Michael Darlan
The six things that actually decide whether a claim gets paid, and two real cases that show how fast they add up.
Ask someone why a cyber insurance claim gets denied, and most people guess wrong. They picture a carrier hunting for some clever exclusion tied to the specific attack, or an obscure coverage gap nobody thought to check.
The real answer is less dramatic and more useful.
Claims get denied because of a gap between what a company told its insurer and what the insurer can verify after something goes wrong. It’s all about the paperwork and whether it held up.
Before understanding why claims are denied, here’s why they’re being filed in the first place.
According to NAIC’s 2025 Report on the Cybersecurity Insurance Market, insurers closed 38,496 US cyber claims in 2024. Only 9,941 of them closed with a payment. Break that down by policy type, and it gets worse for exactly the companies who’d assume they’re the least exposed.
Let me paint the picture:
- Excess policies, the additional layer of coverage companies buy on top of a primary policy once they’ve outgrown the base limit, closed without payment 95% of the time in 2024.
- More than 20 claims closed empty for every 1 that paid out.
- Primary policies were unpaid 65% of the time. Endorsement policies, 69%.
The companies buying excess coverage tend to be the ones with more mature security programs and bigger limits to protect. They’re also the group with the worst outcomes when a claim actually closes.
The six things that actually decide whether a claim gets paid
Between what shows up in NAIC’s data and what plays out in actual case law, the reasons cluster into six recurring patterns. I see all six from the technical side, usually after the fact, when a customer is trying to figure out what happened.
1. Misrepresentation. The application said a control existed. It didn’t, at least not the way it was described. An endpoint without EDR that got listed as covered. A server that skipped the deployment.
2. Failure to maintain. The control was real when the policy was signed and gone by the time it mattered. New assets get added, a rollout stalls halfway through, and nobody goes back to update the file.
3. Late notice. Every policy has a required window for telling the carrier something happened. Miss it, and the carrier doesn’t need any other reason.
4. Policy exclusions. War and state-backed activity are the common ones, and they apply even to companies that don’t think of themselves as a likely target.
5. Undisclosed prior incidents. Insurers audit. If something happened before the policy started and it wasn’t disclosed, it tends to surface eventually, and the timing of that discovery is never good for the policyholder.
6. Insufficient documentation. The control existed. Nobody can produce proof of it on the day it’s asked for. This is the one I see most often, because it’s the easiest one to believe you’ve already handled.
Coalition’s 2025 Cyber Claims Report found that 82% of denied claims involved MFA that wasn’t fully enforced across the environment, not MFA that was entirely absent. Somebody had MFA somewhere, just not everywhere the policy assumed it was.
Two cases that show how fast a documentation gap gets expensive
In February 2024, a ransomware attack took down roughly 80% of the City of Hamilton, Ontario’s network.
The city refused to pay the ransom and rebuilt instead, at a cost that’s run past $18 million. In 2025, the city disclosed that its insurer had denied $5 million of the resulting claim, citing the absence of multi-factor authentication as the policy’s stated root-cause exclusion.
Here’s the part that usually gets left out when this case gets told as a clean cautionary tale: Hamilton wasn’t ignoring MFA. City staff knew about the requirement in the fall of 2022 and had started a phased rollout the following year, department by department.
The attack hit in February 2024, before that rollout reached every department. The insurer’s position wasn’t “you never tried.” It was “you agreed to have this everywhere, and on the day it mattered, you didn’t.”
That’s the distinction that makes this case worth knowing. A control in progress reads the same to a carrier as a control that was never started.
The second case is smaller in dollar terms and sharper in what it proves.
In 2022, Travelers sued its own policyholder, International Control Services (ICS), to rescind a $1 million cyber policy after ICS suffered a ransomware attack. Travelers alleged ICS had represented enterprise-wide MFA on its application. MFA existed in exactly one place: the firewall. ICS agreed to the rescission rather than fight it.
The policy was voided from inception, as if it had never existed.
The detail worth sitting with here is what didn’t matter: intent. Legal analysis of the case is consistent that a misrepresentation doesn’t need to be deliberate to justify rescission under the majority rule in US jurisdictions.
Nobody accused ICS of lying on purpose. The gap between what was attested and what was actually deployed was enough on its own.
The real fix is proof
Neither of those companies got hurt by a weak security program in the abstract. They got hurt by the distance between a statement on a form and what a technical review would have found if someone had checked earlier.
That distance is a technical problem before it’s a paperwork problem.
It’s one thing to say MFA is enforced. It’s another to be able to show the compliance and configuration page inside your identity provider, on demand, for the exact accounts a carrier is asking about. It’s one thing to say you’re patching. It’s another to have a risk register and a patch management solution that proves it.
Saying and showing are different disciplines, and only one of them holds up when it’s tested.
We put together a free Cyber Insurance Requirement Checklist that walks through exactly what a carrier checks against each of the six factors above, access and identity, endpoints, backups, patching, so you can see where your documentation and your actual environment have quietly drifted apart, before a carrier finds that gap for you at the worst possible time.
Quick answers
Why do most cyber insurance claims get denied? Rarely because of the attack itself. Most denials trace back to one of six patterns: misrepresentation, failure to maintain a control, late notice to the carrier, a policy exclusion, an undisclosed prior incident, or insufficient documentation of a control that did exist.
What’s the most common reason MFA causes a claim denial? Partial deployment, not a missing tool. Coalition’s 2025 Cyber Claims Report found that 82% of denials involved MFA that existed somewhere in the environment but wasn’t enforced everywhere the policy assumed it was.
Does intent matter if a company misrepresents its security controls? Under the majority rule in US jurisdictions, no. As Travelers v. ICS showed, a misrepresentation can justify rescinding a policy whether it was intentional, negligent, or an honest mistake. What matters is whether the statement was false and material to the risk.
Written by Michael Darlan, Cybersecurity Specialist at OneAxiom
Edited by Julia Araujo, Marketing Manager at OneAxiom
