Skip to content
Pro tool · 3 free runs with a free account

What actually moves your cyber insurance premium?

Pick a company like yours, adjust it, and see which levers would lower your premium most for the effort, what is pushing it up, and what to show the underwriter.

Step 1

Your company

Typical 120-person services firm: Professional services (legal, accounting, consulting), 50 to 249 employees, $10M to $50M revenue, hybrid, operating in United States.

Premium pressure 44/100Best lever: Email security (DMARC and filtering)
Start from a typical company

Relative premium pressure

44out of 100
Moderate premium pressure
Business profile 9 / 35Control gaps 35 / 65

A relative score from our weighting of public insurer, broker and claims sources, not a quote or a dollar figure. No insurer publishes per-control discounts.

Your best levers

Ranked by expected improvement for each unit of effort, for this profile.

  1. 1

    Email security (DMARC and filtering)

    -2 on the gauge
    Low effortEvidence: moderateShows this renewal

    Now: DMARC at p=none
    First step: DMARC enforced, plus inbound filtering
    Target: Enforced DMARC, advanced filtering, impersonation protection

    Show the underwriter: DMARC record and reports; email security product and its impersonation controls.

    Why it matters

    Coalition: business email compromise and funds transfer fraud were 58% of incidents in 2025 and 60% of claims in 2024. DMARC is visible to an insurer's scan. Source: Coalition, Coalition

  2. 2

    Internet attack surface the insurer can scan

    -2 on the gauge
    Low effortEvidence: strongShows this renewal

    Now: Known findings still open (login panels, old TLS, open ports)
    Move to: Scanned monthly; findings fixed before renewal

    Show the underwriter: A recent outside-in scan with each finding closed or explained; answer any carrier scan alert in writing before binding.

    Why it matters

    Corvus lists its IT security scan score as a premium factor. Coalition found 65%+ of applicants had at least one internet-exposed login panel. Source: Corvus, Coalition

  3. 3

    Payment-change verification (callback)

    -2 on the gauge
    Low effortEvidence: strongShows this renewal

    Now: Informal callback, sometimes
    Move to: Documented callback to a known number, dual approval above a threshold

    Show the underwriter: The written verification procedure, who approves, the threshold, and a sample log.

    Why it matters

    Coalition: funds transfer fraud was 27% of 2025 claims. Amwins: callback and authentication provisions "will often limit coverage for social engineering losses" if you did not follow them. Source: Coalition, Amwins

  4. 4

    Remote access exposure

    -3 on the gauge
    Medium effortEvidence: strongShows this renewal

    Now: Self-managed VPN appliance, patched when we can
    First step: Self-managed VPN, patched within days, MFA on
    Target: Cloud-managed access (ZTNA) or no inbound remote access

    Show the underwriter: External scan report (yours or the carrier's) showing no RDP/admin ports; VPN make, version and patch date; MFA enforcement screenshot.

    Why it matters

    Coalition: 58% of 2024 ransomware claims began with a compromised VPN or firewall. At-Bay: on-premise VPN users were 3.7x more likely to suffer ransomware, and 73% of 2025 attacks started with a VPN. Source: Coalition, At-Bay (via The Register), At-Bay (via Insurance Edge)

  5. 5

    Website tracking pixels and consent

    -2 on the gauge
    Low effortEvidence: moderateShows this renewal

    Now: Consent banner, but pixels not reviewed
    Move to: Pixels approved by a process, fire after consent, opt-out works

    Show the underwriter: Tag inventory, the consent configuration, and the answers to the carrier's pixel questions.

    Why it matters

    Corvus says answers on data collection can lead to a wrongful collection exclusion, and asks about pixel approval, consent and opt-out. Gallagher reports carriers tightening wording on non-breach privacy claims. Source: Corvus, Gallagher (via Insurance Business)

Cover at risk, not just price

  • Slow patching of known flaws. Some wordings restrict cover for losses through a flaw that had a patch for 30 to 45 days or more. (Allens (law firm), Chubb)
  • Backups not isolated or tested. Untested or reachable backups weaken the ransomware answer most underwriters care about.
  • No reliable callback procedure. Social-engineering cover often depends on verification you followed; without it the claim may not be paid. (Amwins)
  • Tracking pixels without a review process. Your answers on data collection can lead to a wrongful-collection exclusion. (Corvus)

