Cyber Insurance for First-Time SMB Buyers: What the 2026 Questionnaire Actually Asks and How to Pass It

Cyber insurance for small business is no longer a niche product.

It sits on the renewal checklist next to workers' comp and the BOP, and for most SMBs it is now a contractual requirement somewhere:

• A bank line of credit
• An enterprise customer's vendor onboarding form
• A state regulator's safeguards rule

The market a first-time buyer is walking into is not the market that existed five years ago. Carrier scrutiny on controls is high, and the questionnaire is now a controls audit dressed up as paperwork. The marketing brochure rarely matches the policy form.

This article covers:

• What a cyber policy actually covers
• What the 2026 questionnaire asks
• The control categories that shape underwriting
• What the policy will not pay
• The operational sequence to pass underwriting without overspending on tools that do not change a single answer

Obsidian Ridge does not sell insurance. We help SMBs pass the questionnaire honestly and operate the controls behind the answers.

The direct answer

A first-time SMB cyber liability policy is two contracts stitched together: first-party pays your losses (forensics, breach notification, business interruption, ransom where legal, data restoration); third-party pays the losses you cause others (regulatory defense, PCI penalties, customer lawsuits).

Most SMBs under 50 employees carry $1 million in aggregate cover, and that policy typically runs about $1,000 to $3,000 per year when controls are documented. The 2026 questionnaire is now a controls audit — MFA on email, remote access, and admin accounts is the hard floor, and MDR or EDR plus tested backups drive premium credits.

Applying with gaps usually results in non-quote or worse terms. Fix the gaps first, then apply.

What does cyber insurance actually cover?

A standalone cyber liability policy is two contracts stitched together. First-party coverage pays your losses. Third-party coverage pays losses your customers suffer because of you.

First-party coverage — your losses

Where most SMBs cash claims. Typical covered costs:

• Forensic investigation to determine scope, root cause, and notification obligations
• Legal counsel, including a breach coach who manages the incident from the legal side
• Breach notification costs, usually billed per record affected
• Credit monitoring and identity theft services for affected individuals
• Business interruption and lost income from a covered cyber event
• Cyber extortion and ransom payment, where legal under OFAC sanctions rules
• Data restoration and system rebuild costs

Third-party coverage — losses you cause others

The third-party section is where the lawsuits and the regulators show up. Typical covered costs:

• Regulatory defense and fines, including HHS Office for Civil Rights, FTC, and state attorneys general
• PCI compliance penalties and forensic assessments from the card brands
• Lawsuits from customers, clients, or business partners whose data was exposed
• Network security liability claims — where your compromised systems caused harm to a third party

Both sections together are the base policy. Almost every meaningful loss type beyond ransomware sits in a rider.

The common add-on riders

Base cyber policies sit underneath a stack of endorsements. The riders that matter most for a first-time SMB buyer:

• Social engineering and wire fraud (crime rider). Covers the BEC pattern where staff are tricked into wiring money to an attacker. Almost always needed.
• Reputation harm. Pays for crisis communications and PR after a publicly disclosed event.
• Bricking. Covers hardware physically destroyed by malware — rare, but real for OT-adjacent SMBs.
• Funds-transfer fraud. Covers direct computer-funds-transfer fraud where the attacker moves money without the insured's authorization. Distinct from social engineering.
• Computer fraud. Covers theft of money or securities via direct computer manipulation.
• System failure. Covers business interruption from an outage that is not the result of an attack — cloud provider failure, hardware failure, accidental admin action.

The two non-negotiables for most SMBs are the crime rider with explicit social-engineering language and a system-failure endorsement if business interruption coverage matters.

The base policy without the crime rider will not respond to a vendor-impersonation BEC, which is the single most common SMB cyber loss in the FBI IC3 2024 Annual Report.

What does cyber insurance typically not cover?

Knowing the exclusions is more important than knowing the coverages, because exclusions decide what you do not collect when something goes wrong.

• Pre-existing breaches you did not disclose at binding. Material misrepresentation voids the policy. Anything you knew or should have known before binding must be disclosed.
• Acts of war and nation-state attacks. After the 2023 Lloyd's of London war exclusion guidance, most policies now exclude nation-state cyber operations. The wording varies by carrier.
• Property damage from cyber-physical incident. A fire caused by malware affecting an HVAC system is property, not cyber. That sits on the property policy.
• Improper data collection. GDPR-style fines for unlawful processing — separate from a breach — are often excluded.
• Patent or IP theft losses. Trade secret theft and intellectual property losses generally fall outside cyber.
• Failure to maintain stated controls. If you told the underwriter MFA was on every account and it was not, the carrier can deny the claim that surfaced the gap.

