Your cyber insurance policy has conditions. Most SMEs have not read them.
A cyber insurance policy is not a blanket safety net. It is a contract with conditions attached, and those conditions typically require specific controls to be in place and evidenced before an incident occurs, not after. Multi-factor authentication on key systems. Patch management within a defined timeframe. Backups that are not just taken, but tested.
For many SMEs, the gap between what they assumed the policy covered and what it actually requires is only discovered at the worst possible moment: when a claim is being assessed.
Cyber insurance is growing fast, and so are claims
More UK businesses are buying cyber cover than ever. Among small businesses, take-up rose from 49% in 2024 to 62% in 2025, according to the government’s Cyber Security Breaches Survey. Across the wider market, the ABI reports that 17% more policies were taken out in 2024 than the year before.
Claims are rising sharply too. The ABI found that £197 million was paid out to help UK businesses recover from cyber incidents in 2024, a 230% increase on 2023. Malware and ransomware made up 51% of claims, up from 32% the year before. And those figures predate the major attacks on household-name retailers and manufacturers in 2025.
None of this is bad news for insurance. Most legitimate claims are paid, and a good policy brings more than money: access to incident response specialists, legal support and forensic experts at the moment you need them most. But as payouts climb, insurers are understandably scrutinising claims more closely, and asking harder questions at underwriting and renewal. That is where SMEs get caught out.
Why claims get declined
Declined claims are rarely about whether the incident was genuine. Nobody disputes that the ransomware happened or the invoice fraud was real. The question is whether the controls the policy required were actually in place, and whether you can prove it.
Most problems fall into a handful of categories.
1. The application form said one thing, reality said another
When you buy or renew cyber cover, you complete a proposal form or questionnaire about your security. Do you enforce MFA? Do you patch critical vulnerabilities promptly? Are your backups stored offline and tested? These answers form the basis on which the insurer agrees to cover you and sets your premium.
The trouble is that these forms are often filled in quickly, by someone in finance or operations, ticking “yes” in good faith based on what they believe to be true. If the insurer later finds the answer was inaccurate, it may treat that as misrepresentation.
A widely discussed 2025 case in Canada illustrates the point. Commentary on the case highlighted that the attack began through an exploited internet-facing server where MFA was missing, and affected 80% of the network. Analysts suggested the claim may have been declined either because the policy had a minimum security standards condition, or because the organisation had stated it enforced MFA for all remote access when it did not.
In the UK, the Insurance Act 2015 places a “duty of fair presentation” on businesses buying insurance. In plain terms, you must disclose what you know, or ought to know, about your risk. An insurer’s remedy depends on what it would have done had it known the truth, which can range from adjusting the premium to declining the claim entirely. “We thought MFA was on everywhere” is not a strong position.
2. MFA was on, but not everywhere
This is the single most common gap I see. MFA is switched on for Microsoft 365, but not for the VPN. Or it is on for staff accounts, but not for the admin accounts that matter most. Or it is enforced for everyone except the two directors who found it inconvenient.
Insurers increasingly expect MFA across email, remote access and privileged accounts as a baseline. If an attacker gets in through the one account without it, partial deployment offers little comfort.
It is worth knowing how common this gap is across UK businesses. The government’s latest survey found that only 47% of businesses use any form of multi-factor authentication. Many of those will be partial deployments.
3. Backups that exist but don’t restore
Almost every business believes it has backups. Far fewer have tested whether they can actually restore from them, how long it would take, and whether the backups would survive an attacker who has gained admin access to the network.
Policies often require backups to be taken regularly, stored separately from the main network, and tested. If your backups fail during an incident, or turn out to have been encrypted along with everything else, the insurer may question whether the conditions were met and whether your losses could have been reduced.
4. Patching that slipped
Many policies expect critical security updates to be applied within a defined timeframe. If an attacker exploits a vulnerability that was publicly known and patched by the vendor months earlier, expect questions about why the update was not applied.
In SMEs, patching usually sits with the MSP. That is fine, but it means you need visibility of what is being patched, how quickly, and what has been excluded. “The MSP handles it” is not evidence.
5. Breaking the rules during the incident itself
Some claims run into trouble not because of what happened before the incident, but during it. Common examples:
- Calling in your own IT company or a forensic firm before contacting the insurer’s incident response line, when the policy requires you to use their panel.
- Paying a ransom, or negotiating with attackers, without the insurer’s consent.
- Delaying notification to the insurer beyond the timeframe set in the policy.
- Wiping and rebuilding systems before evidence has been preserved.
All of these are understandable reactions in a crisis. That is exactly why they need to be worked out in advance and written into an incident response plan. The government’s survey found only a quarter of UK businesses have a formal incident response plan. Without one, the first time anyone reads the claims procedure is often during the incident.
6. The cover was never there in the first place
Finally, some businesses discover that the loss they suffered simply was not covered. Common examples include business interruption cover that is too low or subject to a long waiting period, social engineering or invoice fraud being excluded or heavily sub-limited, and losses at a key supplier not being covered at all.
Cyber policies are rarely one single pot of cover. They are usually split into sections, such as incident response, data restoration, business interruption, extortion, fraud and third-party liability, each with its own limits, excesses and conditions. A claim can be paid under one section and declined under another.
The real gap is evidence
The common thread in all of this is evidence. A business that has MFA switched on for some systems but not others, or has never tested whether its backups genuinely restore, can find itself with a policy that looks comprehensive on paper and offers far less protection in practice than the premium suggested.
When a claim is assessed, the insurer or its appointed experts will want to see records. Screenshots or reports showing MFA enforcement. Patch reports. Backup logs and restore test results. Training records. Your incident response plan. If those records do not exist, it can be difficult to show the controls were in place, even if they mostly were.
This is also a governance issue. The government’s survey shows only 31% of UK businesses have someone at board or senior management level with explicit responsibility for cyber security. When nobody owns the question, nobody checks that what the proposal form says matches what is actually happening.
Treat the policy as a checklist, not a formality
This is not a reason to distrust cyber insurance. For most SMEs, it is a sensible part of managing risk. It is a reason to treat the policy as a checklist rather than a formality.
In practice, that means:
- Read the conditions and exclusions properly, not just the schedule and the headline limits. Look specifically for minimum security requirements, conditions precedent and claims procedures.
- Pull out the last proposal form and check every answer against reality. Where an answer was wrong, tell your broker before renewal, not after a claim.
- Map each required control against what is in place, across every system, user and location. Look for the exceptions, because that is where attackers and loss adjusters both look.
- Gather the evidence now: MFA reports, patching reports, backup restore tests, training records. Keep them somewhere you can reach if your systems are down.
- Check your MSP contract covers what the policy requires, and that your MSP knows what you have told the insurer.
- Write the claims process into your incident response plan, including the insurer’s emergency number, kept somewhere accessible offline.
- Make someone accountable at leadership level for keeping this aligned through the year, not just at renewal.
Reading the conditions properly and mapping them against what is actually in place takes a few hours. It closes a gap that most SMEs do not know exists until it is too late to matter.
If nobody in your business has read your cyber policy’s conditions line by line in the last twelve months, that is worth putting right before the next renewal, not after a claim.
Speak to your broker if you have any concerns, they will be able to offer legal advice.