For a decade, cybersecurity spend followed fear and vendors. Then the insurance market tightened, deductibles jumped, and the renewal packet started to look like an audit. CFOs noticed. The questionnaire was shorter than the strategy deck and meaner about specifics: multifactor everywhere, immutable backups, endpoint detection that is actually watched, a list of who can disable it.
That packet is now one of the more honest IT planning documents in the building. If you cannot get coverage — or you can, but only with a deductible that would wreck a quarter — the control is not optional. It is priced.
From “best practice” to “condition”
MFA on email used to be a talking point. It is now a condition of many policies. So are privileged-access management, tested restores, and a named incident-response retainer. Companies that treated those as a 2028 project discovered they were a 2026 premium.
This is not the insurer being kind. It is the insurer refusing to subsidize the same ransomware script twice. The side effect is useful: it gives the CISO a budget argument that does not depend on a scare story.
The cheapest control is the one that keeps the policy from becoming a brochure.
Where the money actually moves
Watch the mix, not the top line. Identity, backup, and detection are taking share from sprawling “platform” deals that cannot be mapped to a yes/no question on a form. Training still gets funded because underwriters ask about it, even when operators privately doubt the click-through course.
Also watch who owns the relationship. If the broker sits only with finance, IT will be surprised by a control they cannot implement in 30 days. If IT owns it alone, finance will be surprised by the premium. The companies that renew cleanly put both in the room in month nine, not month twelve.
The limit of the model
Insurance is not a substitute for security, and a completed questionnaire is not a mature program. Controls that please an underwriter can still fail a determined attacker. Use the form as a floor. Do not confuse it with a strategy.
Still, as a capital-allocation device, the market is doing something boards failed to do: it is forcing a short list. In a world of infinite tools, a short list is a gift.