Read the exclusion section before you read the coverage section. The shape of the exclusions tells you what the policy is actually for.

What are typical cyber insurance coverage limits for an SMB?

Do not size a policy from a blog post — but walk into the broker conversation with the right anchors.

Most SMBs under 50 employees carry $1 million in aggregate cover; firms with 50 to 250 employees commonly carry $2 million to $5 million. A $1 million policy for a business with documented controls typically prices around $1,000 to $3,000 per year, with weak controls or a higher-risk vertical pushing past $5,000.

Pressure-test the limit against your revenue, sensitive-record volume, regulatory obligations, contract requirements, prior incident history, and business-interruption exposure if email or line-of-business systems go down.

The aggregate limit is half the conversation. Sublimits are the other half.

The ransomware sublimit, regulatory defense sublimit, and crime rider sublimit may all sit below the headline number — on a $1 million policy the social-engineering and crime sublimit commonly lands at $50,000 to $100,000, with standalone crime endorsements running $100,000 to $500,000.

A policy with tight ransomware and crime sublimits is a different product than the same aggregate limit at broader terms. A BOP's built-in cyber endorsement, by contrast, is usually capped around $25,000 to $100,000 — a floor, not primary coverage.

What does the 2026 SMB cyber insurance questionnaire ask?

If you have never filled out a cyber application, the structure is similar across many SMB carrier forms. The order varies. The exact wording varies. These twelve questions are the ones most likely to drive the offer:

1. Total revenue, employee count, and sensitive-data record count. Drives the base premium. Be honest about the record count — undercounting is the most common reason a claim ends up underinsured.
2. Industry classification. Healthcare, financial services, legal, and government contractors are regulated verticals with a higher base loading.
3. Prior cyber incidents in the last 24 to 36 months. Includes events you handled without a claim. Disclose everything.
4. MFA on email — Microsoft 365, Google Workspace, or equivalent. Required for every user, including service accounts and shared mailboxes.
5. MFA on remote access. Every VPN, every RDP path, every RMM tool used by your IT vendor, every jump host.
6. MFA on privileged and admin accounts. Domain admin, M365 global admin, line-of-business system admins.
7. EDR or MDR on all endpoints. Workstations, servers, including domain controllers and hypervisors. 24/7 SOC monitoring strongly preferred.
8. Identity threat detection on cloud productivity. Token theft, malicious inbox rules, rogue OAuth grants on M365 or Workspace.
9. Immutable offsite backup with tested restore in the last 90 days. Backups that exist on paper but were never restored fail this control in practice.
10. Written information security plan. Reviewed within the last 12 months, with a named owner.
11. Documented incident response plan with annual tabletop. Carrier hotline named, roles defined, exercise log retained.
12. Security awareness training with phishing simulations. Recurring cadence, tracked completion rate, click rate trended.

A few carriers ask additional questions on DMARC, conditional access, patching cadence, and vendor management. Those can shape the terms at the margins. The twelve above decide whether you get an offer at all.

Which four controls matter most for cyber insurance underwriting?

If you read nothing else in this article, read this section. Underwriters score everything, but these four controls do much of the work on eligibility and terms.

1. MFA everywhere it matters. Email, remote access, privileged accounts. Missing it commonly triggers a 20 to 40 percent surcharge — or an outright non-quote, since many carriers now treat absent MFA as a hard stop rather than a pricing lever.

2. 24/7 EDR or MDR. Real human SOC, documented escalation, named on-call responder.

   It is one of the clearest ways to answer the monitoring question without pretending software alone is a response plan — and it earns a measurable premium credit, with broker guidance citing 20 to 50 percent total reduction when MDR is stacked with MFA, immutable backups, and an IR plan.

3. Immutable backups with a tested restore log. Cloud object lock or air-gap, restore log within 90 days. Backups that have never been restored are weak evidence.

4. Identity threat detection on the cloud productivity tenant. Token theft, mailbox rules, OAuth grants. This is appearing more often because so many SMB losses start in email and identity.

If you have all four, the application becomes much more evidence-driven and much less argumentative. If you have none, expect harder underwriting, weaker terms, lower sublimits, or a decline until the control gaps are closed.

What is the co-insurance trap on ransomware claims?

