Cyber insurance submissions fail on evidence, not on risk

Ask an underwriter why a cyber submission was declined and the answer is rarely the risk was too high. It is more often we could not tell what the risk was.

A questionnaire answered by the applicant is a claim. An underwriter prices claims with a margin for the ones that turn out to be wrong. That margin is the difference between a competitive premium and an uncompetitive one.

What evidence actually looks like

Three categories do most of the work:

1. Technical evidence of the control. Not 'we have MFA' but which systems, enforced for which users, with what exception list. A DMARC record at p=reject is a good example: it is a public fact, checkable in seconds.
2. External evidence of exposure. Breach history, exposed services, leaked credentials, lookalike domains. None of this requires the applicant's cooperation and all of it correlates with claims.
3. Financial evidence of consequence. What would a day of downtime cost this specific company? That number changes the conversation about limit and retention more than any security score.

Why brokers should care

A submission with evidence is faster to quote, easier to defend at renewal, and gives you a concrete reason to give the client when the premium moves. It also creates a natural advisory conversation: here is the gap the underwriter noticed, here is what closing it does to next year's terms.

The honest limit

Evidence does not make risk disappear, and no quantification model predicts a specific incident. What it does is replace an assumption with a measurement — and measurements can be argued with productively.

That is the entire value proposition of quantification in insurance: not certainty, but a defensible position.