Things pushing your premium up

From your business profile
  • Industry: Professional services (legal, accounting, consulting): Sector sets the hazard class the underwriter starts from.
  • Operates in United States: US class-action and state privacy-law climate.
  • Revenue $10M to $50M: Revenue is the usual exposure base: a bigger business pays more for the same controls.
  • Records held: 10,000 to 100,000: Notification, forensics and liability scale with records.
  • Tracking pixels with US users: Web-tracking suits are a live claims trend; carriers are adding wrongful-collection exclusions.
  • Hybrid stack: Some self-managed infrastructure to defend.
From control gaps
  • Remote access exposure: Self-managed VPN appliance, patched when we can (+3)
  • Patching speed for critical and KEV flaws: 15 to 30 days (+2)
  • Backups and tested restores: Backups exist, restore not tested this year (+2)
  • Email security (DMARC and filtering): DMARC at p=none (+2)
  • Internet attack surface the insurer can scan: Known findings still open (login panels, old TLS, open ports) (+2)

Renewal action plan

Your top levers, split into what shows at this renewal and what to start now, with the evidence to bring.

Preview the plan
CYBER INSURANCE RENEWAL ACTION PLAN
Company: Professional services (legal, accounting, consulting), 50 to 249 employees, $10M to $50M revenue, hybrid, operating in United States
Relative premium pressure: 44/100 (Moderate). PlayCISO relative model, not a quote.

BEFORE THIS RENEWAL
1. Email security (DMARC and filtering) (low effort, evidence moderate)
   Now: DMARC at p=none
   Target: Enforced DMARC, advanced filtering, impersonation protection
   Show the underwriter: DMARC record and reports; email security product and its impersonation controls.
2. Internet attack surface the insurer can scan (low effort, evidence strong)
   Now: Known findings still open (login panels, old TLS, open ports)
   Target: Scanned monthly; findings fixed before renewal
   Show the underwriter: A recent outside-in scan with each finding closed or explained; answer any carrier scan alert in writing before binding.
3. Payment-change verification (callback) (low effort, evidence strong)
   Now: Informal callback, sometimes
   Target: Documented callback to a known number, dual approval above a threshold
   Show the underwriter: The written verification procedure, who approves, the threshold, and a sample log.
4. Remote access exposure (medium effort, evidence strong)
   Now: Self-managed VPN appliance, patched when we can
   Target: Cloud-managed access (ZTNA) or no inbound remote access
   Show the underwriter: External scan report (yours or the carrier's) showing no RDP/admin ports; VPN make, version and patch date; MFA enforcement screenshot.
5. Website tracking pixels and consent (low effort, evidence moderate)
   Now: Consent banner, but pixels not reviewed
   Target: Pixels approved by a process, fire after consent, opt-out works
   Show the underwriter: Tag inventory, the consent configuration, and the answers to the carrier's pixel questions.
6. Patching speed for critical and KEV flaws (medium effort, evidence strong)
   Now: 15 to 30 days
   Target: Within 7 days; internet-facing KEV flaws in 72 hours
   Show the underwriter: Patch SLA policy plus a report of actual time-to-patch for critical/KEV flaws over the last two quarters.

START NOW, SHOWS AT NEXT RENEWAL
1. Network segmentation: Some segments; backups and servers reachable from user devices -> Segmented; backups and admin systems isolated
2. ISO/IEC 27001 certification: None -> Certified, scope covers the core business
3. SOC 2 Type II report: None -> Current Type II report
4. End-of-life systems: Under 10%, isolated or on paid extended support -> None

COVER AT RISK (check your wording)
- Slow patching of known flaws: Some wordings restrict cover for losses through a flaw that had a patch for 30 to 45 days or more.
- Backups not isolated or tested: Untested or reachable backups weaken the ransomware answer most underwriters care about.
- No reliable callback procedure: Social-engineering cover often depends on verification you followed; without it the claim may not be paid.
- Tracking pixels without a review process: Your answers on data collection can lead to a wrongful-collection exclusion.

Weighting is PlayCISO's judgement from public insurer, broker and claims sources; no insurer publishes per-control discounts. Confirm with your broker.
Made with https://playciso.com/tools/cyber-insurance-premium-levers

Loading…

Step 2

Where you are today

Set each lever to your current state. The ranking updates as you go.