The most expensive surprise in 2026 SMB policies is not always the premium — it is the ransomware endorsement.

These endorsements commonly carry coinsurance — typically a 10 to 25 percent insured share, though some policies use 50 percent — along with sublimits below the policy aggregate and controls-warranty language that bites when the insured cannot demonstrate, at the time of loss, that the named controls were operating.

Named controls often include MFA on key surfaces, EDR or MDR with monitoring, immutable tested backups, and a written IR plan.

A ransomware loss can therefore pay far less than the headline limit suggests. If the carrier also finds material misrepresentation on the application, the entire claim can be denied.

The clause lives in the ransomware endorsement, not the declarations page. Read it before binding. Map each named control to evidence you can produce on the day of loss — restore logs, EDR console exports, conditional access policy exports — not the day of the application.

Exclusions worth knowing in plain language

Beyond the standard exclusion list, a handful matter most for first-time SMB buyers:

• War and cyber-war. The Lloyd's exclusion is now standard. Some carriers still pay if attribution is unclear; others have moved to harder language.
• Supply-chain compromise of vendors. Coverage varies. A breach that traveled through your IT provider, RMM tool, or payroll vendor may or may not be covered depending on the systemic-event wording. Ask the broker in plain language.
• Failure to maintain stated controls. If you said MFA was enabled tenant-wide and a forensic investigation shows it was not, the carrier has a defense. This is why honest answers matter more than favorable ones.
• Pre-existing or undisclosed events. Lying on the application voids the policy. Every cyber claim eventually invites the carrier to read the application again.

What happens if you misrepresent a control on the application?

Material misrepresentation on the questionnaire is grounds for the carrier to rescind the policy after a loss. The rescission is retroactive — premiums are returned and claims are denied.

If MFA is on most accounts but not on the CEO's mailbox because it broke her travel routine, the honest answer is "MFA is required on all email accounts except one executive exception."

That answer may affect terms. It does not void the policy.

The other answer — "yes" — may save money at binding and lose the claim when the executive mailbox is the one that gets popped.

Honest answers, even when they affect pricing or terms, are the only viable strategy. The cost difference from an honest "no" is usually smaller than the loss from a denied claim.

What does not change cyber insurance underwriting much?

First-time buyers commonly spend in the wrong places. The following sound like security but do not change a single answer on a 2026 questionnaire:

• A more expensive firewall, by itself
• Two or three antivirus brands stacked on the same endpoint
• "We have a great IT guy"
• A 2019 written information security plan nobody has read since
• A compliance certification with no operational controls behind it
• A generic "we passed an audit" letter without evidence

Carriers score operating controls and evidence. Not invoices, not certificates, not vendor logos.

How do I actually pass cyber insurance underwriting?

If you are reading this with a renewal application open, or a first-application quote request from your broker, work in this order. Each step makes the next easier.

Step 1 — MFA on every surface (1 to 2 weeks)

Enable MFA on Microsoft 365 or Google Workspace tenant-wide via Conditional Access or context-aware access. Add MFA on every remote-access path the IT vendor uses — VPN, RDP, RMM, jump hosts.

Add MFA on every privileged account, including break-glass accounts with a documented checkout procedure. This is usually one of the cheapest control moves and one of the most important underwriting answers.

Step 2 — Deploy 24/7 EDR or MDR (1 to 2 weeks)

A managed detection and response service with a real 24/7 SOC checks the EDR box, the 24/7 monitoring box, and the documented escalation box at the same time.

Adding identity threat detection on top covers the cloud productivity controls underwriters are starting to score separately. See Managed Detection and Response and Managed ITDR.

Step 3 — Immutable backup with monthly restore test

Pick a backup product that supports immutability natively — cloud object lock or air-gap. Schedule a monthly restore of a representative dataset. Keep the log. Carriers ask for the log at claim time. A backup that exists on paper but was never restored fails this control.

Step 4 — Write a WISP and a one-page IR plan

A 12-page written information security plan covering administrative, technical, and physical safeguards, with a named owner and a 12-month review date.

A one-page incident response plan that names who calls the carrier hotline, who declares an incident, who talks to staff, and who decides about closing operations. Keep both short enough that someone will actually read them during a crisis.

Step 5 — Launch SAT with phishing simulations

A managed security awareness training program with quarterly phishing simulations and tracked completion rates.

Carriers want completion data and click rates — not a training video shelved in a learning management system nobody opens. See Managed Security Awareness Training.

