How Cyber Insurance Requirements Are Changing in 2026
By Daniel Agyemang Prempeh, Founder, DefendVistaLast reviewed:
What UK insurers now expect SMEs to have in place, how the 2026 underwriting cycle is tightening, and how to renew without unpleasant surprises.
Cyber insurance is no longer a tick box renewal. UK insurers have tightened requirements every year since the ransomware wave of 2022 and the 2026 underwriting cycle continues the trend. SMEs that have not refreshed their controls are now routinely seeing premium increases of 25 to 60 percent, reduced cover, sub limits on ransomware, or outright refusals from preferred markets. This is what brokers and underwriters are actually asking SMEs to demonstrate.
What insurers are asking now
MFA on email, remote access, all admin accounts and any system holding financial or personal data. EDR (not legacy antivirus) on every endpoint, with central reporting. Tested offline or immutable backups (snapshots on the same SAN no longer qualify with most insurers). A documented and tested incident response plan. Email security including DMARC at minimum p=quarantine, SPF and DKIM. Staff awareness training with measurable phishing simulation results. Privileged access management for IT admins. For larger SMEs, evidence of network segmentation.
What is changing in 2026
Expect tighter scrutiny on supplier risk (your IT outsourcer's controls now affect your premium), evidence requirements for backup testing (not just declarations), stricter wording around ransom payments with explicit exclusions for sanctioned threat actors, and growing pressure on operational technology coverage for hauliers and warehouse operators with telematics or WMS estates. Several markets are also introducing systemic risk exclusions for nation state or critical infrastructure events.
How to prepare for renewal
Start 90 days before renewal, not 30. Run an honest control review against the broker's questionnaire and your current policy wording. Close gaps that will affect either premium or coverage, prioritising MFA, backups and EDR. Document what you have with screenshots, policy excerpts, training completion reports and backup test results. Bring evidence to the renewal meeting. A well prepared operator with a written incident plan, current Cyber Essentials Plus and clean phishing simulation data typically holds premium flat in a market where unprepared peers are seeing 40 percent increases.
What happens when you cannot meet the requirements
Several outcomes, increasingly common. Quote with a ransomware sub limit (often 50 percent of overall cover). Higher excess (£25,000 to £100,000 is now standard for transport SMEs). Specific exclusions for systems where controls are missing. Conditional cover (must implement MFA within 60 days or cover lapses). Outright refusal from preferred markets, leaving you with surplus lines or no cover at all. Brokers can help structure the placement, but the underlying controls still need to be in place.
The bigger picture
Insurance is a layer in a defence in depth model, not a substitute for controls. The Marsh and Aon claims data both show that operators with mature controls have shorter outages, smaller losses and faster claim settlements. Treat the underwriting questionnaire as a useful, externally validated checklist of what good actually looks like for an SME in your sector.
Sector specifics for transport and logistics
Insurers are increasingly asking about telematics portal security, customer EDI gateway access controls, driver awareness training and depot network segregation. Two markets we work with now ask explicitly whether your TMS has MFA and whether the TMS vendor has a SOC 2 report. Bring the answers to renewal and you accelerate the conversation. Be unable to answer and the underwriter prices for the unknown.
Frequently asked questions
Can a broker hide control gaps from the insurer?+
A broker may package an application sympathetically, but misrepresentation invalidates claims. Always be accurate. The cost of an invalidated claim during a real incident dwarfs any premium saving.
What is the most common reason for a refused claim?+
Failure to meet a stated control, particularly MFA on the affected system or backups that turned out to be untested or compromised, at the time of the incident. The control either was in place or it was not: insurers are increasingly using forensic evidence to verify.
Is cyber insurance worth it?+
Usually yes for SMEs that cannot self insure the downtime cost of a ransomware event. Cover should complement, not replace, the underlying controls. Without the controls, you are uninsurable at sensible premium.
Will Cyber Essentials Plus help my premium?+
Often yes, particularly with UK domestic insurers. Several offer explicit premium discounts of 5 to 15 percent for certified firms, and many now treat the certification as a minimum standard rather than an upgrade.
Next step
Want to talk this through?
Book a free 30 minute consultation. No sales pitch, just clear answers.
Book free consultation