Multi-factor authentication
Where MFA is enforced: email, remote access, admin accounts and outside IT providers. The control insurers ask about first.
Free · about 5 minutes · answers never leave your browser
Walk into renewal ready.
The 18 security questions cyber insurers actually ask, in plain English. Get a readiness score and a ranked fix list before you sign.
- No sign-up to get your score
- 18 questions from real insurer forms
- Printable report
Questions sourced from public application forms by
- At-Bay
- Admiral
- Hanover
- DUAL
- Tokio Marine HCC
- CRES
- + Marsh's 12 key controls
How it works
Three steps, about five minutes
No account, no install. Everything runs in your browser.
Answer 18 questions
Yes, Partly, No or Not sure. Each one explains the insurer's jargon and what a true "yes" requires.
Get your readiness score
A score out of 100, your gaps ranked by priority, and plain-English steps to fix each one.
Save it and set reminders
Print or save the report as a PDF, download it as text, and add 90/60/30-day renewal reminders to your calendar.
What insurers ask about
The controls every application keeps asking about
Each question is drawn from real ransomware supplements and cyber applications. Sources are listed on every report.
Backups
An offline or immutable copy, separate logins, encryption and a recent restore test.
Computers and access
EDR on every device, patching speed, unsupported systems, admin rights and Remote Desktop.
- EDR
- Patching
- Old systems
- Admin rights
- Remote Desktop
Email and payments
SPF, DKIM and DMARC, phishing training, and call-back checks on bank changes.
Plans and monitoring
A written, practiced incident plan and someone watching alerts around the clock.
Evidence to keep
What proof to save so you can back up every answer.
Why it matters
Your application answers count
From Arctic Wolf's 2025 survey of insurance professionals and organizations:
26%of initial cyber coverage rejections were put down to inadequate security controls.Arctic Wolf Cyber Insurance Outlook, via Insurance Journal, Sep 2025
17%of claim rejections involved a failure to disclose risk on the application.Arctic Wolf, via Insurance Journal, Sep 2025
56%of businesses that made a claim faced more scrutiny at renewal.Arctic Wolf, via Insurance Journal, Sep 2025
A real example: in 2022 Travelers asked a court to rescind a policy, saying the insured had answered that it used MFA for administrator access when MFA was only protecting its firewall. (Insurance Journal) "Partly" is an answer, and it's better to give it.
Private by design
Scoring runs in your browser. Your answers are never sent to us or stored on a server.
No account needed
No sign-up, no tracking scripts, no cookies. Optional: leave an email if you'd like a free follow-up.
Honest limits
This is a checklist, not insurance or legal advice, and it can't guarantee coverage. Your broker and policy have the final word.
FAQ
Questions, answered plainly
Still unsure whether this fits your situation? Book a free 30-min fit call.
Is this insurance or legal advice?
No. It's a free self-assessment based on questions that appear on real insurer applications. It does not guarantee coverage, pricing or that a claim will be paid. Every insurer words its questions differently, so answer your actual application truthfully and ask your broker if you're unsure.
Where do the questions come from?
From publicly available cyber applications and ransomware supplements, including At-Bay, Admiral, Hanover, DUAL and Tokio Marine HCC, plus Marsh's 12 key controls. The full list is on the sources page and at the end of every report.
How is the score calculated?
Yes counts fully, Partly counts half, No and Not sure count zero, and Not applicable is left out. Controls that appear on most of the applications we reviewed (MFA, offline backups, EDR) weigh three times as much as good-practice items. The weights are our judgment, not an insurer's formula.
Do you store my answers?
No. Answers are kept in your browser tab only (session storage) and disappear when you close it, or right away with "Clear my answers". If you choose to leave an email for a follow-up, we store only that email and, if you tick the box, your score band. See Privacy.
I answered "Not sure" a lot. Is that bad?
It counts as a gap in the score, because you'd need to find out before answering an insurer. The report tells you what to ask your IT provider for each one.
Free · private · about 5 minutes
Know your answers before the application arrives.
Nothing to install, no sign-up. Get your score, your ranked gaps and a printable report.