Cyber Insurance in Australia: The Controls Insurers Now Require

There was a time when a cyber insurance application was a short form with a handful of yes or no questions, completed by whoever in the business had a spare twenty minutes. That is no longer what happens, and businesses renewing this year are discovering it at renewal rather than before it.

The application has become a technical audit. Underwriters ask detailed questions about specific controls, increasingly verify the answers through external scanning and third-party telemetry rather than taking them on trust, and hold the business to those answers if a claim is ever made. The questions are harder, the evidence requirements are real, and the consequences of answering optimistically have become severe.

This guide covers what Australian underwriters actually assess, why the accuracy of your answers matters more than the answers themselves, and what to have in order before your next renewal.

The Controls Underwriters Now Expect

Requirements vary between insurers, but the Australian market has converged on a fairly consistent core. For a business of fifteen to a hundred and fifty people, expect to be asked about all of the following.

Multi-factor authentication across email, remote access, administrator accounts, cloud consoles and increasingly backup systems. This is the single most important control in underwriting, and absent or partial MFA is among the most common reasons cover is refused or heavily loaded. Phishing-resistant methods such as hardware keys are increasingly preferred over SMS.

Endpoint detection and response on all devices, including servers, with active monitoring. Legacy signature-based antivirus does not satisfy this. Several insurers now want to see that alerts are acted upon outside business hours rather than simply generated.

Immutable or offline backups, separated from the production environment so that ransomware holding domain administrator credentials cannot reach them, with documented and tested restoration.

Documented patch management with defined timeframes for critical vulnerabilities.

A written and tested incident response plan.

Email authentication — SPF, DKIM and DMARC configured and enforced. This carries more weight than people expect, because business email compromise and funds transfer fraud account for a substantial share of claims.

Security awareness training with phishing simulation, and privileged access management separating day-to-day accounts from administrative ones.

For cover above roughly a million dollars, insurers increasingly ask for third-party attestation as well — an Essential Eight maturity assessment, an ISO 27001 certificate, or a security rating.

If that list looks familiar, it should. It maps closely onto the ACSC’s Essential Eight, which is not a coincidence. A business that has worked through Essential Eight maturity is most of the way to satisfying an underwriter, and our guide to the Essential Eight covers those controls in detail.

The Real Risk Is Not the Premium

Here is the part we would most like business owners to absorb.

The genuine exposure in cyber insurance is not paying too much. It is holding a policy that will not respond, because the controls you declared on the application were not fully in place when the incident happened.

Virtually every cyber policy contains language to the effect that it is issued in reliance on the representations made in the application, and that material misrepresentation may allow the insurer to deny a claim or rescind the policy entirely. That clause is not new. What has changed is how willingly insurers now use it, and how much verification sits behind the underwriting.

The uncomfortable detail is that intent does not appear to matter much. The denials causing the most damage are not fraud. They are businesses that genuinely believed they had a control in place, answered honestly to the best of their knowledge, and discovered afterwards that the reality did not match. A business that declared MFA everywhere, and had it on every account except a legacy service account nobody remembered, has a misrepresentation problem — and in the leading overseas case the breach did not even need to be caused by the gap for the policy to be rescinded.

That case, Travelers v International Control Services, is an American decision and we would not want to overstate its direct application here. Australian insurance law has its own rules on non-disclosure and misrepresentation. But it is widely cited because it illustrates the mechanism plainly, and Australian underwriters are operating on the same logic.

We would add one note of caution about the statistics circulating on this topic. You will read that forty per cent of Australian cyber insurance claims were denied in 2024, and that a particular percentage of those involved MFA. Those figures come from United States insurance regulators and American carrier data, not from the Australian market, despite frequently appearing in Australian articles without that distinction. The direction of travel is real. The numbers are borrowed.

What an Australian Court Has Actually Said

For an Australian example with real consequences, the better reference is not an insurance case at all.

In February 2026 the Federal Court ordered FIIG Securities to pay a civil penalty of $2.5 million, plus $500,000 towards ASIC’s costs, over cyber security failures across a four-year period. The failures culminated in an intrusion in 2023 in which roughly 385 gigabytes of data was taken, affecting around 18,000 clients. It was the first time an Australian court imposed civil penalties for cyber security failures under the general obligations applying to financial services licensees.

The detail that matters for every business, regardless of industry, is this. FIIG had identified cyber security as a material risk. It had written policies. The problem was that it did not consistently implement, maintain and monitor the controls those policies described. Having the documentation was not a defence; the gap between the documentation and the practice was part of the finding.

Justice Derrington was careful to note that a successful cyber attack does not by itself indicate a failure to meet statutory obligations, and that the standard being applied is not perfection. The concern is adequacy: whether the protections an organisation claimed to have were genuinely in place and operating.

That is the same principle an insurer applies at claim time, arrived at independently by an Australian court. A control that exists on paper and not in production is the exposure, whoever is asking.

The MFA Trap

Since MFA is the control that causes the most claim trouble, it is worth being specific about where businesses come unstuck.

The question on the form usually asks whether MFA is enabled on all administrator accounts, all remote access and all email accounts. The honest answer for a surprising number of businesses is “mostly,” and mostly is not what the form records.

The common gaps are service accounts created for an application years ago, legacy authentication protocols that bypass conditional access entirely, contractor and third-party accounts, shared mailboxes, and accounts belonging to senior staff who requested an exemption because the prompts were inconvenient. Each is individually explicable. Collectively they mean the declaration on the form is not accurate.

There is also a distinction between MFA being available and MFA being enforced. A tenant where MFA is configured but not mandated through policy is not the same as one where it cannot be bypassed, and underwriters have become considerably better at telling the difference.

