Your Cyber Insurance Questionnaire Is a Free Security Audit — Use It Like One

Ask a small business owner what their security roadmap looks like and you will often get a shrug. Ask their insurance broker and you will get a nine-page questionnaire. In 2026, that questionnaire is the closest thing most SMBs have to an independent audit — and it is free.

The Market Has Loosened. The Bar Has Not.

The conventional story about cyber insurance is a hard market that never ends, and it is now wrong. Rates are down roughly 5% year to date in 2026, the fourth consecutive annual decline after a 13% fall in 2025, with global premiums around 16.4 billion dollars. Competition has returned, terms have widened, and for a straightforward small business the cover itself is easier to buy than at any point since 2021. What has not moved is the underwriting bar. Penetration among small and mid-sized businesses still sits at only 10–20% according to Swiss Re, which tells you the obstacle was never only price: it is the work of proving you qualify.

The 2026 baseline across most markets looks remarkably consistent: phishing-resistant multi-factor authentication on every privileged account and remote access path, endpoint detection and response (or a managed equivalent) across the entire fleet, tested immutable backups, a real patch management process, and a documented, rehearsed incident response plan. Vendor and broker estimates put the share of small businesses failing that bar on the first pass at roughly three in four. Treat the figure with skepticism — it comes from companies selling remediation — but the direction is not in dispute, and ESET's 2026 readiness research found 86% of US SMBs carrying insurance. The policy is not a payment; it is an obligation with a premium attached.

Why It Works as a Roadmap

The reason the questionnaire is useful is not that insurers are generous. It is that underwriters are the only people in your business's orbit who actually pay out when controls fail, so their requirements are ranked by loss experience rather than by marketing. That makes the list a decent, if blunt, priority order: identity first, because stolen credentials open the door in the overwhelming majority of claims; endpoints second, because that is where the credential gets stolen; recovery third, because that is what determines whether a bad day becomes an existential one.

The Evidence Problem

Where SMBs get into trouble is not the controls themselves but the attestation. Answering yes aspirationally is a solvency strategy with a short shelf life: a misrepresented control can void coverage precisely when you need it. Underwriting has become evidence-based, and the artifacts requested are specific — MFA enrolment coverage reports rather than a policy screenshot, the EDR console showing full fleet coverage including the laptops nobody remembers, and restore-test logs with dates and results. Expect questions about AI governance as well: which tools staff use, whether customer data is entered into them, and who approved that. Restore testing is the one almost everyone skips, and it is the one that reveals whether your immutable backup is genuinely recoverable or merely present.

The other shift is that the questionnaire is now a renewal instrument, not a first-purchase hurdle. Carriers re-ask every year, compare answers across cycles, and increasingly check them against breach data they already hold. A control that was true in 2024 and quietly lapsed will surface at the worst possible moment, which is why the answers are worth keeping as a maintained register rather than a document that gets rebuilt from memory each spring.

A Realistic Sequence for a Small Team

• Identity: Enforce phishing-resistant MFA on email, VPN, remote desktop, and cloud admin consoles before anything else. Legacy protocols and service accounts are where quiet exemptions live.
• Endpoint: Full-fleet EDR or MDR coverage, including the server under the desk and the contractor's laptop.
• Recovery: Immutable or offline backups, plus a quarterly restore test you can put in a folder and hand to an underwriter.
• Response: A one-page plan with names, deputies, and an out-of-band contact path — then prove it with an exercise rather than a binder.
• Governance: A short AI and data-handling policy, because the next questionnaire will ask and a blank answer reads as uncontrolled.

Insurance was never meant to be the control. But as a forcing function that ranks effort by actual loss data, the questionnaire beats most security advice a small business is likely to receive — provided you answer it honestly and treat the gaps as a work queue rather than a form to be submitted.