NAIC Reports 20% Rise in Cyber Claims as Control Scrutiny Tightens

Key Takeaways

• Insurers increasingly expect evidence that security controls were active when an incident occurred
• MFA, endpoint detection, protected backups, response planning, and patching receive early scrutiny
• Policyholders can reduce claim friction by retaining configuration records, test results, and approved exceptions

The cyber insurance application is no longer just a snapshot of security practices. It can become a key piece of evidence when a ransomware incident turns into a claim.

That distinction matters as claim volume rises. The NAIC reported 56,323 cyber insurance claims in 2025, an increase of 20% year over year. More claims give carriers additional incentive to examine whether applicants accurately described their controls and maintained them throughout the policy period.

A control that existed on the application date but disappeared later may not provide much comfort. The same applies to a technology deployed across only part of the environment. When forensic evidence conflicts with an application response, an insurer may seek to reduce coverage, deny a claim, or pursue rescission, depending on the policy language, applicable law, and materiality of the discrepancy.

MFA is often the first test. Industry research indicates that 99% of cyber insurance applications included specific MFA questions in 2025. Yet a checked box does not show whether MFA covered email, VPN access, remote desktop protocol, cloud services, administrative accounts, and legacy systems. One forgotten remote access gateway can materially change the risk.

MFA deployment is not binary. Insurers may examine identity-provider logs, conditional-access policies, enrollment records, bypass groups, and emergency accounts. They may also ask when an exception was created, who approved it, and whether compensating safeguards were present.

Endpoint detection and response receives similar attention. Data from 2025 shows 88% of carriers reportedly required EDR or managed detection and response across endpoints (source). Products such as Microsoft Defender for Endpoint, CrowdStrike, and SentinelOne can support that requirement, but simply owning licenses may not be enough. Investigators can check agent coverage, sensor health, alert retention, exclusions, and whether monitoring continued around the clock. Traditional antivirus alone may fall short of the capabilities described in an insurance application.

Backups are another pressure point. Coalition reported in 2025 that 94% of organizations hit by ransomware saw attackers target backups, because destroying recovery options can increase leverage during extortion. Carriers therefore tend to favor immutable, offline, or otherwise segregated copies, supported by documented restoration testing. A backup dashboard showing successful jobs is useful, but can the business demonstrate that critical systems were actually restored within the stated recovery window?

The broader market context is shifting too. Cybersecurity Dive has reported that claims patterns for large businesses are changing amid concerns involving artificial intelligence and supply-chain exposure. Those risks make accurate asset inventories, vendor oversight, and control evidence more important during underwriting and claims review.

Incident response obligations can create a separate source of friction. Policies commonly specify when the carrier should be notified and may identify approved breach counsel, forensic specialists, negotiators, or response vendors. A written response plan can help, but insurers may also look for exercise records, current contact details, escalation procedures, and evidence that executives understand their roles.

Guidance from CISA’s Cybersecurity Performance Goals and NIST CSF 2.0 can help organizations structure these practices. The practical insurance issue, however, is proof. Meeting minutes, tabletop exercise reports, forensic retainers, notification workflows, and decision logs can show that response capabilities existed before the incident rather than being assembled afterward.

Patch and vulnerability management completes the group of controls likely to receive early scrutiny. Applications increasingly ask about remediation timelines, internet-facing systems, known exploited vulnerabilities, scanning coverage, and exceptions. As IMIT notes in its overview of insurer requirements, carriers commonly assess controls including MFA, endpoint protection, backups, and vulnerability management when evaluating cyber risk.

For security and risk leaders, this turns insurance readiness into an evidence-management exercise. Useful records include dated configuration exports, EDR coverage reports, restoration results, patch metrics, exception approvals, and copies of the representations submitted through brokers such as Marsh and Aon or insurers such as Coalition.

Documentation cannot repair a missing control. It can show what was operating, where gaps existed, and how exceptions were managed. Regularly comparing application answers with production reality, preferably before renewal and after major infrastructure changes, can reduce surprises when a carrier begins asking difficult questions after an attack.