Why Your Cyber Insurance Claim Can Be Denied After a Breach: a real world disaster scenario.
Most business owners assume cyber insurance works like every other policy they carry. Pay the premium, file a claim when something goes wrong, get paid. That assumption is increasingly wrong. Insurers are denying breach claims, courts are backing them, and the reason usually has nothing to do with the hacker.
The case that set the pattern
In 2022, a ransomware attack hit International Control Services, an electronics manufacturer in Decatur, Illinois. The company filed a claim with its carrier, Travelers. A forensic investigation then found that a server involved in the attack was not protected by multi-factor authentication, even though the company's policy application had stated that MFA was in place. Travelers went to court to void the policy entirely. In August 2022, the court ruled in the carrier's favor and allowed it to rescind the policy. The claim was denied not because the missing MFA caused the breach, but because the company had attested to a control it did not fully have.
It was not a one-time ruling
That decision became a template the industry has followed since. In 2025, a municipality had a claim of roughly 18 million dollars denied because MFA had not been fully rolled out, even though its own insurer had recommended the rollout two years earlier. The pattern is consistent. Insurers now conduct technical audits after a breach and compare what they find against what the policyholder claimed on the application. Any gap, even an accidental one, can be grounds for denial.
The trap is aspirational compliance
Most companies do not lie on their applications. They overstate by accident. An application asks whether you enforce MFA on all administrative access. The honest answer is often mostly, or we are rolling it out, but the form offers only yes or no, so the box gets checked yes. By one analysis, roughly one in four systems reported as protected by MFA do not actually have it enforced. After a breach, that gap between intent and execution is exactly what gets examined, and we meant to is not a defense in a contract.
What carriers expect now
Cyber underwriting has changed. Carriers now commonly require MFA across all systems, endpoint detection and response, immutable backups, a written incident response plan, security awareness training, and vendor risk reviews. One analysis of denied claims found that a large share traced back to the same recurring issue: incomplete identity controls, with MFA gaps at the center. The takeaway is that the controls on your application are not a formality. They are the conditions of the contract.
What to actually do
- Pull your most recent application and read it line by line. For every control you attested to, confirm it is enforced everywhere, not mostly.
- Treat partial MFA the way an investigator will, which is to say as no MFA at all.
- Document your controls in language an underwriter will accept, before you need to, not during a claim.
None of this is exotic work. It is the difference between a policy that pays and a very expensive piece of paper.
The bottom line
Cyber insurance is still worth carrying. But it is a contract, not a safety net, and it pays out only when the security you attested to matches the security you actually run. The time to close that gap is now, while it is a paperwork problem and not a claims problem.
See what Promethos can do for you: Promethos Services
Disclaimer
This article is general information, not legal or insurance advice. Coverage terms and claim outcomes depend on your specific policy and circumstances.
Sources
- Insurance Journal, Travelers Wants Out of Contract With Insured That Allegedly Misrepresented MFA Use
- Portnox, Think You're Covered? 40% of Cyber Insurance Claims Say Otherwise
- Briskinfosec, Your Cyber Insurance Claim May Be Rejected
- Forrester, Who's Responsible For Cyber Insurance Policy Misrepresentations? It Depends.
- Galactic Advisors, Rising Scrutiny of MFA in Cyber Insurance Claims
- Specops Software, MFA Failure Costs Municipality $18m in Cyber Insurance Payout
- Intel Tech, 82% of Cyber Insurance Denied Claims Had One Thing in Common
Chay Butler is the founder of Promethos Cyber Services and brings roughly 30 years in tech and cybersecurity, from front-line technical support to Principal Security Engineer roles, at large companies including ALLTEL, Web.com, and Verizon. He holds the CISSP, GISP, and GCIA certifications, as well as a B.S. in Leadership from the University of West Georgia.
Promethos offers fractional CISO services and security consulting to upper SMB and lower mid-market companies, carrying no product commissions and no vendor relationships. The only thing being sold is the advice itself.
Take the free Strategic Security Pulse Check now, or visit the Contact page for more options.