Cyber Insurance Application Auto-Reject Simulator
A readiness score tells you how you are doing. Underwriters decide on knock-outs — a short list of controls that get you declined, held, or surcharged before you ever see a quote. Answer honestly and see where your application is likely to fail. This is an illustrative model of common 2026 underwriting requirements, not any specific carrier and not insurance advice.
Mark each control Yes / No / Unsure.
What this simulator does
- Underwriters decide on knock-outs, not scores: a short list of controls that get you declined, held, or surcharged before you ever see a quote.
- Answer Yes / No / Unsure on ~15 controls and get a likely outcome — declined, held for subjectivities, surcharged, or quotable — with the specific blockers and how to fix them.
- Models the controls most carriers now treat as mandatory (MFA on email/VPN/privileged access, EDR, tested/immutable backups, no EOL internet-facing systems, no open RDP) and the common surcharge drivers.
- Illustrative of common 2026 underwriting requirements — not any specific carrier, and not insurance advice. Everything runs in your browser.
Why this matters
Cyber-insurance underwriting hardened sharply after the ransomware losses of the early 2020s. Carriers no longer read a long questionnaire and form a holistic view — they gate on a handful of controls that history shows prevent the losses they pay out on, and they decline fast when those are missing. A team can have a mature program on paper and still be declined over one open RDP port or a gap in MFA.
This simulator shows you those gates the way an underwriter applies them, so you fix the blockers before you apply rather than discovering them in a decline letter. It is an illustrative model of common requirements, not any specific carrier and not insurance advice.
Frequently asked questions
What gets a cyber insurance application declined?
The common hard knock-outs in 2026 are: no multi-factor authentication on remote email, VPN/remote access or privileged accounts; no endpoint detection and response (EDR/MDR); no tested, immutable or offline backups; end-of-life or unsupported systems exposed to the internet; and Remote Desktop Protocol (RDP) or database ports open directly to the internet. Any one of these is frequently enough for an underwriter to decline or non-renew regardless of how good the rest of your program is — because each is strongly associated with ransomware. This simulator flags which of them would sink your application before you apply.
Is this the same as a readiness score?
No, and that is the point. A readiness score averages many controls into a number, which can look healthy even when a single mandatory control is missing. Underwriting is not an average — it is a set of pass/fail gates on specific controls, plus pricing factors on top. This tool models those gates (knock-outs) separately from the pricing factors (surcharge drivers), so you see the binary decisions the way a carrier does. Use it alongside the readiness and premium tools, not instead of them.
What is a surcharge driver versus a knock-out?
A knock-out is a control whose absence usually means no quote at all (e.g. no MFA, no EDR, open RDP). A surcharge driver is a weakness that will not get you declined but raises the premium or attaches subjectivities you must remediate — for example weak email filtering, no privileged-access management, no security-awareness training, slow patching, a flat/unsegmented network, thin logging, or no vendor-risk process. Closing surcharge drivers improves both your terms and your price even when you are already insurable.
Why do my application answers matter so much?
Because the application is a warranty, not a survey. If you attest that MFA is enforced everywhere and a breach later shows it was not, the insurer can rescind the policy or deny the claim for a material misrepresentation — this has happened in real, litigated cases. That is why this simulator asks you to answer honestly, including "Unsure": an honest unsure before you apply is recoverable; an inaccurate "Yes" discovered at claim time is not. Confirm each answer against reality before you sign the application.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.