Our advice here is plain: answer the form accurately even where the accurate answer is worse. If MFA is on eighty per cent of accounts, write eighty per cent. A slightly higher premium on an accurate declaration is worth far more than a lower premium on a policy that will not respond.

New Conditions Worth Knowing About

Three developments have changed policies over the past two years and catch businesses unaware.

Statutory reporting as a policy condition. Many insurers now write compliance with the Cyber Security Act’s seventy-two hour ransomware payment reporting obligation into the policy. Failing to meet a legal obligation can therefore also give grounds to deny a claim, which means the reporting duty is no longer only a regulatory matter. Our guide to mandatory ransomware payment reporting covers who is captured and where the clock starts.

Ransomware sub-limits. Cover for ransomware is frequently capped well below the overall policy aggregate, particularly for businesses without strong controls. It is worth reading that number rather than assuming the headline limit applies.

Exclusions have tightened. War and state-sponsored attack exclusions have broadened following changes in the Lloyd’s market, and policies written in the last two years increasingly contain exclusions touching on artificial intelligence. These are worth reading closely, and worth asking your broker about directly.

Why This Costs Less Than It Looks

It is easy to read the list above as an expensive compliance exercise. In practice, most of it is the same work that keeps your business running through an incident, and a good deal of it is already licensed.

A business on Microsoft 365 Business Premium already has conditional access, Intune and Defender for Business included. Enforcing MFA properly costs nothing but configuration and a short period of staff inconvenience. Email authentication is a DNS exercise. The genuinely new spend is usually managed detection, backup improvements, and awareness training.

Set against that, the alternative is a premium paid annually for a policy that may not respond, which is the worst outcome available: the cost without the protection.

There is also a direct commercial return. Businesses that can produce evidence quickly at renewal are in a materially stronger position on both premium and cover than those scrambling to answer questions in the week the policy expires.

What to Do Before Your Next Renewal

Start ninety days out rather than in the final fortnight. That is enough time to close a gap; two weeks is only enough time to discover one.

Work through the control list above and record your honest current position for each, including the exceptions. Then close what can be closed quickly — MFA coverage gaps, enforcement rather than availability, offboarding, and backup separation are usually the fastest wins. Where something cannot be fixed before renewal, document the plan and the timeframe, because an underwriter presented with a known gap and a credible remediation plan responds quite differently to one who discovers the same gap afterwards.

Then gather your evidence. If you hold an Essential Eight maturity assessment or an ISO 27001 certificate, give it to your broker before the application rather than after. Engage the broker early and treat them as an adviser rather than a form-processor.

And build a habit of reviewing the declarations annually. Your environment changes, staff join and leave, applications get added, and a declaration that was accurate at the last renewal quietly stops being accurate somewhere around month seven.

A Note on Evidence

We hold ISO 27001 certification, which means our own information security practices have been independently assessed rather than described. We mention it here for a specific reason rather than as a credential: it has taught us the difference between having a control and being able to evidence a control, which is exactly the gap that causes cyber insurance claims to fail.

An external auditor does not accept that a policy exists. They ask to see it operating. Underwriters are moving in the same direction, and so, as the FIIG decision shows, are Australian courts.

Frequently Asked Questions

What controls do Australian cyber insurers require? The common baseline is multi-factor authentication across email, remote access and privileged accounts; endpoint detection and response on all devices; immutable or offline backups with tested restoration; documented patch management; a written incident response plan; email authentication through SPF, DKIM and DMARC; security awareness training; and privileged access management. Cover above roughly a million dollars often also requires third-party attestation.

Why do cyber insurance claims get denied? The most common preventable reason is a mismatch between the controls declared on the application and the controls actually in place at the time of the incident. Other causes include failing to maintain declared controls after the policy is bound, late notification, and policy exclusions.

Does Essential Eight compliance help with cyber insurance? Yes. The controls Australian underwriters assess map closely onto the Essential Eight, and a maturity assessment gives your broker documented evidence rather than self-attestation. Maturity Level 2 is increasingly the level insurers reference.

What happens if we said we had MFA and we did not quite? It depends on the policy and the circumstances, and this is a question for your broker and your lawyer rather than for us. What we can say is that partial MFA declared as complete is the most common attestation problem we encounter, and the safest course is to correct the record with your insurer rather than leave it unaddressed.

How much does cyber insurance cost for an Australian business? It varies considerably with turnover, sector, cover limit and control maturity. Indicatively, smaller businesses with sound controls and modest limits sit in the low thousands annually, while larger mid-market policies with higher limits run well into the tens of thousands. Control maturity has a genuine effect on pricing.

Do we have to report a ransomware payment to keep our cover? Many policies now include compliance with the Cyber Security Act’s seventy-two hour reporting obligation as a condition. Separately, the legal obligation applies to businesses with turnover of three million dollars or more regardless of what the policy says.

The Control Checklist

We have put together a checklist covering each control Australian underwriters assess, what evidence satisfies it, and the common gaps that turn an honest “yes” into a misrepresentation. It is written to be worked through before you complete an application rather than after.

[Download the cyber insurance control checklist]

If you would rather have someone look at the environment itself, our TechSecure assessment reviews identity and access management, network and system configuration, backup arrangements and policies, and produces a register of risks with practical remediation steps. It benchmarks against the ACSC Essential Eight, which is the same ground your underwriter is covering.

Renewal coming up and not sure your answers would hold? Contact our friendly Brisbane team for a chat today.

Read more about TechSecure, our cyber security assessment