Why would an insurer refuse a claim?

Usually because a control you declared - MFA, tested backups, offboarding evidence - was not actually in place on the day of the incident.

Does a high score guarantee a payout?

No. It tells you which of the standard requirements you can already evidence, and which ones would be argued about.

Can we show the result to our broker?

Yes - print it. Brokers respond well to a business that arrives with its gaps already listed.

All resources

Interactive · Scored check

Cyber-Insurance Readiness - Would Your Claim Actually Pay Out?

Insurers now require MFA, tested backups, offboarding evidence - and deny claims when missing. Score your policy against the controls underwriters actually check.

Interactive 3 min

to a scored readiness tier: 3 minto a scored readiness tier
prioritised gap list to fix first: 1prioritised gap list to fix first
answers stored outside your browser: 0answers stored outside your browser

Answer honestly for your business. Nothing is sent anywhere - your score appears once every control is answered.

0/10 answered

Answer every control above to reveal your readiness tier and the gaps most likely to sink a claim.

Access control

Must-haveMulti-factor authentication on email, VPN and admin accounts

Admin rights limited to who genuinely needs them

Backups

Must-haveBackups that are tested by restoring, not just running

At least one backup copy is offline or immutable

Offboarding

A logged process that removes every account when someone leaves

Email security

SPF and DMARC enforcement on your domain

Endpoint protection

Managed endpoint protection (EDR) on every device

Patching

Security updates applied within 30 days

Awareness training

Staff get security-awareness training at least yearly

Incident response

A written incident-response plan with named contacts

TechSuit

Cyber-Insurance Readiness Report

Underwriting control review · Generated: 11/08/2026 · techsuit.io

Draft - 0 of 10 controls answered. Unanswered controls are reported as "no".

Likely to be denied · 0/10 controls fully in place

Control	Status	Why insurers care
Multi-factor authentication on email, VPN and admin accounts (must-have)	No	MFA is the single most common hard requirement. Most insurers will decline a claim outright if it was not enforced.
Backups that are tested by restoring, not just running (must-have)	No	A backup you have never restored is an assumption. Insurers ask for evidence of successful test restores.
At least one backup copy is offline or immutable	No	Ransomware hunts for connected backups first. An offline or immutable copy is what lets you recover without paying.
A logged process that removes every account when someone leaves	No	Ex-employee access is a frequent breach path and a claim question. Underwriters want a repeatable, evidenced process.
SPF and DMARC enforcement on your domain	No	Email authentication blocks spoofed invoices and impersonation, the most common financial-fraud vector for SMBs.
Managed endpoint protection (EDR) on every device	No	Insurers increasingly require EDR, not just consumer antivirus, and ask which product and how it is monitored.
Security updates applied within 30 days	No	Unpatched, known vulnerabilities are a leading cause of claims. A defined patch cadence is a standard question.
Staff get security-awareness training at least yearly	No	Phishing is the top entry point. Insurers reward documented, recurring training and may require it above a size threshold.
A written incident-response plan with named contacts	No	When a claim is filed, insurers check that you had a plan and followed it. Improvised responses raise costs and disputes.
Admin rights limited to who genuinely needs them	No	Over-privileged accounts turn one compromise into a full breach. Least-privilege is a growing underwriting question.

Generated with TechSuit's Cyber-Insurance Readiness check (techsuit.io). General guidance, not legal or insurance advice.

We can close these gaps for you

We put the controls insurers ask for in place - MFA, tested backups, EDR, offboarding evidence - and give you the documentation to hand your broker at renewal.

Book a 20-min readiness review See our security service

Common questions

Where this fits

Backup & Disaster RecoveryTested restores are the control claims fail on most.Passwords & Access ControlMFA and offboarding evidence, documented rather than assumed.

Related resources

Security

Same topic

Instant Exposure Scan - Your Domain in 30 Seconds

Enter your domain and get 2-3 specific findings on spoofing protection and known breaches.

Interactive 30 sec

View

Security

Same topic

What Would a Breach Actually Cost You?

Enter headcount and downtime, and see the real cost broken down in your own currency.

Interactive 1 min

View

Security

Same topic

How Long Would Your Password Survive?

Type a password and watch how fast a modern rig would get through it - nothing is sent anywhere.

Interactive 30 sec

View

Cyber-Insurance Readiness - Would Your Claim Actually Pay Out?

What you'll walk away with

We can close these gaps for you

Common questions

Why would an insurer refuse a claim?

Does a high score guarantee a payout?

Can we show the result to our broker?

Where this fits

Related resources

Instant Exposure Scan - Your Domain in 30 Seconds

What Would a Breach Actually Cost You?

How Long Would Your Password Survive?