Cyber Insurance in Australia: What Your Broker Won’t Tell You
A no-nonsense guide to getting the cover you need — and actually being able to claim on it
Published by All IT Services | March 2026
You’ve got cyber insurance. Great. Will it actually pay out?
Cyber insurance has gone from a niche product to a boardroom necessity in the space of about five years. If you’re running a business in Australia with any kind of digital footprint — which, in 2026, means every business — your broker has almost certainly raised it with you.
And you’ve probably bought a policy. Good. But here’s the question nobody seems to ask until it’s too late: if you suffer a cyber incident tomorrow, will your insurer actually pay the claim?
The answer depends entirely on whether your business meets the security controls your policy requires. And based on what we see across Sydney businesses every week, a worrying number wouldn’t.
The cyber insurance market in Australia has tightened significantly
The days of filling in a one-page questionnaire and getting a cyber policy are gone. Following a wave of ransomware claims in 2021–2023, Australian insurers fundamentally changed their approach. Premiums have increased. Underwriting requirements have become more granular. And insurers are now actively verifying that the security controls businesses claim to have in place are actually implemented and maintained.
What insurers are actually asking in 2026
Multi-factor authentication (MFA)
This is the single most scrutinised control. Insurers want MFA enforced — not just available — on all remote access, all email accounts, all privileged/administrator accounts, and all cloud platforms. If MFA wasn’t enforced on a compromised admin account, your claim is at serious risk of denial.
Endpoint detection and response (EDR)
Traditional antivirus is no longer sufficient. Underwriters want an EDR solution — products like CrowdStrike, SentinelOne, Microsoft Defender for Endpoint (P2), or Sophos Intercept X.
Backup strategy
Insurers want details: frequency, testing, offline or immutable copies, and defined recovery timeframes. The focus on immutable backups has intensified following incidents where ransomware operators specifically targeted backup systems.
Patching cadence
The ACSC recommends patching critical vulnerabilities within 48 hours. Insurers are increasingly aligned with this expectation, particularly for internet-facing systems.
Security awareness training
Most insurers ask whether staff receive regular cybersecurity awareness training, including phishing simulation.
Incident response plan
Do you have a documented incident response plan? Has it been tested? These questions are now standard on most applications.
What gets claims denied
Misrepresentation on the application
If you stated MFA was enforced on all remote access but the forensic investigation reveals it wasn’t, your insurer may void the policy or deny the claim on grounds of material misrepresentation. This is the most common and most devastating reason for claim denial.
Failure to maintain stated controls
Some policies include ongoing obligations. If you had EDR deployed when you applied but let the licence lapse six months later, you may have a gap in coverage.
Exclusions for known vulnerabilities
Many policies exclude losses from vulnerabilities that had a patch available for more than 30 or 60 days.
War and state-sponsored attack exclusions
Most cyber policies include exclusions for acts of war or state-sponsored attacks. Lloyd’s of London issued guidance requiring clearer exclusion language following the NotPetya attacks.
How to reduce your premiums
Align with the ACSC Essential Eight
Achieving Maturity Level 2 across the Essential Eight controls satisfies most cyber insurance applications and demonstrates a credible security posture.
Get a pre-renewal security assessment
Before your next renewal, have an independent assessment against the controls your insurer asks about. This ensures your application is accurate and identifies gaps you can close.
Document everything
An incident response plan, a backup testing log, a patching schedule, a record of security awareness training — these are evidence that give your broker ammunition to negotiate better terms.
Work with a broker who understands cyber
Not all brokers have deep expertise in cyber insurance. Look for one who specialises or works with a specialist underwriter.
A practical checklist for your next renewal
Before signing your next application, make sure you can honestly answer “yes” to these:
- Is MFA enforced on all email, remote access, and admin accounts?
- Do you have EDR deployed across all endpoints?
- Are backups running daily, tested regularly, with at least one offline/immutable copy?
- Are critical patches applied within 48 hours for internet-facing systems?
- Do staff receive regular security awareness training?
- Do you have a documented and tested incident response plan?
- Are firewall, VPN, and email gateway appliances running current firmware?
- Are administrative privileges restricted to only those who need them?
The bottom line
Cyber insurance is a critical part of your risk management strategy. But it’s not a substitute for proper security controls. The businesses that get the most value treat the application process as a genuine security health check, not a box-ticking exercise.
Don’t wait until you need to make a claim to find out whether your policy will pay.
Let’s make sure you’re covered
All IT Services works with Sydney businesses to align their security posture with cyber insurance requirements. We can run a pre-renewal assessment, help close gaps, and give you documentation your broker needs.
Reach out to Tom Buckley — call (02) 8073 4848 or send Tom an email. We’ll give you a clear picture of where you stand, no obligation.
Sources and references:
– Australian Cyber Security Centre — Essential Eight Maturity Model (cyber.gov.au)
– Australian Prudential Regulation Authority — CPS 234 (apra.gov.au)
– Office of the Australian Information Commissioner — NDB Scheme (oaic.gov.au)
– Insurance Council of Australia (insurancecouncil.com.au)
– Lloyd’s of London — State-backed cyber attack exclusion guidance (lloyds.com)
– Australian Financial Complaints Authority (afca.org.au)