Why cyber claims get denied, and how to keep yours paid

The short answer

Cyber insurance claims are most often denied or reduced for a handful of reasons: the application overstated security controls, the business stopped maintaining a control the policy required, the loss falls under an exclusion or a low sublimit, or the business broke the claim process by reporting late or hiring its own vendors without consent. The common thread is a gap between what the policy assumes and what was true on the day of the attack. You prevent most denials before you buy: answer the application accurately, keep the controls you promised in place, read the exclusions and sublimits, and know the first-hour claim steps.

This article is general information, not legal or insurance advice. Policies differ, so confirm your terms with your broker, insurer or coverage counsel.

Two cases that show how it happens

The MFA answer that was only partly true

In 2022, Travelers asked a federal court in Illinois to rescind a cyber policy it had issued to International Control Services after a ransomware attack. According to the complaint, the application said multi-factor authentication protected administrative and privileged access. Travelers alleged that after the attack it found MFA protected only the firewall and no other systems. It argued the statements were material misrepresentations and asked the court to declare the policy void, meaning no coverage for anything.

The city whose MFA rollout was unfinished

The City of Hamilton, Ontario, was hit by ransomware in February 2024 and did not pay the roughly $18.5 million ransom. In July 2025, a city staff report said its insurer had denied the claim because multi-factor authentication had not been fully implemented for online services at the time of the attack. A third-party review found the denial was consistent with the policy. Recovery costs had reached about $18.3 million Canadian, paid by the city.

Neither organization was without security. Each had a control that was partly in place, and partly was not enough.

The most common reasons claims get denied

1. Misrepresentation on the application. Answering yes to “MFA on all remote access” or “offline backups” when the truth is “mostly” gives the insurer grounds to reduce the claim or rescind the policy.
2. Failure to maintain required controls. Some policies make certain controls a condition of coverage. If MFA was switched off for a few executives or backups stopped running months ago, coverage can be at risk.
3. Exclusions. War and state-backed attack exclusions, losses from known but unpatched vulnerabilities in some policies, bodily injury, property damage, and contractual liability are common examples.
4. Sublimits. Ransomware, social engineering and business interruption are often capped well below the headline limit, so a claim can be partly denied.
5. Social engineering not covered. A fake invoice or changed bank details is often not covered at all without a specific funds transfer fraud endorsement, and that endorsement may require callback verification.
6. Late notice. Most policies require prompt notice. Waiting to see how bad it is can breach a condition.
7. Unapproved vendors or payments. Hiring your own forensic firm or paying a ransom without the insurer’s consent can leave those costs uncovered.
8. Prior known incidents. Events that began before the policy’s retroactive date, or that you knew about before buying, are usually excluded.

About war and state-backed attack exclusions

After the 2017 NotPetya attack, drugmaker Merck sued its property insurers over about $1.4 billion in losses. A New Jersey appeals court held that the war exclusion in those policies, which referred to hostile or warlike action, did not apply to the cyberattack. Insurers responded with clearer wording. Lloyd’s of London required its syndicates to include exclusions for state-backed cyber attacks in standalone cyber policies starting March 31, 2023. Ask your broker how your policy defines a state-backed attack and how attribution is decided.

Would your security answers hold up after a claim? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, business continuity and IT operations, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

How to avoid a denial before you buy or renew

• Have IT answer the technical questions, and have an owner review them. Do not let one person guess.
• Answer what is true today, not what is planned. If MFA covers 90 percent of accounts, say so and explain the plan for the rest.
• Define the terms. “All remote access” includes VPNs, remote desktop tools, cloud admin portals and vendor access accounts.
• Keep evidence. Save MFA enrollment reports, backup test results, update status and training records with the date you submitted the application.
• Read the conditions and exclusions with your broker, especially anything tied to MFA, backups, patching or payment verification.
• Check sublimits for ransomware, business interruption and social engineering against your real exposure.
• Tell the insurer about changes. If a control lapses mid-term, ask your broker whether you need to disclose it.

A five-question self-check

• Could you print a report today showing MFA on every account named in your application?
• When did someone last restore a file or a whole system from backup, and is it written down?
• Do you know your ransomware and social engineering sublimits without looking?
• Is the insurer’s claims hotline in your incident plan and on paper somewhere outside your network?
• Has any control you described changed since the application date?

If any answer is no or not sure, fix that before renewal.

What to do in the first hours of an incident

1. Call the insurer’s claims hotline or breach coach number before hiring anyone.
2. Ask which forensic and legal firms are approved and use them.
3. Preserve logs and evidence. Do not wipe and rebuild systems before the investigators agree.
4. Do not pay a ransom or promise payment without the insurer’s consent and legal advice.
5. Keep a written timeline of who did what and when.
6. Track every cost with receipts, including staff overtime and lost revenue.

If your claim is denied

Ask for the denial in writing with the specific policy language relied on. Give the letter to your broker and, for a significant loss, a coverage lawyer who represents policyholders. Denials are sometimes negotiated or reversed when facts are clarified. You may also be able to file a complaint with your state insurance department. Act quickly, since policies and state law can set deadlines.

Make the application true, then keep it true

The most reliable protection is boring: controls that are fully in place and documented. JLB USA’s cybersecurity services cover MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores and a written recovery plan, and we help clients answer cyber-insurance questionnaires accurately. For what carriers ask about this year, see cyber insurance requirements in 2026.

Keep reading

• User access review process: how to run quarterly reviews in a small business
• Patch management best practices for small businesses
• How much does cyber insurance cost for a small business in 2026?
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026