Cyber Insurance in 2026: Having a Policy Is Only Part of the Plan

Cyber insurance has become fairly common for small and mid-sized businesses and nonprofits. For some organizations, a customer or contract requires it. Others purchase it because their insurance agent, board, lender, or another advisor recommends it.

Whatever the reason, the process can become routine. Complete the application, answer questions about cybersecurity, review the quote, pay the premium, and move on.

In previous articles, we've discussed why cyber insurance does not replace good cybersecurity and why businesses need to be careful about the information provided during the application process. Both are still important. But heading into the next renewal, leadership should also consider how the business has changed and whether its coverage and cybersecurity practices have kept up.

Email and payment fraud remain significant concerns. Criminals are getting better at impersonating executives, employees, and trusted vendors, while AI can make those attempts harder to recognize. When an incident interrupts operations, the financial impact can extend well beyond repairing computers or restoring files.

Having a policy is a useful starting point. Understanding how it fits the organization takes a little more work.

Understand What You Purchased

Cyber insurance can help pay certain costs associated with a covered incident. Depending on the policy, that might include investigation, recovery, legal assistance, notification, liability, or business interruption.

That does not mean every cyber-related loss is covered. A fraudulent payment, for example, may be handled differently from a ransomware incident, and its coverage limit may be substantially lower than the policy's overall limit.

Terminology, definitions, coverage, exclusions, limits, sublimits, deductibles or retentions, and underwriting requirements vary by carrier and policy. A retention generally refers to an amount the organization must absorb before insurance responds, although the specific terms matter.

Your insurance professional should explain how those provisions apply to your organization, including the conditions for reporting an incident and obtaining approval for expenses. Leadership needs that understanding before a claim puts it to the test.

Email Fraud Deserves Leadership's Attention

Coalition's 2026 Cyber Claims Report found that business email compromise and funds transfer fraud accounted for 58 percent of the claims it observed in 2025. It also reported that 71 percent of funds transfer fraud claims resulted directly from social engineering.

Business email compromise involves criminals using email accounts or impersonation to deceive people. Funds transfer fraud involves money being sent or redirected through fraudulent instructions. Those descriptions explain the business problem; an insurer's definitions may differ.

For a smaller organization, this could be a vendor requesting new banking instructions, an executive supposedly asking for an urgent wire, or an employee requesting a payroll change. A message from a genuinely compromised account can be especially convincing because it arrives within a familiar relationship.

AI adds another concern because criminals can use it to produce more believable messages or imitate someone's voice. Staff who have learned to look for poor grammar and awkward wording need a stronger basis for deciding whether a request is legitimate.

Leadership should work with finance and operations to establish verification procedures for payment changes and unusual transactions. That includes using a previously verified phone number, requiring another person's approval where appropriate, and giving employees permission to slow down an urgent request. Then ask the insurance professional how the policy would respond if someone followed fraudulent instructions.

Downtime Can Become the Larger Expense

Stolen information gets attention, but losing access to everyday systems can create an immediate business problem.

Consider what happens when staff cannot use accounting, scheduling, customer records, shared files, or the applications needed to deliver services. Employees may still be on payroll while revenue stops or programs are delayed. Recovery can also require outside assistance, temporary arrangements, and considerable management time.

The 2026 NetDiligence Cyber Claims Study found that small and medium enterprise claims involving business interruption averaged about $1.9 million in total incident cost, more than five times the average for claims without it.

That figure is not a prediction of your organization's loss. It reflects the claims in the study, with different businesses and incident circumstances. It does illustrate how disrupted operations can increase the overall cost.

Leadership should identify the systems the organization depends on and establish realistic recovery expectations. With that information, the insurance discussion becomes more useful: what interruption coverage applies, whether there is a waiting period, how lost income is calculated, and whether an outage at an outside provider is addressed.

Verify the Application Answers

Cyber insurance applications often ask about multi-factor authentication, backups, employee training, security monitoring, and incident response. Nontechnical leaders understandably rely on employees or technology providers to answer those questions.

The concern is whether those answers have been checked.

Someone may say multi-factor authentication, or MFA, is enabled because employees use an additional verification step for email. The application may ask about a broader set of accounts and systems, including administrators and remote access. Exceptions can matter.

Backups deserve the same scrutiny. Having copies of files does not establish that the organization can restore the systems it needs within an acceptable time. Recovery testing provides a much better basis for that answer.

Before submitting the application, ask whoever supplied the responses how they verified them and what evidence supports them. If the wording is unclear, have the insurance professional clarify it before leadership signs.

This is also worth revisiting during the policy period. A system change or a discontinued security service can leave the organization operating differently from what it represented at renewal.

Use Renewal to Review the Business

Marsh's Q2 2026 U.S. market data reported a 2 percent decline in cyber insurance rates. That is helpful market context, although an individual organization's pricing and terms will depend on its circumstances.

An attractive premium still leaves plenty to review. Since the last renewal, the organization may have added locations, changed payment processes, adopted cloud applications, collected different information, or become more dependent on outside providers.

Bring those changes into the renewal discussion. Finance can explain payment exposure, operations can describe the consequences of downtime, and the technology provider can verify controls and recovery capabilities. The insurance professional can then help leadership assess whether coverage still fits.

Include incident reporting in that conversation. Staff should know whom to contact, and leadership should understand any requirements concerning notice, approved providers, or consent before incurring expenses. Sorting that out during an incident creates avoidable pressure.

Bringing the Conversations Together

In my experience, the insurance, technology, finance, and leadership discussions often happen separately. Each person may understand their responsibilities, yet assumptions can go unchallenged between them.

Perspectives Cyber and Technology Advisors helps SMB and nonprofit leaders connect those discussions with the organization's actual cybersecurity practices. That may involve verifying application responses, reviewing evidence of important controls, or helping leadership understand the business consequences of a recovery gap.

PCTA does not sell insurance or cybersecurity products. Our advisory role is to help leadership make informed decisions and have more productive conversations with its insurance and technology providers.

As renewal approaches, give those conversations enough time. The value comes from understanding what has changed, verifying what is in place, and addressing the gaps while there is still room to act.

Disclaimer: This article provides general information and education. PCTA does not provide legal or insurance advice. Policy terms and requirements vary by carrier and policy. Review your specific coverage, application responses, and obligations with your insurance agent, broker, carrier, and legal counsel as appropriate.