Five years ago, buying a cyber insurance policy looked a lot like buying general liability coverage. You filled out a short application, answered a handful of yes/no questions about firewalls and backups, and a broker came back with a quote in a few days. Premiums were affordable, limits were generous, and underwriters were largely willing to take your word for it.
After several brutal loss years driven by ransomware, business email compromise, and supply-chain attacks, the cyber insurance market has matured into one of the most technically rigorous lines of commercial coverage. California businesses, in particular, are feeling the squeeze: tighter underwriting, longer applications, mandatory security controls, and renewal conversations that increasingly resemble a third-party security audit. If you haven't bought or renewed a policy in the last 18 months, the experience you're walking into is going to surprise you.
The Market Has Recalibrated — and Underwriting With It
The pricing whiplash of 2021–2022, when premiums in some segments doubled or tripled year-over-year, has stabilized. Capacity has returned. New carriers have entered the market. For well-prepared buyers, rates in 2026 are flat to modestly down compared with the peak.
The Controls Underwriters Now Treat as Non-Negotiable
Across the major carriers, a clear consensus has emerged on the security controls that separate insurable risks from uninsurable ones. These aren't best-practice suggestions anymore; they're effectively coverage prerequisites. Expect to be asked — and to provide evidence — about each of the following.
Why Underwriters Now Verify, Not Just Ask
The most consequential shift isn't what's on the application — it's how it gets validated.
Almost every major carrier now runs an external attack-surface scan against your domain before quoting. They look for exposed RDP, outdated software banners, expired certificates, leaked credentials on the dark web, misconfigured cloud storage, and hundreds of other indicators. If their scan disagrees with your application — for example, you said "no RDP exposed" but their scan finds three open ports — your application doesn't just get questioned. It often gets declined outright, because the carrier now considers it materially inaccurate.
This has two important implications:
- You should run the same scans on yourself first. Several free and low-cost services replicate what underwriters see. Fix the findings before submitting your application, not after.
- Don't guess on your application. If you're unsure whether a control is fully deployed, find out. "Mostly" or "in progress" is acceptable language; an inaccurate "yes" is grounds for denial — and, in the worst case, rescission of coverage after a claim.
This is also why many growing businesses are now bringing in a cybersecurity insurance advisory partner before renewal — someone who can review the application alongside the actual environment, run the same scans an underwriter will run, and translate technical reality into the language insurers expect to see. The cost of that engagement is almost always recovered in premium savings, broader coverage, or simply avoiding a denial.
The Bottom Line
Cyber insurance in 2026 rewards businesses that treat security as an operational discipline and penalizes those that treat it as a paperwork exercise. The carriers writing the best terms are the ones who can tell the difference — and they have the tools, data, and underwriting expertise to do it quickly.
The good news: the work that earns you a better policy is the same work that makes a claim less likely in the first place. MFA everywhere, modern endpoint protection, tested offline backups, a real incident response plan, and an honest, evidence-backed application aren't just underwriting requirements. They're the controls that keep small incidents from becoming existential ones.
Walk into your next renewal prepared, and you'll find a market that's more competitive and more accommodating than the headlines suggest. Walk in unprepared, and you'll discover — often at the worst possible moment — just how much the rules have changed.
Copyright © 2026 California Business Journal. All Rights Reserved.
For California Business Journal Disclaimers, go to /terms-conditions/.
