What cyber insurers now demand from Australian businesses

Five years ago, getting cyber insurance was easy. Fill out a short questionnaire, pay your premium, and you were covered. Today, the landscape has changed dramatically — and many Australian businesses are finding out the hard way that their policies may not protect them when it matters most.

Insurers have been hit hard by ransomware claims, and they've responded by tightening requirements. Most policies now mandate specific controls: multi-factor authentication (MFA) on all remote access and privileged accounts, endpoint detection and response (EDR) on every device, regular patching, tested and air-gapped backups, and security awareness training for staff. If you can't demonstrate these controls at renewal — or worse, at claim time — you may face higher premiums, reduced coverage, or outright denial.

The claims process is where many businesses get caught. Insurers conduct forensic investigations after an incident, and if they find that a required control was missing or misconfigured, they can reduce or deny the payout. 'We have antivirus' is no longer sufficient documentation. You need evidence: MFA logs, patch reports, backup test records, training completion rates.

This is where the Essential Eight becomes invaluable. The framework covers exactly what insurers are looking for, and Otaris documents your compliance as part of our managed service. When your insurer asks for evidence, you have it — because we've been maintaining and reporting on it all along.

Don't wait until your next renewal to find out you're underprotected. A free Raven Score shows you where you stand against the Essential Eight and highlights the gaps that could put your coverage at risk.