Why would an insurer refuse a claim?

Usually because a control you declared - MFA, tested backups, offboarding evidence - was not actually in place on the day of the incident.

Does a high score guarantee a payout?

No. It tells you which of the standard requirements you can already evidence, and which ones would be argued about.

Can we show the result to our broker?

Yes - print it. Brokers respond well to a business that arrives with its gaps already listed.

All resources

Interactive · Scored check

Cyber-Insurance Readiness - Would Your Claim Actually Pay Out?

Insurers now require MFA, tested backups, offboarding evidence - and deny claims when missing. Score your policy against the controls underwriters actually check.

Interactive 3 min

Who it's for: Businesses holding a cyber policy - or about to buy one.
Format: Interactive
Time needed: 3 min
Topic: Security · IL · EU
What you end up with: A printable readiness score you can review with your broker.

What's inside

The controls underwriters actually verify at claim time
Honest three-way scoring per control
Your readiness tier and the gaps most likely to sink a claim

What you'll walk away with

to a scored readiness tier: 3 minto a scored readiness tier
prioritised gap list to fix first: 1prioritised gap list to fix first
answers stored outside your browser: 0answers stored outside your browser

Guided run

Answer honestly for your business. Nothing is sent anywhere - your score appears once every control is answered.

0/10 answered

Answer every control above to reveal your readiness tier and the gaps most likely to sink a claim.

Access control

Must-haveMulti-factor authentication on email, VPN and admin accounts

Admin rights limited to who genuinely needs them

Backups

Must-haveBackups that are tested by restoring, not just running

At least one backup copy is offline or immutable

Offboarding

A logged process that removes every account when someone leaves

Email security

SPF and DMARC enforcement on your domain

Endpoint protection

Managed endpoint protection (EDR) on every device

Patching

Security updates applied within 30 days

Awareness training

Staff get security-awareness training at least yearly

Incident response

A written incident-response plan with named contacts

TechSuit

Cyber-Insurance Readiness Report

Underwriting control review · Generated: 27/08/2026 · techsuit.io

Draft - 0 of 10 controls answered. Unanswered controls are reported as "no".

Likely to be denied · 0/10 controls fully in place

Control	Status	Why insurers care
Multi-factor authentication on email, VPN and admin accounts (must-have)	No	MFA is the single most common hard requirement. Most insurers will decline a claim outright if it was not enforced.
Backups that are tested by restoring, not just running (must-have)	No	A backup you have never restored is an assumption. Insurers ask for evidence of successful test restores.
At least one backup copy is offline or immutable	No	Ransomware hunts for connected backups first. An offline or immutable copy is what lets you recover without paying.
A logged process that removes every account when someone leaves	No	Ex-employee access is a frequent breach path and a claim question. Underwriters want a repeatable, evidenced process.
SPF and DMARC enforcement on your domain	No	Email authentication blocks spoofed invoices and impersonation, the most common financial-fraud vector for SMBs.
Managed endpoint protection (EDR) on every device	No	Insurers increasingly require EDR, not just consumer antivirus, and ask which product and how it is monitored.
Security updates applied within 30 days	No	Unpatched, known vulnerabilities are a leading cause of claims. A defined patch cadence is a standard question.
Staff get security-awareness training at least yearly	No	Phishing is the top entry point. Insurers reward documented, recurring training and may require it above a size threshold.
A written incident-response plan with named contacts	No	When a claim is filed, insurers check that you had a plan and followed it. Improvised responses raise costs and disputes.
Admin rights limited to who genuinely needs them	No	Over-privileged accounts turn one compromise into a full breach. Least-privilege is a growing underwriting question.

Generated with TechSuit's Cyber-Insurance Readiness check (techsuit.io). General guidance, not legal or insurance advice.

We can close these gaps for you

We put the controls insurers ask for in place - MFA, tested backups, EDR, offboarding evidence - and give you the documentation to hand your broker at renewal.

Book a 20-min readiness review See our security service