All professional firms
Why your cyber insurance premium jumped, and what brings it down
· PS ProTech · 6 min read
The renewal arrived and the number is higher. Or the number held, but there's a new exclusion, a lower limit on fraud, and a form twice as long as last year's. Your broker says it's the market.
Part of it is. The rest is how your firm looks on paper, and that part is yours to change. Here's how the price is set, what moves it, and what to do in the eight weeks before you sign.
Six reasons the premium went up
1. Your answers. A "no" or a "partly" on multi-factor authentication, on protection for each computer, or on backups pushes the price up. It can also bring lower limits and carve-outs for ransomware or payment fraud. This is the reason you can do most about.
2. Your firm grew. Revenue and headcount are inputs. So is the number of client records you hold.
3. What you hold. Social Security numbers, bank details and health information drive the price, and the count matters. A tax practice or a personal injury firm holds far more of them than its size suggests.
4. Something happened. A claim, or an incident you reported, follows you to renewal.
5. Your profession's claims. Professional firms handle other people's money and confidential files. That makes them a target for wire fraud and ransomware, and insurers price the whole class on it.
6. The insurer changed its mind. Carriers tighten after a bad year and loosen after a good one. You can't control that. You can make your firm one that other carriers want, which is what gives your broker something to shop.
Reasons one to three are in your hands. They're also the ones that decide whether a claim gets paid.
What underwriters price on
Insurers know which missing controls lead to claims, and the application asks about each. These are the ones that move the price:
| Control | What the underwriter wants to see |
|---|---|
| Multi-factor authentication | On email, remote access and administrator accounts, for everyone, with a report to prove it |
| Protection on each computer | Software that watches for ransomware behavior, on every device, with someone monitoring it |
| Backups | Kept separate from your network, and a restore tested recently |
| Email filtering | Links and attachments screened before staff see them |
| Staff training | Regular, with simulated phishing and completion records |
| Updates | Critical ones installed within days, no unsupported systems |
| Payment verification | A written call-back rule for any change to bank details |
| An incident plan | Written, with named contacts |
We go through each question, and what a good answer looks like, in what cyber insurers ask.
The answer that can cost you the whole policy
Tempting as it is, don't round a "mostly" up to a "yes" to get the better price.
In 2022, Travelers went to federal court to cancel a cyber policy it had issued to an Illinois company. The application said multi-factor authentication protected administrator access. After a ransomware attack, the insurer found it was only on the firewall. The company agreed to a judgment rescinding the policy, which left it with no cover for the attack (Lockton's summary of Travelers v. ICS).
The application had been signed by the chief executive. Yours is signed by you.
A cheaper premium bought with an optimistic answer is the worst deal in insurance: you pay every year and collect nothing when it counts. Sign what you can prove, and keep the proof.
Eight weeks before renewal
Weeks one and two: find out where you stand.
- Get this year's application from your broker. Don't work from last year's.
- Mark every question: yes with proof, partly, or no.
- Use our cyber insurance readiness worksheet to keep track.
Weeks three to five: close the gaps that are cheap and count for most.
- Turn on multi-factor authentication for every account, including the partners who objected. See why MFA comes first.
- Put behavior-based protection on every computer and confirm the count matches your headcount. See antivirus vs EDR.
- Test a restore from backup and write down the date.
- Adopt the payment change verification procedure and have the people who handle payments sign it.
Week six: build the evidence folder.
- One document or screenshot for each "yes": the MFA report, the device list, the backup report, the training records, the written plan.
Week seven: give your broker a story to tell.
- Send a one-page summary of what you've improved since last year, with the evidence.
- Ask for it to be shown to more than one carrier.
Week eight: sign. Read the limits and exclusions as carefully as the price, especially the limit on funds transfer fraud. It's often far lower than the headline figure.
What we can't promise
We can't tell you the premium will fall by a set amount, and neither can anyone else. The underwriter decides, and the market moves on its own.
What good controls do reliably is narrower and more useful. They keep you insurable. They keep ransomware and fraud inside the cover rather than carved out. And they mean the application was true on the day you need the policy to pay.
The premium is the small number. The claim is the big one.
Insurance and protection: what each one is for
Insurance pays after the loss. Protection makes the loss less likely and smaller. An owner needs both, and they cost less together than apart.
| What you get | |
|---|---|
| Insurance without the controls | A higher premium, lower limits, and a real chance the claim is disputed |
| Controls without insurance | Fewer incidents, and you pay for the bad one yourself |
| Both | Better terms, a claim that pays, and far fewer days when you need it |
Against that, the figures:
| What it comes to | |
|---|---|
| Our Business plan for ten people | $1,490 a month. It puts the first six controls in the table in place and keeps the reports that prove it. |
| Our Secure plan for ten people | $2,340 a month. It adds the written security plan, compliance reporting, and help completing the application. |
| Average reported loss to email payment fraud | About $123,000, by the FBI's 2025 figures |
| A disputed claim | The whole loss, plus the premiums you paid for cover you didn't have |
Nobody enjoys either bill. But one is a fixed amount each month for a quiet year and an expert on your side at renewal. The other arrives once, on the worst day, with no limit on it.
Where to start
If your renewal is more than two months away, start with the worksheet and the eight-week plan. If it's sooner, do steps four and six this week; they count for most.
Insurance and questionnaire support is part of our compliance support. To find out how your answers would look to an underwriter, book a free review.
This is general information. Your policy and your broker are the authority on what your insurer requires.