Cyber insurance policies have changed dramatically since 2020 — premiums have risen, coverage exclusions have expanded, and insurers now require specific security controls as a condition of coverage. Here's what NZ businesses need to understand before buying, and what they need to have in place to qualify.
Key takeaways
- 1MFA: Required for remote access, email, and privileged accounts by virtually every insurer. A business without MFA on Microsoft 365 may be declined coverage outright or face signif
- 2EDR on all endpoints: Traditional antivirus is no longer acceptable to many insurers. Behavioural EDR (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint) is required or str
- 3Tested backups: Insurers ask not just whether you have backups but whether they're immutable and whether they've been tested. Untested backups that prove unrestorable during an inc
- 4Privileged access management: Segregated admin accounts, separate from daily-use accounts, for system administration tasks.
- 5Patch management: Evidence of a defined, documented patch management process with timely application of critical patches.
In 2019, cyber insurance was a niche product with relatively generous coverage and low premiums. Then 2020–2021 happened: ransomware payouts reached astronomical levels, insurers paid out more in cyber claims than they collected in premiums, and the entire market restructured. By 2023, cyber insurance had become significantly more expensive, more restrictive in coverage, and far more demanding about the security controls required to qualify for a policy.
What Cyber Insurance Covers
A comprehensive NZ cyber insurance policy typically covers: incident response costs (engaging specialist forensic and response firms), ransom payment (subject to sanctions compliance and sub-limits), legal costs and regulatory defence, Privacy Act notification costs, business interruption (revenue loss during downtime), and third-party liability (if your breach causes loss to a customer or supplier).
What it typically does not cover: reputational damage, pre-existing vulnerabilities that weren't remediated before the policy period, losses caused by unpatched systems where patches had been available for more than a specified period, and increasingly, "acts of war" — a contentious exclusion that some insurers attempted to apply to state-sponsored ransomware groups with mixed legal outcomes.
What Insurers Now Require Before Issuing Coverage
The security control requirements for cyber insurance have hardened significantly. The following controls are commonly required or result in substantially lower premiums when demonstrated:
- MFA: Required for remote access, email, and privileged accounts by virtually every insurer. A business without MFA on Microsoft 365 may be declined coverage outright or face significantly higher premiums.
- EDR on all endpoints: Traditional antivirus is no longer acceptable to many insurers. Behavioural EDR (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint) is required or strongly preferred.
- Tested backups: Insurers ask not just whether you have backups but whether they're immutable and whether they've been tested. Untested backups that prove unrestorable during an incident create policy disputes.
- Privileged access management: Segregated admin accounts, separate from daily-use accounts, for system administration tasks.
- Patch management: Evidence of a defined, documented patch management process with timely application of critical patches.
How Optimyze Helps Clients Qualify
When an Optimyze-managed client applies for cyber insurance, they can provide documented evidence of the security controls the insurer asks about — because those controls are standard deployments in every managed engagement. MFA deployment records, EDR coverage reports, backup test logs, and patch compliance reports are available on request. This evidence materially improves the coverage terms and premiums available to managed clients compared to unmanaged businesses with equivalent size and sector risk profiles.
Cyber insurance is not a substitute for security investment — it's a complement to it. And increasingly, you can't get the insurance without the security controls in the first place. The two have become inseparable.
