A Boca Raton accounting firm sat down last month to renew its cyber policy, the same policy it had carried for three years without incident. The renewal questionnaire looked familiar. The owner checked the same boxes she'd checked before: yes to multi-factor authentication, yes to endpoint protection, yes to backups. The application went in. Two weeks later, the underwriter came back asking for screenshots, configuration exports, and a signed attestation from whoever manages the network. The firm didn't have most of it. The renewal stalled, the premium quote came back 40 percent higher than expected, and the owner spent a week scrambling to produce documentation that should have already existed.
That scenario is playing out across Palm Beach County right now. Cyber insurance renewal has stopped being a paperwork exercise and started being a technical audit, and the businesses getting caught off guard aren't the ones with weak security. They're the ones who assumed a "yes" answer was still enough.
The Questionnaire Changed Before Most Businesses Noticed
For years, cyber insurance applications worked on the honor system. A business owner or office manager filled out a form, checked some boxes, and the policy was issued. Underwriters took the answers at face value because verifying them was expensive and claims were still relatively rare.
That changed once ransomware claims and business email compromise losses started piling up. Carriers now cross-reference application answers against external scans, breach forensics from other policyholders, and, increasingly, direct requests for proof: exported reports from your MFA provider, EDR dashboard screenshots, backup restore logs with dates on them. A verbal or checkbox "yes" no longer closes the file.
If your business is coming up on renewal, the questions themselves are worth walking through one at a time, because the failure points are consistent across almost every SMB we work with in Boca Raton.
"MFA Enforced" Has to Mean Everywhere, Not Just the VPN
Nearly every carrier now asks some version of: Is multi-factor authentication enforced on remote access, email, and privileged or administrative accounts? Most businesses answer yes because they turned on MFA for their VPN years ago and never revisited it.
The gap shows up in email and admin accounts, the two places attackers actually go first. A firm can have MFA locked down on remote desktop access while leaving Microsoft 365 logins and domain admin accounts wide open, and that's a "no" on the questionnaire even though the business believes it qualifies for a "yes."
This distinction has already ended up in court. In Travelers Property Casualty Company of America v. International Control Services, the insurer moved to rescind a policy after a ransomware attack revealed that MFA had been applied to the firewall but not to the server environment the application described. Insurance Journal reported that Travelers and the insured ultimately agreed to void the policy entirely, meaning the business absorbed the ransomware loss with no coverage. The misrepresentation wasn't intentional. It didn't matter.
Antivirus Isn't EDR, and Underwriters Know the Difference
A lot of Boca Raton businesses answer "yes, we have endpoint protection" while running consumer-grade or legacy antivirus that hasn't been updated in its detection approach in a decade. Carriers now specifically ask about endpoint detection and response, a category of tool that behaves differently: it watches for suspicious activity in real time and can isolate a compromised device automatically, rather than just matching files against a known-malware list.
The mismatch usually isn't intentional deception. It's that whoever fills out the questionnaire doesn't know the technical difference between what's installed and what the question is actually asking. That's exactly the kind of gap a cybersecurity risk assessment is built to catch before the insurer catches it for you.
A Backup You Haven't Restored Is a Guess, Not a Backup
Backup questions on renewal forms have gotten specific. Carriers don't just ask whether backups exist. They ask whether backups are isolated from the production network, whether they're immutable (meaning ransomware can't encrypt or delete them), and whether a restore has actually been tested and dated recently.
This is where a lot of businesses get tripped up, because the backup job has been running successfully for years, which feels like proof it works. A completed backup job and a verified, restorable backup are not the same thing. If your IT provider can't hand you a dated restore-test log, that's a real answer to give your broker before renewal, not something to guess at on the form.
An Untested Incident Response Plan Is Just a Document
Most SMBs either have no written incident response plan or have one that was drafted once, filed away, and never looked at again. Carriers increasingly want to know whether the plan has been tested, often through a tabletop exercise where key staff walk through a simulated incident and confirm who does what.
A plan that exists only as a PDF nobody has read since it was written tends to fail in practice exactly when it matters most, and it also increasingly fails to satisfy underwriting requirements on its own.
Security Awareness Training Needs a Paper Trail
"Do you provide cybersecurity training?" is on nearly every renewal questionnaire now, and the honest answer for a lot of professional services firms is that they send an occasional email reminder about phishing and call it training. Carriers want documented completion records, ideally with a training platform that tracks who completed what and when.
Given that phishing and credential theft remain the entry point for the majority of SMB breaches, this isn't a box carriers are checking arbitrarily. Verizon's 2025 Data Breach Investigations Report found that ransomware was present in 88 percent of confirmed breaches at small and mid-sized businesses, compared to 39 percent at larger enterprises, a gap driven in large part by weaker layered defenses and less consistent staff training at smaller organizations.
Email Security Controls Get Checked in Detail, Not Just Named
Questions about email security used to be a single line item. Now they break down into specifics: is SPF, DKIM, and DMARC configured and enforced (not just set to monitor mode), and is there an out-of-band verification step for wire transfer requests. A firm handling client trust funds or real estate closings, common in Boca Raton, is exactly the profile carriers scrutinize hardest here, because business email compromise against exactly this kind of business has produced some of the largest claims in the market.
Who Signs the Application Matters as Much as What It Says
The person who signs a cyber insurance application is usually the owner, CFO, or office manager, not the person who actually knows what's running on the network. That gap is precisely what turned the Travelers case into a cautionary tale for every policyholder afterward: courts have treated a signature on the application as a fully informed attestation, regardless of whether the signer personally understood the technical reality underneath it.
Before signing anything at renewal, it's worth having whoever manages your IT environment, internal or outsourced, review the questionnaire line by line against what's actually deployed.
What to Do Before Your Renewal Lands on Your Desk
The businesses that sail through renewal aren't the ones with the biggest security budgets. They're the ones who know exactly what they can prove before the underwriter asks. That starts with an honest cybersecurity risk assessment that maps your actual controls against what carriers are asking for, and it's a big part of why we built our Cybersecurity Risk Report for South Florida SMBs, which breaks down exactly where local businesses tend to fall short on insurability.
QuestingHound has spent 25 years supporting Boca Raton businesses, particularly law firms, accounting practices, and other organizations handling sensitive client data where a denied claim isn't just a financial hit but a liability and reputational problem. Our cybersecurity services cover the specific controls carriers scrutinize most, including email security and documented security awareness training, and they're delivered alongside full managed IT services so the same team that identifies a gap is the one that closes it.
If your renewal is coming up and you're not certain your answers would hold up to a documentation request, that's worth finding out now rather than during a claim. We offer complimentary consultations to walk through exactly where your business stands.
John Boden
John brings over 25 years of hands-on IT experience to every client relationship and has personally overseen hundreds of technology assessments across Broward and Palm Beach County. His approach is built on accountability — when QuestingHound makes a mistake, they own it — and on the belief that trust is the foundation of any useful IT relationship.
