Insurers are no longer buying good intentions. In 2026 the cyber market remains competitive for well‑prepared organisations, but underwriters have sharpened technical standards and underwriting warranties: a claim is only as deliverable as the evidence you can produce. Boards and commercial leads must treat renewal as an assurance exercise, not an administrative tick‑box — and start now if renewal is due within 6–12 months.
Why this matters now
Three market facts change the renewal conversation in 2026. First, underwriters have standardised renewal questionnaires and expect demonstrable controls as a condition of pricing or even eligibility. Second, the market remains broadly open and competitive, but insurers now treat inaccurate attestation as a policy‑voiding warranty. Third, UK regulatory and resilience programmes (from CAF v4.0 through the Cyber Security and Resilience Bill) have raised expectations for evidence, reporting and third‑party assurance. Together these trends mean boards must prioritise verifiable evidence over promises — and convert security activity into documentary proof before the renewal submission.
What underwriters now expect (the core evidence list)
Insurers vary in wording, but the practical evidence they want is consistent. Prepare to show:
- Identity and access controls: organisation‑wide use of multi‑factor authentication (MFA) for all privileged and remote access, with an inventory of exceptions and compensating controls; privileged‑access lifecycle evidence (joiner/mover/leaver).
- Patch and vulnerability management: a timestamped inventory of critical assets, recent patching cadence for high‑risk CVEs, and a documented exception register for deferred patches.
- Backup and recovery: tested backups with recent recovery test results, RPO/RTO metrics and evidence of offsite/immutable copies.
- Endpoint and detection: EDR/managed detection telemetry, alerting thresholds, and a recent mean time to detect/contain metric or table showing improvement actions.
- Incident response: an up‑to‑date incident response plan, evidence of tabletop exercises in the last 12 months, and a post‑incident lessons log.
- Third‑party and cloud risk: supplier mapping for critical services, recent supplier assurance questionnaires, and contractual SLAs with remedies and resolution planning where supplier failure would materially harm operations.
- Cyber Essentials / certifications where relevant: copies of current certificates and associated scope statements.
Practical sources corroborate this checklist: market reports and underwriting guidance published in 2026 emphasise certifiable controls and documentary proof as the key differentiator between quoted and withdrawn offers.
A board‑level 90‑day plan (what to do now)
Day 0: Set the governance line. The board must delegate a senior responsible owner (SRO) for the renewal evidence pack. That person reports weekly to the Audit/Risk committee and owns completion of the deliverables listed below.
Days 1–14: Evidence triage. Ask for the insurer’s renewal questionnaire and run a rapid gap analysis. Prioritise items with binary evidence (MFA logs, backup test report, certificate scans). Produce a short red/amber/green dashboard and a proposed remediation backlog priced for 30/60/90 days.
Days 15–45: Close the critical gaps. Typical actions in this window include closing outstanding critical patches (or documenting justified exceptions), running at least one scripted backup recovery test for a top‑10 business asset, and completing a tabletop incident exercise with an evidence report.
Days 46–90: Harden narrative and contracts. Finalise a concise evidence pack (see next section), ensure supplier artefacts are attached for critical services, and confirm any contractual warranties with insurers or brokers are aligned to capability (avoid over‑claiming).
Board brief: present the evidence pack, the residual risk dashboard, and a funding request (if remediation is needed) at day 90 to secure sign‑off before the renewal submission window.
The renewal evidence pack: contents and format
Design the pack for a busy underwriter and a non‑technical board member. Include:
1) Executive summary (1 page): renewal date, SRO, high‑level risk posture, and the single page change since last renewal.
2) Controls index (1 page): a table mapping insurer questions to evidence files (file names, timestamps, owner).
3) Technical evidence (folder): MFA logs, patch reports, backup test report (with snapshots), EDR summary and selected screenshots, incident plan and a dated tabletop report.
4) Supplier assurance folder: critical supplier register, latest third‑party questionnaires, contractual clauses covering continuity and sub‑contracting, and resolution planning notes for suppliers above a materiality threshold.
5) Governance artefacts: policy sign‑offs, training completion rates, and the board‑level cyber risk appetite statement.
Make the pack searchable (pdfs with bookmarks), dated and signed by the SRO. Insurers and brokers repeatedly ask for straightforward, verifiable files — avoid long unreferenced statements of intent.
Commercial and contractual actions to protect cover
Link underwriting warranties and procurement posture. Where contracts with strategic suppliers include indemnities or information obligations tied to security, ensure they are realistic and evidenceable at renewal. When procurement pipelines are active, make sure new contracts include rights to audit, data‑access clauses needed for insurer due diligence, and termination/transition provisions proportionate to supplier criticality.
If remediation will take longer than the insurer’s renewal timetable, negotiate a conditional renewal with explicit timelines and a clear remediation plan attached to the policy schedule. Use the broker to translate technical remediation into an insurer‑readable plan and avoid unilateral, unsupported attestation.
What boards should ask executive teams this week
1) Has the renewal questionnaire been shared with the SRO and broker? If not, get it now. 2) Can we produce timestamped evidence for MFA, backups and critical‑patch status within 14 days? 3) Which suppliers are material to continuity, and do we have recent assurance artefacts for them? 4) What is the residual risk if the insurer applies a conditional warranty or exclusions? 5) What is the proposed budget and procurement route for any urgent remediation?
These questions force a move from vague assurances to accountable evidence and (importantly) a funded plan if remediation is required.
Deliverables Antares would offer (commercial conversion examples)
A compact, underwriter‑ready evidence pack (executive brief + indexed files). A 90‑day remediation sprint to fix binary gaps (patches, backup tests, MFA exceptions). Supplier assurance reviews and contractual redlines for critical suppliers. And renewal negotiation support via the broker, translating technical remediation into insurer‑acceptable timelines and warranties.
In 2026, cyber renewal is an assurance exercise: insurers will judge cover on the evidence you can produce, not the policies you have.
Antares recommended actions
These are Antares's recommended first actions for organisations turning the issues in this article into practical governance and delivery.
- Appoint an SRO for renewal evidence and publish a 90‑day board reporting cadence this week.
- Run a triage against the insurer questionnaire and produce a red/amber/green dashboard within 10 working days.
- Prioritise binary evidence: MFA logs, a verified backup recovery test, critical patching reports and one tabletop exercise report.
- Map critical suppliers, attach latest assurance artefacts to the evidence pack, and insert audit and resolution rights into new contracts.
- Use the broker early: convert technical remediation into insurer‑acceptable conditional wording rather than overstating capability.