Five operational moves, a realistic execution window, and the main control categories on a 2026 questionnaire are now answered yes — with evidence.

The first-time buyer process

The mechanics of buying a cyber policy for the first time:

1. Find a broker who specializes in cyber. This is not your general business insurance broker. Cyber underwriting is its own discipline, and a generalist broker will hand you the first carrier's form and a quote that does not reflect your controls.

   Ask the broker how many cyber policies they placed last year and which carrier panel they work with.

2. Complete the questionnaire honestly. Where a control is partially in place, say so. Where you do not know, find out before answering rather than guessing.

3. Get three quotes. Carriers can price and sublimit the same risk differently. One quote is not enough information.

4. Read the policy and every rider before signing. Focus on co-insurance, sublimits, the war exclusion, the supply-chain wording, and the carrier's definition of "incident." The marketing summary is not the policy.

5. Bind with a clear understanding of who you call when something happens. The carrier's incident response hotline goes in your IR plan, on a laminated card in the office, and into the phones of everyone who could declare an incident.

   Late notification is one of the most common reasons coverage is denied on otherwise-covered events.

Pricing signals — what to question

Cyber pricing changes by revenue, industry, record count, geography, prior incidents, and the exact controls in place.

The broad market also moves: after the steep increases of 2021 and 2022, U.S. cyber rates declined roughly 5 to 7 percent in 2024 per NAIC data and have since stabilized for firms with documented controls — so a renewal hike today usually points at your controls or a claim, not the market.

Instead of relying on static price bands, ask the broker to explain:

• Why the quoted aggregate limit fits your exposure
• Which sublimits are lower than the headline limit
• Whether ransomware, social engineering, regulatory defense, and system failure are full-limit or sublimited
• Whether any exclusions or warranties are driving the price
• How the quote changes after MFA, MDR, tested backups, and an incident response plan are documented

A quote that looks unusually cheap or unusually expensive is a signal to ask why.

Outliers below the expected market often have low sublimits, high deductibles, or restrictive wording. Outliers above the expected market often reflect missing controls, prior incidents, or a vertical the carrier is pricing cautiously.

Renewal reality

Most SMBs see renewal pressure even when nothing changes. The way to improve the conversation is to demonstrate control improvements year over year:

• Added ITDR
• Completed tabletop
• Tightened conditional access
• Raised SAT completion rate

Fresh quotes from multiple markets can also expose whether the current carrier is pricing cautiously or whether the terms are broadly in line with the market.

Carriers also share loss intelligence. A claim paid in a prior policy period invites a specific question at the next renewal: what changed since the incident?

Answers like "we are more careful now" do not pass. Answers like "we moved to a 24/7 MDR provider in March, added MFA on the line-of-business admin accounts in April, and completed a tabletop in May" do.

The other 2026 reality: non-renewal is more common than it used to be when controls have slipped or after a claim. The firm has 30 to 60 days to find replacement coverage, and the next application asks about the prior non-renewal. The fix is operational, not paperwork.

Where Obsidian Ridge fits

We are not an insurance broker. We do not sell policies. We help SMBs:

• Operate the controls underwriters score
• Produce the evidence package the application asks for
• Pass renewal without overspending on tools that do not improve the application

Our Ridge Plus tier ($50 per person per month, everything in Ridge Core included) covers MFA enforcement support, 24/7 MDR, ITDR on the productivity tenant, and the managed SAT program. Those are the recurring control categories that appear across 2026 applications, operated and monitored, with the evidence package as a byproduct.

See pricing.

For first-time buyers or renewing buyers staring at a questionnaire, the Cyber Insurance Readiness sprint is a fixed-scope engagement (7 business days, $1,500–$3,500) that:

• Maps your current state against the carrier questionnaire
• Identifies the gaps that will most likely block underwriting
• Produces a clean evidence package to submit with the application

For a deeper walk through the underwriting controls, see the companion piece on the 22-control questionnaire.

To walk through your specific situation with us before applying, talk with us. The assessment tool gives you a faster posture snapshot against the controls underwriters care about, if you want a read before committing to anything.

Cyber insurance is not a substitute for controls. It is a backstop for the residual risk that remains after the controls are doing their job.

First-time buyers who treat the policy as the plan tend to learn the expensive way that the controls warranty in the fine print is doing more work than the declarations page. The fix is operational, and it is cheaper than trying to remediate under claim pressure.

Start with MFA, MDR, a tested backup, and an honest answer to twelve questions. The rest of the application gets easier from there.