UK Cyber Insurance: What Insurers Expect in 2026

Cyber insurance has changed significantly over the past few years. The application forms are longer, the questions are more technical, and the requirements have shifted from “tell us about your security” to “prove it is in place.” If you are approaching renewal or thinking about cover for the first time, this is what UK insurers now expect, and what it typically costs.

Why insurers have raised the bar

Cyber insurance covers the financial consequences of incidents like data breaches, ransomware attacks, and business email compromise, things like recovery costs, regulatory fines, legal fees, and business interruption. Over the past few years, the size and frequency of claims has risen sharply, driven by increasingly sophisticated attacks and the availability of criminal tools that have made large-scale attacks accessible to far more threat actors than before.

Insurers have responded by being more selective about who they cover and at what price. If you leave obvious doors open, many will decline to cover you, or price the policy to reflect the risk. The good news is that the controls they are asking for are not unreasonable: they broadly match what good IT support practice recommends anyway.

What insurers now require

Multi-factor authentication (MFA)

MFA means that logging in requires something beyond just a password, a code sent to your phone, a prompt in an authenticator app, or a physical security key. UK insurers now expect MFA to be active on all administrator accounts, remote access systems such as VPN connections, and cloud services including Microsoft 365, Google Workspace, and accounting software. Failing to have it in place is often an automatic reason to refuse a claim or decline a policy altogether.

Endpoint detection and response (EDR)

Standard antivirus is no longer considered sufficient. EDR, endpoint detection and response, means security software that actively monitors devices for suspicious behaviour rather than simply scanning for known threats. ESET, which we deploy and manage across our client base, includes EDR capabilities that meet the technical requirements most UK insurers look for.

Immutable backups

Most businesses have some form of backup, but insurers now ask specifically about immutable or air-gapped copies, backups that cannot be altered, deleted, or encrypted even if an attacker gains full administrator access to your systems. A backup that lives on the same network as your live data provides far less protection than one that is logically or physically separated from it.

Cyber Essentials certification

Cyber Essentials is a UK government-backed scheme that tests an organisation against five core security controls: firewalls, secure configuration, access control, malware protection, and software update management. It is not a legal requirement for most private businesses, but it has become a significant factor in cyber insurance underwriting. Many insurers now treat it as a baseline condition for cover or offer meaningfully better terms to certified organisations. There is also an additional practical benefit for smaller businesses: any UK organisation with a turnover under £20 million receives £25,000 of cyber liability insurance free when they achieve Cyber Essentials certification through an IASME-accredited body.

What does cyber insurance cost?

Premiums vary considerably by turnover, the type of data you hold, your sector, and the controls you have in place. As a rough market guide, small businesses seeking around £500,000 of cover typically pay between £500 and £1,500 per year. Businesses with a turnover of £2 million to £10 million seeking £2 million of cover are more likely to be in the £3,500 to £9,000 range annually.

Holding Cyber Essentials or Cyber Essentials Plus certification typically reduces premiums by 10% to 25% with many UK insurers. That saving often more than covers the cost of achieving certification.

What to do next

If you are approaching renewal or exploring cover for the first time, the most useful thing you can do before speaking to a broker is work out what you actually have in place. Is MFA switched on for all cloud accounts? Do your backups include an immutable or offline copy? Have you audited user access recently to confirm that former employees and unused accounts have been removed?

Our IT security service can walk you through exactly that kind of review, and we can guide you through the Cyber Essentials certification process from initial assessment through to the certificate. If you are a Microsoft 365 business, our managed IT support service includes regular configuration reviews that typically identify and close exactly the gaps insurers are looking for. For businesses at the point of reviewing their broader IT strategy or preparing for a first cyber insurance application, our IT consulting service can also help you build a clear picture of where you stand.

If you would like to talk through your current position, get in touch or call 01452 701355 for a no-obligation conversation.