Somewhere in your filing system there is a document describing exactly how your business is defended. It is not a security report and nobody on your team wrote it. It is the application you filled in to get cyber insurance.
Almost nobody reads it again after signing. That is the part worth changing.
The form was a survey of your defenses
Think back to what the insurer wanted to know. Is multi-factor authentication turned on, the second step that stops a stolen password working on its own. Are backups taken regularly, tested, and stored away from the main network. Are systems patched. Do staff get trained to spot a fake email.
You answered those questions. Somebody at your business said yes to each one, and the price you pay was set on the strength of those answers.
So the policy is not really a financial product you bought. It is a description of your business that you certified, and the insurer priced the risk of believing you.
The answers get checked on the worst day of the year
Here is the part that surprises owners. An insurer does not verify those answers when you sign. It verifies them when you claim.
That means the audit happens on the day the systems are locked, the day the phones are ringing, the day you have the least time and the fewest people available to go and find evidence. If the backup was never tested, that is discovered then. If one account never had the second step turned on, that is discovered then, and it is quite often the account the attacker used.
A business that treated the policy as a substitute for the practices it describes can end up holding neither.
Why the controls are on the form at all
Insurers are not asking out of principle. They have paid out on thousands of incidents and they know which handful of practices separate a bad week from a business that does not reopen.
Multi-factor authentication stops the stolen password, which is how most break-ins start. A tested backup is the difference between restoring on Tuesday and negotiating with somebody who has your files. Patching closes the holes that are already public knowledge. Training is the only control that works on the one attack that targets a person rather than a machine.
The list is short because it had to be. It is what actually moves the number.
Read your own answers before somebody else does
Take the application out and go through it line by line, treating every yes as a claim somebody will test.
Who can prove the backup was restored, and when. Which accounts have the second step turned on, including the ones belonging to people who left. When the last update actually ran on the machine in the corner that nobody logs into.
Where an answer has drifted away from the truth, you have found something worth fixing, and you have found it in a quiet week rather than on the worst day of the year.
The old way is buying the policy and filing it. The new way is reading it as a specification and closing the gap between what it says and what is true.
Here is a five-minute move: find your most recent cyber insurance application and read the security questions only. If any answer makes you pause, that pause is the finding.
👉 New to Borked PC? Start by filling out our quick Right Fit Questionnaire to see if Borked PC could be the right IT and Cybersecurity Partner for you.
📞 Or schedule a free 15-minute call at a time that works for you: Book a call
Prefer to talk now? Give us a call at (610) 599-6195.