Cyber Insurance Claims Are Being Denied – And It's Your Fault

Written By Noel Bradford

Insurance Isn’t Magic — It’s a Contract

Cyber insurance feels like a safety net. You get hit with ransomware, your business halts, and in theory, your insurer steps in to soften the blow. But here’s the truth: cyber insurance is not a get-out-of-jail-free card. And right now, more and more UK businesses are learning that the hard way.

Insurers are denying claims. Not one or two. Dozens. Hundreds. Some of them even have valid reasons — and others, well, they’re making them up as they go along. But either way, if your claim is denied, you're left holding the bag.

Let’s explore why cyber insurance is becoming harder to rely on — and what you can do to make sure your next claim doesn’t end in tears.

Why Are Claims Being Rejected?

There are three main culprits: poor security hygiene, vague policies, and a total failure to understand what’s actually required.

1. You Didn’t Do the Basics

If you’re breached and it turns out you haven’t patched your systems, didn’t enable MFA, or left RDP wide open to the world that’s not bad luck. That’s negligence.

Most insurers now require “reasonable cyber precautions.” If you fail to meet even basic standards like using supported software, patching, password management, or endpoint protection your claim can be tossed.

2. The Policy Wasn’t What You Thought It Was

Plenty of UK businesses think their cyber insurance covers everything from reputation damage to data restoration. Spoiler: most of it doesn’t.

Policies often have strict exclusions, low claim caps, and clauses written in the kind of language only a solicitor’s ghostwriter could love. If you didn’t get someone to read the fine print or worse, your broker didn’t understand it either you might be in for a nasty surprise.

3. You Didn’t Report Things Properly

Did you delay telling your insurer? Did you give them vague or inaccurate info? Did you fail to notify the ICO when required? Those things matter.

Claims are being rejected because the incident wasn’t reported quickly enough, or because the timeline you gave didn't match the technical evidence. If your comms are sloppy, your claim goes straight in the bin.

Cyber Essentials and Insurability

Let’s be blunt if you don’t have Cyber Essentials, some insurers won’t even touch you. If you don’t have Cyber Essentials Plus, they’ll give you laughable limits and even more exclusions.

Cyber Essentials is now table stakes. It's a way of proving you're not completely asleep at the wheel. And if you want higher cover, better terms, and less scrutiny at claim time? Get CE+ and keep it current.

Some insurers are even bundling insurance with compliance tooling which is a double-edged sword. Yes, you get help staying compliant, but if the tool shows you were out of compliance and you didn’t act? That’s logged. And used against you.

Where MSPs Get It Wrong

Many businesses rely on their IT providers or MSPs to sort “the cyber stuff.” But that’s where things get dicey.

I’ve seen MSPs tell clients they’re compliant when they aren’t. I’ve seen patching SLAs missed for months. I’ve seen backup systems that looked fine until someone actually tried to restore them.

If your MSP tells you everything’s covered, ask them to show you in writing what that includes. And have someone outside the MSP check it. Trust, but verify.

What You Should Be Doing Right Now

If you’ve got cyber insurance (or are shopping for it), here's your to-do list:

  • Review your policy. Know what’s covered, what’s excluded, and what’s required.

  • Patch everything. Especially anything public-facing.

  • Use MFA. Everywhere. No excuses.

  • Get Cyber Essentials Plus. And keep the certification current.

  • Audit your backups. Test restores. Document them.

  • Check your MSP’s work. Or get a second opinion.

  • Log and monitor. If you don’t know what’s happening, neither will your insurer.

Final Thoughts: Insurance Can Help But Only If You Earn It

Cyber insurance is useful if you understand what you’re buying and how to make it stick. But it won’t protect you from laziness, poor governance, or assumptions.

Treat your policy like a legally binding agreement (because it is). Match it with real-world action. And stop pretending that ticking the “yes” box on an application form is the same as building cyber resilience.

If you want cover that actually works, you have to be worth covering.

This isn’t scare tactics. It’s the new normal. The question is whether your business and your board are ready for it.


Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com
Previous

Why Ransomware Will Keep Winning Until Cybersecurity Becomes a Business Risk – Not a Tech Problem (Part 3/3)
Next

You’ve Got a Flood Plan, But No Cyber Plan? Here’s Why That’s a Business Killer