The days of "cyber policy €4,000 a year, covers €5 M" are over. Insurers saw huge loss ratios in 2023–2025. Think ransomware mega-claims in the seven-figure range, BEC incidents with direct losses and business outages that lasted for weeks. The result: in 2026, cyber policies cost far more or cover far less. Some you simply cannot get at all.
The New Minimum Rules From Insurers
A typical risk questionnaire in 2026 no longer just asks "do you have a backup?" It goes into deep technical detail:
- Multi-factor authentication: For all privileged accounts, outside access and webmail. "Rolled out to 80 %" is not enough. The auditor wants 100 %.
- Endpoint detection and response (EDR/XDR): Not "classic AV", but detection based on behavior, with a central telemetry backend.
- Backup strategy 3-2-1-1-0: Three copies, two media, one off-site, one that cannot be changed, and zero errors at the last restore test. You must be able to prove the restore test.
- SIEM that keeps logs for 12 months or more: For forensics after an incident. Self-hosted Wazuh or a similar tool is accepted if the logs cannot be changed.
- Patch management with an SLA: Critical CVEs are patched within 72 h, or you document how you offset the risk.
- Phishing awareness that shows results: Training once a year, plus phishing tests that track the click rate over time.
- Incident response plan, tested: A tabletop exercise once a year, with the board taking part.
- Supplier risk checks (TPRM): At least for the top 10 critical providers.
Miss any of these and you face a surcharge or a no. A "no" means: no policy from this insurer. And the next one will read your questionnaire with doubt.
The Most Dangerous Part: The Warranty Clauses
Even a policy you already have may not protect you. It fails if it later turns out that the minimums you claimed were not in place at the time of the loss. Standard 2026 wording:
"Coverage is forfeit insofar as the technical and organizational measures asserted in the risk questionnaire were not implemented as asserted at the time of the insured event."
In plain words: say you confirmed 100 % MFA in the questionnaire, but you really had 70 %. If the loss runs through an account without MFA, the policy does not pay. This is not just theory. It was standard practice in 2025.
How One Joined-Up Platform Saves the Policy
A platform like SecTepe.Comm + SecTepe.Core covers several insurer demands directly. Above all, it supplies the evidence:
- MFA coverage report: Pulled from Keycloak on its own. "What share of our accounts have FIDO2 or TOTP turned on?" becomes a live number.
- SIEM logs: Wazuh as a known SIEM, with append-only storage and logs kept for 12+ months.
- Backup audit trail: A WORM archive for mail forensics and Borg/Restic for asset backups. Restore test logs are written on their own.
- Phishing tests: GoPhish is built in. You see click-rate trends without an outside tool.
- Awareness training: A wiki module with quizzes and attendance rates.
- TPRM module: A supplier list, a risk score and a set rhythm for new reviews.
- Incident response runbooks: Versioned in the wiki. Tabletop minutes go into the audit log.
The Insurance Math
Take a mid-sized firm with 200 staff. Its old policy cost €8,000 a year with a €25,000 deductible. "BEC" and "insider threats" were left out. In 2026 it asks four insurers for new quotes:
- Two say no.
- One wants €35,000 a year with a €100,000 deductible.
- One offers €18,000 a year. But only on these terms: "SIEM, MFA, EDR, awareness as in the questionnaire, annual confirmation".
The premium rise you avoid (~€17,000 a year) pays for the ISMS tooling over the term. On top, you know the policy will actually pay out when a loss occurs.
Questions the Board Should Be Asking Now
- When did we last update our cyber risk questionnaire? Who signed it?
- Which of the measures we claimed do we have, and can we prove they work?
- What is our real MFA coverage? (Not "we plan to", but the live number.)
- How long do we keep our logs today? Can they be changed?
- When did we last run a restore test that worked?
Conclusion
In 2026, cyber insurance is no longer an add-on you tick off at the end. It is a process that puts your security level to a real test. A joined-up security and GRC platform delivers just the evidence the insurer asks for. That means it also delivers the policy the board needs when a loss occurs.