Cyber insurance requirements
Cyber insurance and cyber security are usually bought from different people, at different times, using different vocabulary.
That is how businesses end up holding a policy which does not quite cover the way they would actually be attacked, or having spent money on controls their insurer gives them no credit for.
Meanwhile, cyber insurance requirements have shifted considerably in the last few years, and a lot of businesses are answering proposal forms to a standard that no longer applies.
Fourarmed exists in the space between the two, because that is where we came from.
We came out of Castlemead, an insurance broker. Fourarmed was founded because of a pattern Castlemead kept seeing from the brokering side. Clients who had bought cyber cover in good faith, believed they were adequately protected, then had a much worse experience than they should have when something went wrong.
Sometimes that was due to cover that did not fit the business. More often it was security that looked fine on a proposal form and turned out to be thinner in practice, with the discovery of that gap happening at the worst possible moment, during a claim.
Security firms do not read policy wordings. Brokers are not in a position to audit a client's network.
In response, we built a security business that speaks insurance and kept it close to a broker that speaks security. Our approach explains what that changes in practice.
Cyber underwriting has tightened considerably, and the claims figures explain why. The Association of British Insurers reported £197m paid out on UK cyber claims in 2024, a 230% increase on the previous year, with ransomware and malware making up 51% of claims. Underwriters have responded by asking harder questions and asking for evidence to back up the answers.
A Cyber Essentials certificate helps and it is a sensible thing to hold, but it is not the same as satisfying an underwriter. The scheme covers five technical controls at a point in time. Insurers are pricing your ability to keep trading, which is a broader question.
A cyber policy is a contract, and what you tell the insurer when you buy it forms part of that contract. Under the Insurance Act 2015, commercial buyers have a duty of fair presentation: a duty to disclose what a prudent underwriter would want to know. Policies also carry conditions and, sometimes, warranties, which are specific requirements about controls you must have in place.
This is usually not deliberate. Somebody in the business answered "yes, we have MFA" because it was enabled for the leadership team, and it turned out not to be on for the account that was compromised. The insurer's position is that they priced a different risk from the one they actually carried.
If the wording requires MFA on remote access, or backups held offline, and the loss happens through the gap, the insurer has grounds to decline or reduce.
Even where your controls were genuinely in place, a claim needs proof, such as patch records, access logs, training records, and backup test results. Organisations that have never had to produce these find it hard to do so under time pressure, especially in the middle of an incident.
None of that is insurers behaving badly. It is the ordinary consequence of a contract priced on a description of your business. The fix is to make sure the description is accurate before you sign it, and that you can back it up afterwards.
We start with a cyber security audit, before you answer the proposal form. That way your answers are grounded in evidence and not in the best understanding of whoever filled the form in. It is considerably cheaper than finding out during a claim.
We flag the items most likely to affect your premium or your terms separately from the rest, so you can deal with a short list ahead of renewal instead of the whole plan.
The audit produces a defensible number for what downtime would cost you, which tells you how much cover you actually need. Plenty of businesses turn out to be over-insured on one limb of a policy and under-insured on another.
Audit reports, monitoring reports, phishing simulation results and training records are provided. Twelve months of documentation makes both renewal and any future claim substantially easier.
Certification helps too. Cyber Essentials or Cyber Essentials Plus gives underwriters a recognised reference point. Basic certification also includes £25,000 of cyber liability cover for eligible organisations in the UK or Crown Dependencies turning over under £20m. It is a floor, not a policy, though it is worth having.
A cyber security audit establishes what is true, including the business interruption figure.
We flag these separately in the report, so this is a short list rather than the whole plan.
This should include patch records, access reviews, backup restore tests, training and simulation results, as well as the incident response plan with names and numbers in it.
Walk into the conversation with documentation and a defensible view of the cover you need.
Monitoring reports and training records accumulate the evidence for next time without anyone having to reconstruct it.
Fourarmed handles security, while Castlemead handles insurance. Between us you can get your risk assessed, improved, evidenced and then covered, without having to act as the translator between two industries that do not naturally share a vocabulary.
You are under no obligation to use both. Plenty of our clients have brokers they are happy with, and we will work with any broker. We would rather your cover was right than that it came from a particular place, but if you would like the security work and the insurance to join up, that is what the arrangement is for.
That is typically long enough to fix what needs fixing, and to arrive with something to show for it.