Exposure (4)What an attacker (and the insurer's scanner) can see and reach.

Lowers premium and widens carrier appetite when exposure shrinks. Medium effort: a quarter; some spend.

Lowers premium when the carrier's scan comes back clean. Low effort: weeks; mostly configuration or process.

Lowers the privacy-loss scenario the underwriter prices. Medium effort: a quarter; some spend.

Avoids a wrongful-collection exclusion or sub-limit. Low effort: weeks; mostly configuration or process.

Controls (12)The application-form controls: identity, endpoints, backups, patching.

Often a condition of cover; gaps raise premium or block a quote. Low effort: weeks; mostly configuration or process.

Lowers premium; missing EDR can block a quote. Medium effort: a quarter; some spend.

Lowers premium and the business-interruption estimate. Medium effort: a quarter; some spend.

Lowers premium; slow patching can shrink cover for known flaws. Medium effort: a quarter; some spend.

Lowers incident likelihood; credited where the form asks. Medium effort: a quarter; some spend.

Lowers premium; asked on most mid-market forms. Medium effort: a quarter; some spend.

Lowers BEC and fraud exposure. Low effort: weeks; mostly configuration or process.

Limits how far an incident spreads. High effort: a multi-quarter project.

Shortens investigations; supports the claim. Medium effort: a quarter; some spend.

Lowers premium where asked; speeds the claim. Low effort: weeks; mostly configuration or process.

Protects contingent business-interruption cover. Medium effort: a quarter; some spend.

Keeps social-engineering cover and its limit. Low effort: weeks; mostly configuration or process.

People (4)Who owns security and how staff are prepared.

Makes every other answer credible. Medium effort: a quarter; some spend.

Asked on most forms; small effect on its own. Low effort: weeks; mostly configuration or process.

Little or no direct premium effect. Medium effort: a quarter; some spend.

Small effect; helps on larger and listed risks. Low effort: weeks; mostly configuration or process.

Certifications (2)Company certificates and attestations.

Helps evidence and insurability; no published fixed discount. High effort: a multi-quarter project.

Helps evidence and insurability; no published fixed discount. High effort: a multi-quarter project.

Policy structure (3)Choices in how you buy, not how you defend.

Higher retention lowers premium but you pay more of each loss. Low effort: weeks; mostly configuration or process.

Better terms in a falling market. Low effort: weeks; mostly configuration or process.

Can lower retentions and keeps renewals clean. Low effort: weeks; mostly configuration or process.

Not relevant to this profile: OT / industrial network separation, Card data scope, PCI DSS compliance. Change the profile (OT stack, card payments, tracking pixels, on-prem servers) to bring them in.

Myths about cyber premiums

  • Myth: Getting SOC 2 or ISO 27001 earns a fixed premium discount.

    No public source ties a fixed discount to either. Certificates help you evidence the controls underwriters price, and one insurer (Vouch) reports 40% lower claims frequency among its SOC 2 customers, but the controls are what is priced. Source: Vouch (published with Vanta).

  • Myth: Hiring CISSP-certified staff lowers the premium.

    We found no public underwriting source that prices individual staff certifications. Forms ask what controls run and who owns them.

  • Myth: "We have MFA" ticks the box.

    Marsh McLennan found MFA "only works" when it covers critical data, all remote access and admin accounts. Partial MFA is the gap that shows up in claims. Source: Marsh McLennan.

  • Myth: EDR on its own stops ransomware.

    At-Bay: 60% of Akira victims had a leading EDR product; the ones that avoided full encryption had it monitored 24/7. Source: At-Bay (via Insurance Edge).

  • Myth: The application is just paperwork.

    Carriers scan you from outside (Corvus prices its scan score) and a wrong answer can be used against a claim. Answer what you can evidence. Source: Corvus.

  • Myth: Rates are falling, so controls do not matter this year.

    Marsh: global cyber rates fell 4% in Q2 2026. But carriers are tightening wording on contingent business interruption and privacy claims (Gallagher), so terms can still get worse while price falls. Source: Marsh, Gallagher (via Insurance Business).

  • Myth: Cyber insurance pays for any attack.

    Lloyd's requires standalone cyber policies to exclude state backed cyber-attacks (from 31 March 2023). Read the exclusion, not just the limit. Source: Lloyd's.

