TL;DR
A real estate tech company had cyber insurance, then a breach, then a denied claim. The insurer pointed to a clause about "failure to maintain minimum security controls": missing MFA and outdated software had voided the coverage. The breach cost $35,000 out of pocket, and the $200/month policy covered none of it.
The False Security
When the founder of a growing real estate tech startup bought cyber insurance, he felt responsible. Smart, even. $200/month for $500,000 in coverage seemed like a fair deal, and if anything went wrong, insurance would handle it.
He didn't read the policy carefully. He skimmed it, saw "data breach coverage," and signed. Big mistake.
The Breach
An attacker gained access through a compromised employee password. Without MFA, one stolen credential was enough. They accessed customer data (property transaction records and client contact details) for about 48 hours before the team detected and stopped it.
It wasn't cheap:
- Legal consultation: $8,000
- Forensic investigation: $12,000
- Customer notification and credit monitoring: $10,000
- PR and crisis management: $5,000
Total: $35,000. The founder wasn't worried. He had insurance.
The Claim
He filed the claim, confident it would be covered. Three weeks later, he received a letter:
"After review, we have determined that your claim does not meet the conditions for coverage under your policy. Specifically, Section 4.2(c) requires maintenance of 'industry-standard security controls including multi-factor authentication on all administrative access.' Our investigation found that MFA was not enabled on the compromised account. Therefore, this claim is denied."
He read it three times. Then he called his lawyer.
The Policy Fine Print
The lawyer reviewed the policy. The insurer was right. Buried in the terms were requirements the founder had never noticed:
- MFA required on all administrative and privileged accounts
- Software updates must be applied within 30 days of release
- Annual security assessments must be documented
- Employee training must be conducted annually
The company met none of them. The policy they'd been paying for was void, in practice, from day one.
The painful truth: cyber insurance is a contract with conditions, and the conditions are baseline security. Miss them and the coverage disappears exactly when you need it.
Why Insurers Include These Clauses
At first, the founder was angry. It felt like the insurer was looking for excuses not to pay.
After talking to a broker, he understood their perspective. Without security requirements:
- Premiums would be much higher (think 10x)
- Anyone could buy a policy, ignore security entirely, and make breaches more common for everyone
The requirements aren't arbitrary. MFA alone would have stopped this breach. What the insurer was really saying: "We'll cover you if you take basic precautions. If you don't, you're choosing to be vulnerable."
They weren't wrong. The founder just didn't like hearing it.
What Went Wrong
1. Didn't Read the Policy
He signed without understanding the requirements. Section 4 spelled them out.
2. Assumed Insurance = Protection
He thought having insurance meant worrying less about security. It's the other way round: the insurance assumes the security is already there.
3. Never Verified Compliance
Even if he had read it, nobody was checking whether the company actually met the requirements, let alone tracking it.
What Changed
Actually Read Policies
The founder now reads every insurance policy completely. He highlights the conditions and maintains a checklist of requirements.
Security Requirements First
Before buying a new policy, the team reviews its security requirements and makes sure they already meet them, or can within weeks.
Document Everything
The company now documents its security measures: MFA enabled, software update logs, training records. If they ever file another claim, they'll have evidence of compliance.
Regular Compliance Checks
They review the insurance requirements every quarter, because policies get updated at renewal and nobody announces it.
The $35,000 lesson: cyber insurance pays out only when you've done the basics. Skip MFA and updates, and don't expect the policy to save you.
What security measures do cyber policies typically require?
Common requirements include: MFA on privileged accounts, regular software updates, endpoint protection, employee security training, regular backups, and documented security policies. Requirements vary by insurer and policy tier.
How can I verify I'm compliant with my policy?
Ask for the full policy document, not the summary. Look for sections titled "conditions," "requirements," or "warranties," turn every requirement into a checklist item, and check yourself against each one. Then write down the evidence.
Can I appeal a denied cyber insurance claim?
Yes, but success depends on the specifics. If you can prove compliance with the cited requirement, or if the requirement was ambiguous, you may have grounds. Consult with a lawyer experienced in insurance disputes.
Is cyber insurance worth it if there are so many conditions?
Yes, if you keep up the required measures, which you'd want anyway to prevent breaches. Treat the policy as a reason to keep security up, never a replacement for it.
Meet Your Requirements
Scan your app to verify you meet common security baselines.