber insurance underwriting is evolving from questionnaire driven to evidence driven.”

Cyber Risk Advisor, U.S. Commercial Market

Agencies That Lead Early May Gain a Competitive Edge

Many SMB clients are still underestimating how quickly cyber underwriting expectations are evolving. Some business owners only discover deficiencies after a renewal problem or a declined submission.

Agencies that address these conversations proactively may place themselves in a much stronger position heading into future renewals.

Even simple conversations around MFA implementation, employee training frequency, vendor management, and backup procedures can help clients avoid costly surprises later.

More importantly, these discussions reinforce the agency’s role as a trusted advisor focused on protecting the client’s business, reputation, and operational continuity.

Cyber insurance is no longer just a standalone coverage conversation. It is becoming a broader business resilience discussion, and agencies that recognize that shift early may be the ones that stand out most in the years ahead.