TL;DR

The short answer

5 points
  • Certification alone rarely buys a fixed discount: no public source ties one to SOC 2 or ISO 27001. Certificates help you evidence the controls insurers actually price.
  • The levers with the strongest public evidence are internet-facing remote access, MFA across email, remote access and admin accounts, EDR with 24/7 monitoring, tested immutable backups, and patching speed.
  • Some gaps cost cover, not just price: slow patching and end-of-life systems can trigger sub-limits, and missing callback checks can void social-engineering cover.
  • Your profile (sector, revenue, records, jurisdictions, claims history, OT) sets the starting point; the tool shows which levers matter for that profile.
  • The score is a transparent relative model built on cited insurer, broker and claims sources. It is not a quote.

Every lever, its direction and its evidence

Evidence strength is our reading of the public sources: strong means insurer claims data or a named wording ties it to losses or terms; weak means we found no public study and the weight is our judgement. Some levers only apply to certain profiles (OT, card payments, tracking pixels).

Exposure

Remote access exposure
Lowers premium and widens carrier appetite when exposure shrinks
Coalition: 58% of 2024 ransomware claims began with a compromised VPN or firewall. At-Bay: on-premise VPN users were 3.7x more likely to suffer ransomware, and 73% of 2025 attacks started with a VPN.
Evidence: Strong
Medium effort
Can show this renewal
Internet attack surface the insurer can scan
Lowers premium when the carrier's scan comes back clean
Corvus lists its IT security scan score as a premium factor. Coalition found 65%+ of applicants had at least one internet-exposed login panel.
Evidence: Strong
Low effort
Can show this renewal
End-of-life systems
Raises premium and can trigger sub-limits or exclusions
Allens: many wordings limit cover for end-of-life systems and unpatched known flaws, sometimes down to 5-10% of the limit. Chubb's Neglected Software Exploit endorsement shifts risk to the insured over time.
Evidence: Moderate
High effort
Usually next renewal
OT / industrial network separation
Lowers business-interruption exposure
Our reasoning: in an OT business an IT ransomware event can stop production, which is business-interruption loss. We found no public study that prices OT segmentation, so this is weighted on judgement.
Evidence: Weak
High effort
Usually next renewal
Records held (data minimisation)
Lowers the privacy-loss scenario the underwriter prices
The number and type of records is a standard application question because notification, forensics and liability scale with it. No public source puts a number on the premium effect of deleting records.
Evidence: Moderate
Medium effort
Can show this renewal
Website tracking pixels and consent
Avoids a wrongful-collection exclusion or sub-limit
Corvus says answers on data collection can lead to a wrongful collection exclusion, and asks about pixel approval, consent and opt-out. Gallagher reports carriers tightening wording on non-breach privacy claims.
Evidence: Moderate
Low effort
Can show this renewal
Card data scope
Shrinks the PCI part of the loss scenario
Our reasoning: card data you never touch cannot be stolen from you, and PCI fines and assessments are often a separate, smaller limit. We found no public pricing study for this.
Evidence: Weak
Medium effort
Usually next renewal

