Why cyber insurance got harder to buy in 2020

Cyber insurance changed dramatically in 2020. Premiums rose. Coverage narrowed. Deductibles increased. And the application process became far more demanding. Organizations that had renewed cyber insurance with minimal questions in 2019 found themselves answering detailed inquiries about multi-factor authentication, backup practices, and security awareness training in 2020. The market had hardened, and the reason was simple: ransomware had surged, claims had spiked, and carriers could no longer afford to write coverage without verifying that policyholders had basic security controls in place.

The ransomware surge

Ransomware attacks increased significantly in 2020, targeting organizations of every size. Hospitals, municipalities, schools, and small businesses all faced incidents. The average ransom demand grew. The average recovery cost, including downtime and remediation, grew even more. Insurance carriers that had underwritten policies based on limited risk data suddenly faced claims they had not priced for. The market responded by tightening underwriting standards across the board.

What carriers started asking for

By mid-2020, most cyber insurance applications included questions that had been rare the year before. Carriers wanted to know: whether multi-factor authentication was enforced on remote access and email; whether endpoint detection and response was deployed; whether backups were maintained offline and tested regularly; whether security awareness training was conducted annually for all employees; and whether the organization had a documented incident response plan. Organizations that could answer yes to these questions received better terms. Those that could not faced higher premiums or non-renewal.

Training documentation became a gate

Security awareness training moved from a nice-to-have to a must-have for insurance eligibility. Carriers understood that most breaches involved human error, and they wanted evidence that organizations were addressing that risk. A vague statement that employees were trained was no longer sufficient. Carriers began requesting: completion rosters with names and dates; certificates of completion; training content summaries showing topics covered; and evidence that new hires were trained before accessing systems. Organizations with documented training programs had a significant advantage at renewal.

What organizations should have done

The best-prepared organizations took three steps. First, they conducted a security assessment against the questions carriers were now asking and closed the gaps they found. Second, they implemented or documented the controls they already had, especially MFA, backups, and training. Third, they gathered their documentation before the renewal application arrived, rather than scrambling to produce it under a deadline. Proactive preparation produced better outcomes than reactive responses.

The long-term shift

The 2020 hardening of the cyber insurance market was not temporary. It marked a permanent shift in how carriers evaluate risk. Going forward, documented security controls, including annual training, became a baseline expectation rather than a differentiator. Organizations that treated these controls as formal programs, with records and review cycles, positioned themselves well. Those that treated them as informal activities faced increasing friction at every renewal.