Some firm owners are making a quiet bet right now. They are choosing not to tighten up security because they assume cyber insurance will write the check if something happens.
I understand why that feels reasonable. You pay the premiums, you answer the renewal questions, you sign the paperwork, and it is easy to believe the policy is your safety net.
From a security standpoint, this is where firms get surprised.
Cyber insurance is not a permission slip to stay exposed. It is a contract with conditions. If the conditions are not met, or if the insurer believes basic safeguards were not in place or were not consistently used, claims can be delayed, reduced, or denied.
Even when a claim is paid, the damage still shows up in other places. Downtime, disrupted cases, missed deadlines, client trust, staff stress, and the time it takes to unwind the mess.
Insurance is important. It is just not the plan.
This post will help you understand how cyber insurance works in real life, what insurers tend to care about most, and what “reasonable efforts” looks like for a professional services firm that wants peace of mind.
What Cyber Insurance Is Actually For
Cyber insurance is designed to help with the financial side of recovery after a covered incident. Depending on your policy, that can include:
Incident response and forensic investigation
Legal guidance and notification costs
Credit monitoring for impacted individuals
Ransom negotiation support (sometimes)
System restoration and business interruption coverage (sometimes)
Third-party claims (sometimes)
Every policy is different. The details matter.
Here is the key: cyber insurance is the backstop, not the steering wheel. Your firm still has to run the response, keep the business moving, communicate with clients, and show you took reasonable steps to protect data.
Why Claims Get Complicated
Insurers do not deny claims “just because.” They are managing risk based on the profile presented during underwriting.
Here are three reasons firms get stuck during a claim:
1) The application says “yes,” but reality says “sometimes”Most insurance applications ask about specific controls such as MFA, backups, endpoint protection, and response planning. Firms sometimes answer based on intention or partial rollout. After an incident, the insurer looks for proof.
If MFA was only on some accounts, or bypassed for convenience, that is no longer a “yes.”
2) Controls exist, but they are not enforcedA tool sitting in place is not the same as a control being used consistently. Insurers care about enforcement, consistency, and evidence.
3) The incident ties directly to a basic missing safeguardIf the breach happened because a basic protection was not in place, the insurer may view it as avoidable exposure. That is when claims can become stressful.
The Hidden Cost Even When Insurance Pays
Even when a claim is approved, firms still pay in real-world costs:
Downtime: billable work stops and productivity drops
Operational chaos: decisions under pressure with incomplete information
Client trust: confidence can shift quietly, even if clients stay
Staff stress: your team is disrupted and leadership is pulled into crisis mode
Reputation: word travels, even when details are limited
Long recovery tail: cleanup and follow-up takes weeks or months
From a business standpoint, that is a hard way to run a firm.
The Better Approach: Insurance as Backstop, Security as Strategy
The more realistic approach is to keep insurance in place, and run your security like you actually want to avoid the incident.
That means focusing on the fundamentals.
Not perfection. Not a pile of tools.
Just being defensible.
The “Table Stakes” Insurers and Claims Teams Care About Most
Every policy is different, but these controls show up over and over when a claim is on the line.
1) MFA on email and remote access, enforced for everyoneEmail is still the front door for most firms.
Attackers target email because it gives them access to conversations, invoices, password resets, and identities they can impersonate. MFA is one of the highest-impact protections you can enable, but only when it is enforced for every account.
Best practice examples:
Enforce MFA for every user, including partners and admins
Require stronger MFA methods where possible
Block legacy authentication
Require MFA for remote access and any admin portals
Shared accounts create blind spots. They make it harder to prove who did what, and harder to revoke access when someone leaves.
Offboarding is where firms get hit the hardest because it is easy to miss one system, one mailbox permission, one shared folder, or one MFA device.
Best practice examples:
Unique user accounts for each person
Role-based access and least privilege
Quarterly access reviews
A consistent offboarding checklist across all systems
Many firms have backups. Fewer firms have proven restores.
A backup is only valuable if you can restore quickly and completely. Insurers and incident responders will ask when you last tested a restore, how far back backups go, and how long recovery will take.
Best practice examples:
Offsite or immutable backups
Regular restore testing, not just “backup success” emails
Separate backups for Microsoft 365 data
Recovery targets documented (how fast you need systems back)
Basic antivirus is not enough for modern threats. EDR is better, but monitoring is what matters. If nobody sees the alerts, the tool does not help you when it counts.
Best practice examples:
EDR with active monitoring and response
Consistent patching and device standards
Disk encryption and device controls
A plan for lost or stolen devices
When something goes wrong, one of the first questions is, “How long has this been happening?”
If you do not have logs, you cannot answer. If you do not have alerts, you miss early warning signs such as impossible travel logins, unusual downloads, mailbox rule changes, or suspicious OAuth activity.
Best practice examples:
Centralized logging for sign-ins
Alerts for risky events
Routine review of forwarding rules and mailbox rules
Restrict third-party app access
This does not have to be complicated. It just needs to exist.
When an incident hits, you do not want to be deciding in the moment who calls the bank, who calls the insurer, who communicates with clients, and what gets shut down first.
Best practice examples:
A one-page plan with roles and contacts
Insurer hotline and policy details accessible
Bank contact and wire fraud steps documented
A short “first hour” checklist
The Defensible Test: Could You Prove “Reasonable Efforts”?
Here is the simplest question to ask:
If you had to prove you took reasonable efforts to protect client data, could you show it clearly?
Not could you explain it. Could you show it.
That means having proof such as:
MFA enforcement and access controls
Backup test logs
Patch compliance reports
Offboarding checklists
Training completion records
Incident response plan and contact list
Documentation is not busywork. It is peace of mind.
What to Do Next: A Practical Path Forward
If you want to reduce risk without turning cybersecurity into a full-time job, do this:
Step 1: Validate the controls you claim to haveBefore your next renewal, confirm what is actually enforced.
Step 2: Lock down the basicsFocus on MFA, access control, backups, endpoint monitoring, logging, and response planning.
Step 3: Document your postureKeep proof in one place so you can show it if you ever need to.
Step 4: Run a simple tabletop exercise once a yearWalk through what you would do if you got a suspicious login alert today. You will find gaps quickly, without the stress of a real incident.
A Simple Checklist You Can Use This Week
If you want momentum, check these five items:
Is MFA enforced for every user on email and remote access?
Are there any shared accounts, shared passwords, or lingering ex-employee access?
When was the last successful restore test, and how long did it take?
Is your endpoint protection actively monitored and responded to?
Do you have a one-page incident response plan with insurer and bank contacts?
If any of those answers are unclear, that is good information. Clarity gives you control.
Final Thought
Cyber insurance is a smart backstop. It is not a strategy.
A firm that relies on insurance instead of protection is making a bet that the incident will be simple, the claim will be smooth, and the business will keep running.
That is rarely how it goes.
If you want peace of mind, focus on being defensible. Put the basics in place, enforce them consistently, and keep proof of what you are doing.
If you want, send us a message and we will share a short checklist of the controls that tend to matter most when a claim is on the line, written in plain language and easy to hand to your team.
