Cyber insurance premiums will frequently run a small to mid-sized business 1,200–7,000 a year, depending on your industry. Rates spiked during the 2021–2022 hard market, then eased over the next two years. That's about to change: insurers are forecasting a 15%–20% increase in 2026 as claims costs catch up with pricing.
That’s the bad news.
The good news? There’s something you can do about your insurance bill. Even better? It’s stuff you should be doing anyway.
What insurers require before they set your cyber insurance premium
Every cyber insurance application starts with a questionnaire, and every questionnaire is really a checklist of what underwriters need to see before they'll write a policy or offer a better rate.
That’s a good thing. Insurers are trying to price based on actual risk, rather than blanket rate hikes.
Below, I’ll share the 12 items that show up most often on applications and the ones that give you the most room to negotiate at renewal.
1. Turn on multi-factor authentication (MFA)
Multi-factor authentication is usually the first thing an underwriter checks, and for good reason — it closes off the most common way stolen credentials get used.
If MFA isn't turned on for all accounts yet, this is the fastest way to change your risk profile before your next renewal.
2. Map your controls to a recognized framework (NIST, ISO, or SOC)
A framework (like NIST CSF) doesn't replace the controls on this list — it's how you prove you have them. Insurers increasingly ask which framework you follow, because it gives them a standardized way to verify your risk instead of taking your word for it.
3. Back up your data (the right way)
A backup strategy only counts if it's tested, isolated from your main network, and fast enough to actually restore operations after an incident.
Modern ransomware specifically targets backups it can find, so insurers want to see that yours are protected separately from the systems they're backing up.
4. Move toward Zero Trust architecture
Zero Trust starts from the assumption that no user or device should be trusted by default, even inside your own network. That matters to insurers because it limits how far an attacker can move once they're in, which is often the difference between a contained incident and a full breach.
5. Build a documented incident response plan
An incident response plan spells out exactly who does what in the first hours after a security incident: who's notified, what gets isolated, and who talks to customers and regulators.
A data breach now costs U.S. organizations $10.22 million on average — an all-time high. Businesses that can move fast in the first hours can contain those costs far better than ones improvising in real time.
6. Use microsegmentation to limit lateral movement
Microsegmentation divides your network into smaller, isolated zones, so a compromised device or account can't reach the rest of your systems.
More carriers now ask directly whether it's in place, particularly for businesses handling sensitive client or patient data. It's a deeper technical lift than most items on this list, so map it out with a partner before deciding where the segments go.
7. Enforce least-privilege, identity-based access controls
Least privilege means giving each employee access only to the systems and data their job actually requires, nothing more. Combined with identity-based controls, it narrows how much damage a single stolen password or compromised account can do — which is exactly what underwriters are trying to price.
8. Manage vendor and third-party risk
Your security posture is only as strong as the vendors and partners who touch your systems. A documented process for vetting new vendors and reviewing existing ones signals that a third-party connection isn't a way around your own defenses.
Having a single tech partner across IT, print, and security instead of a patchwork of vendors can make this easier — fewer connections means fewer questions to answer.
9. Train your staff to recognize threats
Most breaches still start with a person, not a piece of malware: a clicked link, a convincing email, a reused password.
Regular training that teaches employees what phishing and social engineering actually look like is one of the lowest-cost, highest-return items on this list. Marco builds ongoing awareness training into its Managed IT engagements because one session a year isn't enough to change behavior.
10. Run regular penetration testing
A penetration test is a controlled, authorized attempt to break into your own systems before someone with bad intentions does it for real.
Insurers view a recent test as proof that your defenses have actually been verified, not just documented on paper. An annual cadence is a reasonable baseline for most mid-market businesses, though your industry and data sensitivity may call for more.
11. Practice proper password management
Weak or reused passwords remain one of the most common ways into a business's systems. A password manager that generates and stores unique, complex credentials for every account removes that risk without adding friction for your team, and gives IT a way to revoke access instantly when someone leaves.
12. Keep your compliance posture future-proofed
Cybersecurity requirements aren’t static — new regulations, new carrier requirements, and new industry standards arrive every year.
Building your controls around a framework that adapts, rather than a one-time checklist, means your next renewal conversation starts from a stronger position.
Frequently asked questions about cyber insurance and premiums
We’re not insurance providers, but we do help our clients with renewal questionnaires. Here are a few things our clients often ask us.
How can you lower your cyber insurance premium?
Put the controls insurers actually ask about in place before you apply or renew: multi-factor authentication, a documented incident response plan, regular employee training, and a tested backup strategy, among others. Businesses that can prove these controls exist typically qualify for better rates than those still building them.
Is cyber liability insurance worth it?
For most businesses handling customer data, financial information, or online systems, yes. A breach now costs U.S. organizations $10.22 million on average, an expense most companies can't absorb on their own, which is exactly what a policy is designed to offset.
What are cyber insurance requirements?
Requirements vary by carrier and industry, but most underwriters look for multi-factor authentication, a documented incident response plan, regular data backups, and employee security training at minimum. Larger policies or higher-risk industries may also require a recognized framework like NIST or a recent penetration test.
What does cyber insurance not cover?
Most policies exclude prior known incidents, intentional acts by employees, and losses tied to security controls a business claimed to have but hadn't actually implemented. Reviewing exclusions with your broker before a claim happens is the only way to know exactly where those lines fall for your coverage.
Getting expert help to lower your premium
Most businesses don't tackle all 12 items in a single quarter, nor does every organization have to be Fort Knox. What matters is knowing where you stand today and prioritizing the controls that matter most for your industry and risk profile.
We take a practical approach to cybersecurity that focuses on eliminating your biggest risks according to how you work and how you’re likely to be attacked.
Want a sneak preview of what one of our cybersecurity experts would recommend?
Click the link below to get a clear picture of where your organization stands right now — it takes a few minutes and provides custom recommendations of what needs to be updated now vs. later.
