Cyber insurance claims are most often reduced or denied not because of what happened during the incident, but because of what was written on the application months earlier. When a loss triggers a forensic review, the carrier reads the application back against the environment as it actually was on the signing date. An answer that was optimistic, stale, or scoped more broadly than reality becomes a material misrepresentation, and a material misrepresentation can void the policy from inception rather than merely reduce the payout.
The gap is rarely deliberate. Someone answered yes to MFA because MFA was on, and nobody checked which systems it covered.
What Does Rescission Actually Mean?
Denial reduces or refuses one claim. Rescission unwinds the policy as if it never existed, returns the premium, and leaves every claim under it uncovered, including ones already paid.
The reference case is Travelers v. International Control Services. Travelers filed in the U.S. District Court for the Central District of Illinois in July 2022, alleging that ICS had represented on its application that MFA protected administrative access when, by the insurer's account, MFA protected only the firewall and not the server hit by ransomware. The parties stipulated to a judgment, and on 26 August 2022 the court rescinded the CyberRisk Tech policy and declared it null and void from inception. No trial on the merits of the breach itself. The dispute was entirely about a sentence on a form.
Read the mechanism, not the headline: the carrier did not argue the security was inadequate. It argued the description of the security was inaccurate.
Which Answers Get Rechecked First?
After a loss, the forensic and coverage teams work backwards from the intrusion path to the application question that covers it. The questions closest to the attack chain get read first.
| What the application asked | What the review reads | The usual gap |
|---|---|---|
| Is MFA enforced for administrative access | Conditional Access policies, their assignments, and sign-in logs on the breach date | Enforcement covered users but not service or admin paths |
| Is MFA enforced for remote access and email | Policy scope against the actual VPN, RDP, and legacy auth surfaces | Legacy authentication left open as a migration exception |
| Are backups immutable and segregated | Immutability policy state, lock window, and who held write access | The backup admin was also a domain admin |
| Do you have EDR deployed across endpoints | Deployment coverage counts per device inventory | "Deployed" meant licensed, not installed everywhere |
| Is privileged access limited and reviewed | Standing role assignments and the date of the last review | Permanent Global Admins nobody had counted |
| Are security patches applied within N days | Patch state of the exploited system on the incident date | The one exception the policy allowed for a legacy app |
Every row is a fact that could have been read from the tenant before the form was signed. Where each one lives in Microsoft 365, Entra ID, and Azure is mapped in proving cyber insurance answers.
Why Do True Answers Go Bad After Signing?
Three patterns account for most of it.
Scope drift. The answer described the intended standard, and the environment carried exceptions the answerer never saw. Conditional Access exclusion groups that survived a migration are the classic version.
Time drift. The answer was true in March and false by November. A new service principal with a client secret, an admin added for a project, or a Conditional Access exclusion opened for a vendor all move quietly between renewals.
Source drift. The answer came from a policy document rather than the systems. The policy said what should be true. Nobody read what was true.
What Makes an Answer Defensible?
An answer survives a post-incident review when it carries three things: a scope, an artifact, and a date.
"MFA is enforced" is an opinion. "MFA enforced for all 14 privileged accounts, with two documented break-glass accounts excluded by design and monitored by alert, read from Entra ID on 3 September 2026" is a representation you can stand behind, because it names the exceptions before the carrier finds them.
Qualifying an answer is not weakness. Carriers price known exceptions. They rescind over undisclosed ones. The same principle drives what SOC 2 auditors test: the claim and the artifact behind it have to match.
What Should You Do Before the Next Renewal?
Pull last year's completed application. For each answer, decide whether it is verifiable from the environment, partly verifiable, or attested. Then read the verifiable ones from the systems today rather than from memory, and note the date on each. The count you end with, answers you can prove today over answers you gave, is your insurance posture, and it moves independently of any benchmark score.
Rescan on a schedule after you sign, so drift lands in a ticket queue instead of a claim file.
SecValley scans Microsoft 365, Entra ID, and Azure read-only and reports dated findings, including checks it could not read, which are reported as unanswered and never as passed. Insurance Posture runs on the same scans and maps them to the carrier question set. The public question library is at insuranceposture.com/questions.
The premium is the small number on the policy. The limit is the large one. An answer nobody verified puts the large one at risk to save an afternoon.
SecValley is a security scanning and compliance platform, not an insurance broker, agent, or carrier. Nothing here is insurance, legal, or coverage advice. Policy wording, application questions, and the consequences of a misstatement vary by carrier, by policy, and by state. Talk to your broker and your counsel about your own program.
Frequently Asked Questions
Can a cyber insurance policy be voided over one wrong application answer?
Yes, if the answer was material to the underwriting decision. In Travelers v. International Control Services the court rescinded the policy from inception after the insurer alleged the applicant had overstated where MFA was enforced. Materiality, not intent, is the test most policies turn on.
Is the claim denied because security was weak, or because the answer was wrong?
These are separate grounds. Weak security generally does not void coverage, because insuring imperfect environments is the product. An inaccurate description of that security is a misrepresentation, and misrepresentation can unwind the contract entirely.
Who is responsible for the accuracy of the application, the broker or the insured?
The insured signs it. Applications are typically countersigned by both an executive and the person responsible for network and information security, which is precisely why the technical answers need to come from the systems rather than from a policy document.
How often should application answers be revalidated after binding?
Quarterly is the practical cadence, and before every renewal at minimum. Privileged accounts, Conditional Access exclusions, and backup configurations all change between renewals, and an answer that lapses after submission is what a post-incident review is built to surface.
