Cyber Incident History

Why it matters for underwriting

Prior cyber incidents are a strong leading indicator of control maturity, because a breach that recurs despite an organisation’s stated defences signals that remediation was incomplete or that the underlying vulnerability class remains unaddressed. Underwriters review incident type (ransomware, business email compromise, third-party vendor breach, unauthorised access), the systems and data affected, the time to detection and containment, and the ultimate cost, since these details reveal far more about an applicant’s actual security posture than a static questionnaire on controls alone.

Capturing the attribute and evidence

Cyber proposal forms ask applicants to list all material incidents and breaches over the preceding three years, together with incident type, affected systems, cost and any regulatory involvement. Underwriters corroborate this with the incident response or forensic investigation report prepared after the event, a cyber loss run from the current or prior insurer where cover already existed, and, if applicable, correspondence with a data protection authority documenting the notification and any resulting investigation. Recurrence of a similar incident type after remediation is scrutinised particularly closely.

Effect on coverage, premium and conditions

A clean incident history combined with mature controls supports competitive premium rates and full limits. A disclosed incident history, especially unremediated recurring incidents, commonly leads to higher premiums, increased retentions, sublimits or exclusions for the specific vulnerability class involved, mandatory security warranties as a condition of cover, or, where controls remain materially deficient, a decline to offer terms.

Mitigation measures

Insurers typically require documented closure of the root cause identified in the post-incident forensic report, implementation of multi-factor authentication, endpoint detection and response, and offline backups where these were missing, and a follow-up penetration test or security assessment confirming the gap has been closed before renewal terms are finalised.