Proof, Not Promises: The Cyber Insurance Controls UK Insurers Expect to See in 2026

Cyber liability renewal season has become a markedly different conversation from the one most SMEs remember. Proposals that once ran to a page now extend to several, and the questions are specific: how many accounts use phishing-resistant authentication, how quickly can a critical server be restored, who reviews endpoint alerts at two in the morning, and can the business demonstrate any of it.

The answers given are attestations. If they cannot be supported, cover may be reduced, conditions imposed or a claim disputed. Underwriters are not being difficult for its own sake; they are pricing a risk they can only assess through the controls a business is willing to evidence.

Why the bar moved

Insurers absorbed a decade of losses in a compressed period. Ransomware moved from opportunistic to organised, with negotiators and extortion economics that made small firms profitable targets. A single compromised credential at a managed service provider could cascade across dozens of policyholders at once, creating aggregation risk that traditional models were not built to absorb.

At the same time, reinsurers and regulators demanded more rigour in how cyber risk is underwritten and how policy terms are framed. The result is a market that no longer accepts reassurance. It accepts configuration exports, restore logs and dated screenshots.

The five controls that keep appearing

Phishing-resistant multi-factor authentication. Push notifications and SMS codes are increasingly treated as baseline rather than sufficient. Insurers look for FIDO2 security keys, passkeys or certificate-based authentication, with legacy protocols and basic authentication disabled. The scope matters as much as the method: email, remote access, administrative consoles, finance systems and any third-party access route.

Endpoint detection and response, actively monitored. Antivirus alone does not satisfy most questionnaires. The expectation is endpoint telemetry that is centrally collected, alerts that are triaged under a defined process, and clarity about who responds out of hours. Installing an EDR agent and never reading its dashboard is a common and detectable gap.

Immutable, isolated backups with a proven restore. Underwriters want at least one copy that ransomware cannot encrypt or delete, typically held offline or in an immutable repository, with credentials and encryption keys held separately from the production environment. Critically, they want recovery to have been tested, with a documented recovery time and recovery point that the business has accepted as tolerable.

Privileged access management and asset visibility. A maintained inventory of users, devices and applications is the foundation of every other control. On top of it sits least privilege: separate administrative accounts, day-to-day users without local admin rights, prompt removal of access at the end of employment, and controlled third-party access with an audit trail.

Patch management, vulnerability remediation and a documented incident response plan. The expectation is a defined cadence, tracked remediation timescales for critical vulnerabilities, and external scanning where appropriate. Alongside it: a written incident response plan with named contacts, escalation routes and evidence of having been exercised, supported by log retention sufficient to investigate.

Turning practice into evidence

This is where most SMEs lose ground. Controls may exist, but nobody has assembled the proof at the moment it is requested, and the questionnaire is completed from memory in an afternoon.

A modest evidence pack, maintained continuously, resolves most of the problem:

• Configuration exports and dated screenshots showing MFA enforcement coverage and the proportion of users enrolled.
• EDR dashboard reports showing deployment coverage, alert volumes and mean time to triage.
• Backup job histories and, decisively, restore test records with dates, scope and outcome.
• Patch compliance and vulnerability reports, including how exceptions were risk-accepted.
• Policy documents carrying version numbers and approval dates, plus records of staff security training completion.
• Minutes and actions from a tabletop exercise.

Two further rules matter. First, be candid about gaps. An underwriter will treat a disclosed weakness with a dated remediation plan more favourably than a claim that later proves inaccurate. Second, keep the pack current; a renewal answered with evidence from eighteen months ago reads as neglect.

Closing gaps without overspending

Most SMEs already own more capability than they use. Microsoft 365 licensing frequently includes identity protection, endpoint protection and data governance features that are simply unconfigured. Reviewing entitlements before procuring new platforms is the cheapest possible first step, and often removes two or three line items from a shopping list.

Sequence the work by risk reduction per pound rather than by supplier enthusiasm. Identity comes first: enforcing phishing-resistant MFA and eliminating stale accounts delivers disproportionate benefit for modest cost. Backup integrity and restore testing follow, because recovery capability is what determines whether an incident is a bad week or a closed business. Endpoint detection with a clear triage route comes next, then privilege clean-up and lifecycle processes. Documentation and incident response planning can proceed in parallel, since they are largely a matter of discipline rather than expenditure.

Structured schemes help. Cyber Essentials provides a recognised baseline that maps neatly onto many questionnaire items, and Cyber Essentials Plus adds independent verification that carries weight with public sector buyers and larger customers. For many firms it is the shortest honest route to credible answers.

The trap to avoid is tool sprawl: overlapping products, none fully deployed, each generating alerts that nobody owns. A smaller set of properly configured controls, evidenced consistently, outperforms a broad but shallow stack in both underwriting and practice.

Beyond the renewal

The commercial benefit of this work does not end with a signed policy. Organisations that can evidence their controls answer client due diligence questionnaires in hours rather than weeks. They respond to tender requirements with documentation rather than reassurance. They reduce downtime, contain incidents earlier and hold a defensible position in the event of regulatory scrutiny.

Insurance, in other words, is a by-product. The underlying asset is resilience: a business that knows what it holds, who can reach it, how quickly it can be restored and who is responsible when something goes wrong.

A sensible starting point

Work backwards from the renewal date. Ninety days out is comfortable; thirty is not. Request the insurer's full questionnaire early, map each question to existing evidence, identify the genuine gaps, and agree a sequenced remediation plan with owners and dates. Address identity first, prove recovery next, and document as you go.

Underwriters are not asking for perfection. They are asking whether the business can demonstrate, in concrete terms, that it has taken the risk seriously. That is a standard most UK SMEs can meet, provided they treat evidence as part of the control rather than an afterthought.