Prices are softening. The questions are not.
If your cyber insurance renewal is due in the next few months, there is a good chance the headline news will be welcome. Premiums have been easing. According to Marsh, global cyber insurance rates fell by 4% in the second quarter of 2026, the twelfth consecutive quarter of decreases. Across the wider UK commercial market, Marsh reports average rates down 8%.
That makes it tempting to treat this year’s renewal as routine: sign the form, pay the slightly lower premium, move on.
That would be a mistake. While prices have softened, underwriting has not gone back to the box-ticking of a few years ago. Marsh notes that as conditions stabilise after prolonged rate reductions, underwriting is becoming more selective. In a competitive market, insurers are choosing which risks they want, and the questionnaire is how they decide.
The questions have changed
Older cyber proposal forms asked broad questions. Do you have antivirus? Do you back up your data? Do you use multi-factor authentication? A confident “yes” was usually enough.
Current forms probe specifics, and increasingly expect you to be able to prove your answers. The shift looks something like this:
| What older forms asked | What current forms ask |
|---|---|
| Do you use MFA? | Is MFA enforced for all users, on email, remote access and every privileged or admin account? Are there exceptions? |
| Do you patch your systems? | How quickly are critical vulnerabilities patched? Can you evidence it? What happens to systems that cannot be patched? |
| Do you take backups? | Are backups stored offline or immutable? Are they separated from your main network credentials? When were they last restored in a test, and how long did it take? |
| Do you train staff? | How often? Do you run phishing simulations? What do you do with the results? |
| (Not asked) | What AI tools are in use, what data goes into them, and what governance sits around them? |
None of these questions are unreasonable. They reflect what insurers have learned from paying claims. But each one turns a general statement of good intent into a specific, checkable claim about how your business actually operates.
The new section: AI
The most noticeable addition in many 2026 questionnaires is a section on artificial intelligence. Underwriters want to know what AI tools the business uses, what data is being sent to third-party AI providers, and what controls and oversight are in place.
This matters because adoption is running well ahead of governance. The government’s latest Cyber Security Breaches Survey found that nearly a third of UK businesses are using, adopting or considering AI, but only 24% of those have cyber security measures in place to manage the associated risks.
For many SMEs, the honest answer to “what AI tools are in use?” is “we’re not entirely sure”. Staff use ChatGPT, Copilot or other tools, sometimes through company accounts and sometimes through personal ones, often without anyone having decided what data is acceptable to put into them.
The insurance market is still working out how to handle this. Commentators describe a move away from “silent AI”, where AI risks were implicitly covered by existing policies without being mentioned, towards AI-specific exclusions and revised wording. For now, cyber policies remain the most stable source of cover, with many insurers treating AI as an extension of traditional cyber risks such as unauthorised access, data breaches and social engineering. Some insurers have gone further and written affirmative cover in; Coalition, for example, introduced an AI endorsement covering events such as fraudulent instructions sent via deepfakes, and later built it into its base policy.
The practical point for an SME is simple. If the form asks about AI and you cannot describe what you use and how it is controlled, that is likely to count against you, and you should check carefully whether your policy wording now limits cover for AI-related losses.
Who actually fills in the form
The people signing off these renewals are usually FDs or MDs, not IT specialists. They are often working through a long questionnaire close to a deadline, relying on a quick conversation with the MSP or whoever “looks after IT”.
That creates two problems. First, the questions are technical, and the difference between “MFA is on” and “MFA is enforced for every user and admin account with no exceptions” is not obvious unless you know why it matters. Second, the answers carry legal weight. Under the Insurance Act 2015, businesses have a duty of fair presentation: to disclose what they know, or ought to know, about their risk. An answer given in good faith but turning out to be wrong can still affect a claim.
The gap between what the new questions actually mean and what the business can genuinely evidence is often far wider than anyone realised until the form is in front of them.
The backup that existed and the test that did not
One pattern comes up repeatedly. A business has had backups running reliably for years. The MSP set them up, the reports arrive, nobody has ever had a reason to worry. Then the renewal form asks: when did you last test a full restore, and can you evidence it?
Nobody can remember a test. There is no record of one. The backup existed. The test did not.
That single gap, invisible in day-to-day operations, can be the difference between a smooth renewal and a difficult one. At renewal, it may mean a higher premium, a narrower policy or additional conditions. After an incident, it is worse: if backups turn out to be unusable, or the business told the insurer they were tested when they were not, the claim itself may be at risk.
The same pattern repeats elsewhere. MFA that is on for most users but not the finance director who found it inconvenient. Patching that happens, but with no reporting to prove how quickly. A training programme that ran once, two years ago. In each case, the control mostly exists. The evidence does not.
Why a soft market makes this more important, not less
It is easy to assume that falling prices mean insurers are relaxed. In reality, competition means insurers are differentiating, not just on price but on which businesses they want to cover and on what terms. Marsh notes insurers are competing through broader cover and lower deductibles as well as price.
Those better terms go to businesses that can demonstrate good controls. A business that can evidence MFA coverage, patching times, tested backups and AI governance is in a strong position to negotiate. A business that answers vaguely, or cannot back up its answers, may still get cover, but on worse terms than it could have had, and with more risk of a dispute if it ever needs to claim.
Treat the questionnaire as a review, not a formality
Treating the annual questionnaire as a formality is no longer a safe assumption. The better approach is to treat it as a free, annual health check on your security, written by the people who pay out when things go wrong.
In practice, that means:
- Get last year’s form and this year’s form side by side as early as possible. Note the new questions.
- Translate the technical questions into plain terms, so the person signing understands what they are confirming.
- Test each answer against reality, including the exceptions. “Yes, except for…” needs to be written down, not glossed over.
- Gather evidence before you answer: MFA reports, patching reports, backup restore test results, training records.
- Take stock of AI use across the business, including tools staff use on their own initiative, and agree basic rules on what data can go into them.
- Fix quick wins before renewal, such as running and documenting a backup restore test, or closing MFA gaps.
- Talk to your broker about any answers you are unsure of, and check the policy wording for AI-related exclusions or limits.
This is worth doing with someone independent of the people who run your IT, ideally a few weeks before the renewal lands, not while filling in the form under a deadline. An honest internal review costs a few hours. The alternative is finding out what your answers really meant when you need to make a claim.