When two similar companies receive quotes that differ substantially, the gap is rarely explained by revenue or industry alone. It comes from the way insurers price cyber risk: the process by which an underwriter converts answers about your environment into a probability of loss and an estimate of the maximum cost. Understanding that process changes what you fix first and what you document.
Underwriting has matured. Early policies were priced on broad industry averages with little differentiation between accounts. Today most carriers combine a structured questionnaire, external scanning of your public footprint, and sometimes a direct conversation with a security leader. The result rewards specificity and punishes vagueness.
This guide explains how the assessment works, which controls carry the most weight in the final number, and which documents to have ready before you submit.
How the Underwriting Model Works
Most carriers build a price from four inputs: the likelihood that an incident occurs, the probable financial severity if it does, the uncertainty surrounding both estimates, and the cost of capital the insurer must hold against the risk. Nearly every question on the application maps back to one of those four.
Likelihood is driven by your attack surface and the maturity of your controls. Severity depends on how much the business depends on the systems affected — a manufacturer that halts a production line has a very different interruption profile from an advisory firm that can keep working from laptops. Uncertainty is why incomplete answers cost money: an underwriter who cannot verify a claim must price the worse case.
Why External Scanning Changes the Conversation
Before quoting, many carriers scan your public-facing infrastructure for exposed services, outdated certificates, and known vulnerabilities. Discrepancies between what you declared and what the scan shows raise questions and, frequently, the premium. Review your own external footprint before you apply so there are no surprises.
Exposure Questions That Decide Everything
Certain answers carry disproportionate weight. Expect detailed questions about:
- Annual revenue and the number of records containing personal, financial, or health data.
- Whether operations stop entirely if core systems are unavailable, and how long you could tolerate an outage.
- Third parties with access to your network, including service providers, contractors, and integration partners.
- Regulatory exposure, including the jurisdictions whose residents’ data you hold.
- Prior incidents, claims, and extortion attempts, whether or not they were formally reported.
- Whether you depend on a single data center, a single hosting region, or a single critical vendor.
Answering “we think so” to any of these signals uncertainty, and uncertainty is priced in. Specific, verifiable answers are worth more than confident ones.
Controls That Carry the Most Weight
Not every control moves the needle equally. In most underwriting models a small group of measures accounts for the bulk of the difference.
Phishing-Resistant Authentication
Multi-factor authentication earns credit, but the strength of the method matters. Approaches resistant to interception and relay attacks are weighted more favorably than one-time codes delivered by text message. Applying strong authentication to remote access, email, and administrative consoles covers the entry points attackers use most.
Backup Isolation and Tested Recovery
Underwriters want to know whether a destructive attack can reach your backups and whether you have actually restored from them. A dated restore test carries more weight than a long feature list from a backup product.
Segmentation, Privileged Access, and Detection
Networks that permit unrestricted lateral movement turn a single compromised laptop into an enterprise incident. Evidence of segmentation between user, server, and backup environments, combined with time-bound administrative access, is a frequent reason for a better quote. Continuous monitoring with centralized logging and a defined escalation path lowers expected cost by shortening dwell time — an untested response plan is treated as an intention, while an exercised one is treated as a control.
Documents Underwriters Typically Request
Prepare these before you start the submission, not after a follow-up email arrives:
- A written information security policy with a version date and a named owner.
- An asset inventory covering systems, applications, and data stores.
- Evidence of authentication configuration across remote access and privileged accounts.
- A description of backup architecture and results of the most recent restore test.
- An incident response plan, plus records of any tabletop exercise or live test.
- Security awareness training completion records.
- Vulnerability management output showing scan cadence and remediation timelines.
- A list of vendors with network or data access and how each is assessed.
Consistency across these documents matters. If the policy states a quarterly scan cadence and the reports show an annual one, the inconsistency is what the underwriter remembers.
What Weakens an Otherwise Strong Submission
Well-protected organizations still undermine themselves through presentation. Common problems include blanket affirmative answers with no evidence, missing documentation for a control the team genuinely operates, contradictions between the questionnaire and the attached policy, and silence about an old incident that later surfaces during claims review.
Overstating a control’s reach is equally damaging. Claiming that strong authentication covers all systems when a legacy application still uses static credentials creates a warranty exposure far larger than the discount the overstatement earned.
Frequently Asked Questions
Do better controls always produce a lower premium?
Not automatically. Controls influence the underwriter’s view of likelihood, but severity, industry, and the limits you request also shape the final figure. Strong controls generally improve terms and widen the range of carriers willing to quote at all.
How much detail should we provide?
Enough that every material claim can be verified. Brief, specific answers supported by dated documents persuade more effectively than long narrative descriptions with nothing attached.
Can a quote be negotiated?
Yes. Limits, retentions, waiting periods, and coverage breadth are all variables. Discussing trade-offs with a broker is often more productive than pressing for a premium reduction in isolation.
How far ahead of renewal should we start?
Several months is realistic. Controls take time to implement and document, and evidence assembled at the last minute tends to be technically true but poorly supported.
Pricing cyber risk is an exercise in evidence. Insurers are not evaluating your intentions; they are evaluating what your environment demonstrably does today. The organizations that fare best treat the underwriting questionnaire as a diagnostic instrument — a structured reason to close gaps, and then to prove that they are closed.
This article is general information only and is not professional, legal, or insurance advice. Underwriting criteria differ by carrier, jurisdiction, and account. Consult a qualified broker or advisor for guidance specific to your situation.