There was a time when cyber insurance was purchased like office furniture: pick a limit, sign the form, file it away. That era is over. Today the questionnaire runs pages deep, the answers are verified, and the connection between your security program and your policy is direct enough that they've effectively become the same document.
What underwriters actually check
The modern application asks for evidence, not intentions: MFA coverage across email, remote access, and admin accounts — with the gaps enumerated. Endpoint detection and response, and whether anyone monitors it after 5 p.m. Backup architecture, immutability, and the date of your last tested restore. An incident response plan with named roles. Patch cadence. Vendor management. And the newest section: generative AI — what tools are in use, what data may enter them, and whether a written policy governs it (we covered what that policy needs to contain).
The three ways answers cost you
Premiums. Weak controls price directly into the quote — organizations with strong, evidenced controls are seeing materially better renewals than those without.
Exclusions and sublimits. Can't attest to MFA? Some carriers will still write the policy — with social-engineering losses excluded or capped at a fraction of the limit. You're insured, except for the way you're most likely to be hit.
Claims. This is the one that hurts. Attest to a control you don't actually have, suffer a loss that touches it, and you've handed the carrier a misrepresentation argument. The most expensive sentence in cybersecurity is "we said yes on the questionnaire."
Answering honestly without overpaying
The wrong response is creative form-filling. The right one is closing the premium-moving gaps before renewal season — most of them (MFA completion, EDR deployment, backup testing, a real IR plan) are weeks of work, not quarters, and they pay for themselves in the quote. The sequence we run in our renewal readiness engagement: map your posture against the actual questionnaire, close the gaps that move premium, and package the evidence so your broker negotiates from strength. Two to six weeks, fixed scope.
The reframe worth internalizing
Security spend used to be justified by fear. Now it has a price signal: every control has a premium consequence, an exclusion consequence, and a claims consequence you can roughly quantify. That makes the budget conversation with your CFO dramatically easier — a theme we take further in the economics of not getting hit. If your renewal lands this year, start the conversation before the questionnaire does.