Cyber Insurance Is Changing — Are You Still Covered?

Cyber insurance used to be a safety net — a relatively low-cost way to transfer risk and sleep better at night. But those days are fading fast.

As cyberattacks become more frequent, complex, and costly, insurers are raising the bar for coverage. Requirements that were once “nice to have” are now non-negotiable. And for many small to mid-sized manufacturers, failing to meet these new standards can mean higher premiums, limited coverage, or outright denial of claims.

If it’s been more than a year since your organization reviewed its cyber insurance policy, now is the time to revisit it. Your financial protection may no longer be what you think it is.

‍

Why Insurers Are Shifting the Goalposts

Cyber insurers have paid out big in recent years — ransomware attacks, data breaches, and payment fraud schemes have become both more common and more expensive.

To protect themselves, insurance providers are:

• Narrowing what’s covered under “cyber events” or adding riders for specific types of events.
• Requiring more proof that applicants have solid cybersecurity controls and practices in place.
• Scrutinizing claims more aggressively, sometimes rejecting them for minor policy violations.

🛡️ Real-world example: One manufacturer had a ransomware claim denied because they hadn’t enforced multi-factor authentication for email, even though it was listed as a condition in their policy renewal.

‍

What’s Being Required Now (and What Happens If You Don’t Have It)

Most underwriters are no longer content with check-the-box questionnaires. They now expect:

✅ Multi-Factor Authentication (MFA)

For all admin accounts, VPNs, and email.
Without it? You might not qualify for any meaningful coverage.

✅ Endpoint Detection & Response (EDR) Tools

Basic antivirus is not enough.
Without it? Your claim might be rejected due to “inadequate threat detection.”

✅ Regular Data Backups (Tested!)

And stored separately from your main environment.
Without it? You may lose out on reimbursement for recovery costs or business interruption.

✅ Employee Security Training

Phishing simulations, annual awareness sessions.
Without it? Claims tied to human error may face tougher scrutiny.

✅ Incident Response and Recovery Plans

Insurers want to see documented procedures.
Without it? Delays in response could increase damages — and your liability.

‍

Questions to Ask Before Your Next Renewal

Here are five critical questions every manufacturer, system integrator, and industry partner should be asking now:

1. Have our security controls changed since our last application?
2. Do we meet the insurer’s minimum cybersecurity standards — today?
3. What exclusions exist in our policy for human error, third-party vendors, or outdated software?
4. If we were breached tomorrow, what documentation would we need to provide? Do we have it?
5. Are we over-insured in one area and under-insured in another (i.e., OT or supply chain risks)?

‍

Tips for a Successful Cyber Insurance Review

• Involve IT early. Don’t let the CFO or insurance broker handle renewals in isolation. Security teams must review technical requirements in advance of your next renewal.
• Request a copy of the insurer’s risk control checklist. Many underwriters provide one — use it as a roadmap.
• Simulate a claim. If you had to file tomorrow, could you prove compliance? Could you respond in hours, not days?

‍

What It Means for PMMI Members

Whether you’re a CPG brand, OEM, supplier, or solution provider, your exposure to cyber risk is only increasing — and insurance is just one piece of the puzzle.

Think of cyber insurance not as a substitute for security, but as a compliance-driven partnership with real consequences. When used well, it can help protect your balance sheet, reputation, and operational continuity. But it’s not a blank check anymore.

Bottom line: If you haven’t updated your cybersecurity practices to match today’s insurance landscape, you may not be covered when you need it most.

‍

Do you have insights or experiences with changing cyber insurance policies? We’d love to hear from you — email cyberhealth@pmmi.org to contribute or share feedback.