How to Save on Cyber Insurance
Cyber underwriters price the security habits you keep as much as the industry you work in. This guide explains the controls insurers ask about, why each one matters to them, and the policy choices that keep a cyber premium in proportion to your real exposure.
Why controls drive cyber pricing
Most lines of insurance are priced on size and activity. Cyber adds a long list of questions about how you run your systems, because a few weak spots explain a large share of losses. Marsh, the insurance broker, says insurers have tightened underwriting and now question applicants about their cyber operating environment and risk controls, and that adopting certain controls has become a minimum requirement of insurers. Missing one of them can narrow your choices before price even comes up.
Insureon’s published cost data lists the other factors: your industry, how many staff can reach sensitive information, the kind of records you store, your claims history and the risk management you practice. Several of those sit within your control. The cyber insurance page covers what the policy does, and How to Save on Business Insurance covers habits that help across every line.
Multifactor authentication where it counts
If you fix one thing before applying, make it multifactor authentication. A Microsoft Research study published in May 2023 found that MFA reduced the risk of account compromise by 99.22% across the accounts it examined, and by 98.56% where credentials had already leaked. The same study found that authenticator apps performed better than text-message codes. Marsh lists MFA for remote access and for administrator accounts first among its twelve key controls.
- Email, which is the doorway to password resets and payment fraud.
- Remote access of any kind, including VPNs and remote desktop tools.
- Administrator and other privileged accounts, on every system.
- Cloud storage, backups, payroll and online banking.
Answer the application exactly. A “yes” to MFA that is true for email but not for remote access is the kind of gap that causes trouble when a claim is reviewed. If a control is partly in place, say so and describe the date you expect to finish.
Backups, endpoint tools and patching
Ransomware losses grow when a business cannot restore its own data. Marsh calls for backups that are secured, encrypted and tested, kept isolated from the network or protected by MFA and encryption. Run a test restore every few months and write down the date, because underwriters increasingly ask when you last proved that recovery works.
Endpoint detection and response, usually shortened to EDR, is software that watches laptops and servers for attacker behavior and can isolate a machine that starts acting oddly. It sits on Marsh’s list too, alongside patch and vulnerability management and replacing or protecting end-of-life systems. An outside IT provider can usually add EDR and automatic patching under an existing service plan. Ask for a one-page summary of what they run, because that summary answers half the application.
Hold less data and keep a plan
Every customer record you store is something a breach could expose and a notice could have to reach. The FTC’s guide to protecting personal information starts with five principles, and one of them is to scale down: keep only what you need for your business. Purge old card details, copies of IDs and closed-account files on a schedule, and the record counts you report on an application shrink with them.
The FTC also tells businesses to plan ahead for security incidents, and an incident response plan is on Marsh’s list as well. A single page naming who to call, where the policy number lives offline and which systems come back first is enough for many small firms. The cyber insurance readiness checklist walks through building one along with the rest of an application.
Staff habits and payment checks
Phishing remains a common way in, so Marsh includes cybersecurity awareness sessions and phishing tests among its controls, along with email filtering and web security. Short, regular reminders and an occasional practice phishing email build the reflex. Keep a simple log of when they happen so you can answer the application with dates instead of impressions.
Fraudulent payment requests deserve their own rule: any new or changed bank details get confirmed by phone, using a number already on file. Funds-transfer and social-engineering fraud sit where cyber and crime coverage overlap, and each is often written with its own smaller limit. How to Save on Crime Bonds covers the money controls that matter on the crime side.
Choosing limits, deductibles and packages
Insureon reports that cyber limits generally fall between $1 million and $5 million, with average deductibles of $1,000 to $2,500, and that policies with higher deductibles are less expensive. Pick a deductible you could pay without strain, and size the limit to your record counts and to any figure a client contract names rather than to the largest option on the page.
Before trimming a quote, look at what each part covers. The FTC lists first-party items such as data recovery, customer notification, business interruption and extortion, and third-party items such as claims and regulatory response. Dropping a part to lower the premium makes sense only when you understand which risk you are taking back.
Insureon also notes that businesses can often save by bundling policies with one insurer, that many insurers discount a premium paid annually, and that technology E&O costs less than buying cyber and E&O separately. Technology and advisory firms should read How to Save on Errors and Omissions Insurance before deciding how to package the two.
A few useful answers
Common questions
Will turning on multifactor authentication lower my cyber insurance premium?
No insurer promises a set reduction, but MFA is treated as a baseline control. Without it on email, remote access and administrator accounts, many insurers will offer fewer options or decline, so it shapes your choices before price does.
What is endpoint detection and response, and why do cyber applications ask about it?
EDR is security software that watches computers and servers for attacker behavior and can cut off a compromised device. Insurers ask because it helps stop ransomware early, which limits the size of a claim.
Does deleting old customer records affect a cyber insurance quote?
It can help. Applications ask what kinds of records you hold and roughly how many, and fewer stored records means less to expose and fewer people to notify after a breach.
Should a small business pick a higher deductible on its cyber policy?
A higher deductible lowers the premium, but you pay that amount first after an incident. Choose a figure your cash flow could absorb during a week when your systems might be down.
How do I show a cyber underwriter that our backups actually work?
Record the date of your last test restore, how often backups run and where the separated copy is kept. Specific dates and details read far better on an application than a simple yes.