Cyber Insurance Requirements 2026 — Philadelphia Small Business

You filed a claim after a ransomware attack. You had a cyber insurance policy. And the insurer denied it — because you couldn’t prove MFA was active on every account at the time of the breach.

This scenario is playing out for small businesses across Philadelphia right now, and it’s going to get worse. Cyber insurers paid out $7.8 billion in claims in 2025 alone. They are tightening requirements, auditing compliance more aggressively, and using policy language to deny claims when businesses can’t prove they had the controls they said they had.

MFA IS NO LONGER OPTIONAL — IT’S A HARD REQUIREMENT

Ninety-six percent of cyber insurers now require multi-factor authentication (MFA) as a condition of coverage. Not just on email — on VPN access, remote desktop connections, cloud applications, and all administrator accounts.

The catch: you have to stay compliant every day, not just on the day you sign the application. If you told your insurer MFA was active on all accounts and a breach occurs on an account where someone turned it off “just temporarily” — the insurer can deny the claim. This has already happened.

ENDPOINT DETECTION AND RESPONSE (EDR): NOW EXPECTED BY UNDERWRITERS

Basic antivirus is no longer sufficient. Insurers now ask whether you have Endpoint Detection and Response (EDR) tools on every workstation and server — and whether it’s being actively monitored by a Security Operations Center (SOC). At Abuzz, we deploy Huntress on every managed client, providing both EDR capabilities and 24/7 SOC coverage.

EMAIL SECURITY: THE GAP MOST PHILADELPHIA SMBs ARE MISSING

Insurers are asking whether you have advanced email filtering beyond default Microsoft 365 settings:

– DMARC, DKIM, and SPF records configured to prevent domain spoofing

– Anti-impersonation protection catching lookalike domains

– Link scanning that checks URLs at the time of click, not just delivery

– Attachment sandboxing to detonate suspicious files safely

Default Microsoft 365 settings provide none of the above at the level insurers expect.

BACKUP AND RECOVERY: TESTED BACKUPS, NOT JUST EXISTING ONES

Insurers want documented quarterly restore tests. The 2026 standard is immutable, offsite backups for critical systems with proof they work.

SECURITY AWARENESS TRAINING

Several major cyber insurers have added documented security awareness training to their application questionnaires. You need a tracked, formal program — not just a yearly reminder email.