Cyber Insurance Declined or Refused? UK Guide to Getting Covered

Why is cyber insurance so hard to get in 2026?

If your cyber insurance application has been declined, your renewal refused, or your quote loaded with exclusions and sub-limits, you are far from alone — and it usually isn't because your business is uninsurable. It's because the cyber market has fundamentally changed. After paying out enormous ransomware and business-interruption losses from 2022 onwards, insurers moved from trust-based underwriting to verification-based underwriting. The short questionnaire became a technical audit, and a set of security controls that were once "nice to have" became hard conditions of cover.

The result is that businesses get declined not because they're bad risks, but because they can't yet evidence the controls insurers now demand — or because their application was presented poorly. A decline is a problem to be solved, not a verdict. This is exactly the kind of difficult, declined or non-standard risk we specialise in placing at Miller & Partner. If you're new to the topic, our general guide to cyber insurance covers the basics — this guide is for when you've already been turned down and need a route back to cover. Where the decline is driven by something other than your security posture, two adjacent routes apply: business insurance after insolvency, where a formal procedure or a director-level search is what triggered it, and business insurance with a CCJ, where adverse credit stopped the quote before any underwriter looked at your controls.

Why is the attestation trap so dangerous?

This is the single most important point in this guide — and the one that catches the most businesses out. Modern cyber applications ask detailed yes/no questions about your security controls. Your answers don't just inform the quote; they typically become warranties — binding statements the insurer relies on. And here's the trap: an optimistic or careless answer can quietly turn a policy you paid for into one that won't pay out.

The classic example: you're asked "Is MFA enabled?" and you tick yes — because it's on email. But your VPN, remote desktop and cloud admin accounts have no MFA enforced. From a claims perspective, that answer may be treated as a misrepresentation. If a breach later exploits one of those unprotected routes, the insurer can use the discrepancy to deny the claim or void the policy — and in a widely reported case, an organisation was refused a multi-million-dollar ransomware payout precisely because MFA had not been fully implemented across affected systems.

What are the common reasons cyber cover is refused?

When an application is declined or a renewal refused, the cause is usually one of a short, recurring list. Insurers will normally state it explicitly — and you should always ask for it in writing. The most common blockers are below.

Declined vs placeable: what actually changes the outcome?

The difference between a flat decline and a workable quote is often less about the business itself and more about the controls in place and how the risk is presented. This is where a specialist broker changes the result.

Which security controls do insurers now require?

For 2026, a recurring set of controls has moved firmly into the "non-negotiable" category for most cyber underwriters. You don't always need every one perfectly in place — but you need to address them, evidence them, or offer documented compensating controls. The core expectations:

How do you get covered after a decline?

A decline feels final, but it rarely is. The route back to cover is usually methodical rather than dramatic. First, get the declination reasons in writing — insurers typically give a short, specific list. Second, close the gaps you can quickly (enforcing MFA universally is often the single biggest lever) and document compensating controls where a perfect fix isn't immediate. Third, build an evidence pack: screenshots of MFA enforcement, EDR deployment reports, backup-restore test logs, your incident-response plan, and patching reports. Fourth, work with a broker who can take that evidenced risk to markets beyond the one that declined you — including Lloyd's syndicates and specialist cyber MGAs that consider non-standard and previously-declined risks. We walk through how this feeds into pricing and terms in the pricing section below.

Can you get cyber cover after a ransomware attack?

Yes — but it's harder, and how you present the aftermath matters enormously. Insurers will want to see what happened, what you've changed, and that the vulnerability that was exploited has been closed. A business that suffered ransomware, then demonstrably hardened its controls — universal MFA, EDR, immutable tested backups, a tested incident-response plan — can often still be placed, sometimes with a higher excess, a sub-limit on ransomware, or a co-insurance share initially. The worst thing you can do is hide the incident; the best thing is to evidence a credible remediation story. This is precisely the kind of post-incident, "previously declined" risk where specialist placement makes the difference between no cover and a workable policy.

How do UK GDPR fines affect your cover?

Cyber incidents that expose personal data trigger obligations under the UK GDPR and Data Protection Act 2018. You must notify the Information Commissioner's Office (ICO) of a qualifying personal data breach within 72 hours of becoming aware of it, and inform affected individuals where the risk to them is high. ICO fines can reach up to £17.5m or 4% of global annual turnover, whichever is higher.

For insurance, two points matter. First, many cyber policies include regulatory defence cover for the legal costs of responding to ICO action — but the limits are often well below the maximum possible fine, so check them. Second, the fines themselves may be uninsurable under English public-policy principles, depending on whether the breach was merely negligent or reckless. Your policy wording should be read carefully on this point — and it's a key reason why robust controls (which reduce both the breach risk and the regulatory exposure) sit at the heart of a defensible cyber position.