Controls

MFA coverage
Often a condition of cover; gaps raise premium or block a quote
Marsh McLennan: MFA "only works" when it covers critical data, remote access and admin accounts. Coalition: stolen credentials were the top way into ransomware claims (47%).
Evidence: Strong
Low effort
Can show this renewal
Endpoint detection (EDR / MDR)
Lowers premium; missing EDR can block a quote
At-Bay: 60% of Akira ransomware victims had a leading EDR product; the only businesses that avoided full encryption had EDR backed by 24/7 MDR.
Evidence: Strong
Medium effort
Can show this renewal
Backups and tested restores
Lowers premium and the business-interruption estimate
Backups are on essentially every cyber application because they decide whether ransomware becomes a long outage. A tested restore is what turns "we have backups" into evidence.
Evidence: Strong
Medium effort
Can show this renewal
Patching speed for critical and KEV flaws
Lowers premium; slow patching can shrink cover for known flaws
Marsh McLennan: patching high-severity flaws within 7 days was a top-four control and the least implemented (24%). Chubb gives a 45-day grace period before risk shifts to you; Allens notes 30-day triggers are common.
Evidence: Strong
Medium effort
Can show this renewal
Configuration hardening baselines
Lowers incident likelihood; credited where the form asks
Marsh McLennan found automated hardening had, "by a wide margin", the strongest link to fewer incidents: nearly six times less likely.
Evidence: Strong
Medium effort
Can show this renewal
Privileged access (PAM)
Lowers premium; asked on most mid-market forms
Marsh McLennan notes insurers most often recommend EDR, MFA and PAM. Its own data puts PAM below hardening and patching in signal strength.
Evidence: Moderate
Medium effort
Can show this renewal
Email security (DMARC and filtering)
Lowers BEC and fraud exposure
Coalition: business email compromise and funds transfer fraud were 58% of incidents in 2025 and 60% of claims in 2024. DMARC is visible to an insurer's scan.
Evidence: Moderate
Low effort
Can show this renewal
Network segmentation
Limits how far an incident spreads
A common application question, because it decides whether one infected laptop becomes a company-wide outage. We found no public pricing study for it.
Evidence: Moderate
High effort
Usually next renewal
Logging and monitoring
Shortens investigations; supports the claim
Forensics cost is part of most claims; logs you kept shorten the investigation. It overlaps with MDR, so we weight it below EDR.
Evidence: Moderate
Medium effort
Can show this renewal
Incident response plan and tabletop
Lowers premium where asked; speeds the claim
Asked on nearly every form. Coalition says quick reporting improves fund recovery, and an exercised plan is what makes reporting quick.
Evidence: Moderate
Low effort
Can show this renewal
Vendor and third-party risk
Protects contingent business-interruption cover
Gallagher reports carriers tightening wording on contingent business interruption, the cover that responds when a supplier is hit.
Evidence: Weak
Medium effort
Can show this renewal
Payment-change verification (callback)
Keeps social-engineering cover and its limit
Coalition: funds transfer fraud was 27% of 2025 claims. Amwins: callback and authentication provisions "will often limit coverage for social engineering losses" if you did not follow them.
Evidence: Strong
Low effort
Can show this renewal

People

Who owns security
Makes every other answer credible
Applications ask who is responsible for security; an underwriter call goes better when one person can answer every control question.
Evidence: Moderate
Medium effort
Can show this renewal
Phishing training and simulation
Asked on most forms; small effect on its own
Email is where most claims start (Coalition: BEC and funds transfer fraud were 58% of incidents in 2025). Training is a standard question; it is not a substitute for MFA or callback controls.
Evidence: Moderate
Low effort
Can show this renewal
Staff certifications (CISSP, CISM and similar)
Little or no direct premium effect
We found no public underwriting source that prices individual staff certifications. Forms ask what controls run and who owns them, not which certificates staff hold.
Evidence: Weak
Medium effort
Usually next renewal
Board oversight of cyber risk
Small effect; helps on larger and listed risks
Our reasoning: larger and listed accounts are often asked about governance on underwriting calls. We found no public study that ties it to price.
Evidence: Weak
Low effort
Can show this renewal

Certifications

SOC 2 Type II report
Helps evidence and insurability; no published fixed discount
Vouch says its SOC 2 customers had 40% lower claims frequency (its own data). That is one insurer's claims figure, not a premium discount; no public source ties a fixed discount to the report.
Evidence: Weak
High effort
Usually next renewal
ISO/IEC 27001 certification
Helps evidence and insurability; no published fixed discount
Like SOC 2, it is evidence that controls exist and are audited. We found no independent source that quantifies a premium reduction for it.
Evidence: Weak
High effort
Usually next renewal
PCI DSS compliance
Supports the PCI fines and assessments cover
Our reasoning: PCI fines and assessments are often a separate, smaller limit, and underwriters ask about compliance when you take cards. No public pricing study found.
Evidence: Weak
Medium effort
Usually next renewal

Policy structure

Retention (deductible) you choose
Higher retention lowers premium but you pay more of each loss
Taking more of each loss is the most direct premium lever there is. It does not reduce risk, it moves it to you, so model it before you choose.
Evidence: Strong
Low effort
Can show this renewal
Renewal timing and marketing
Better terms in a falling market
Marsh: global cyber rates fell for a twelfth straight quarter in Q2 2026 (-4%; US -2%). In a falling market, buyers who market the risk with evidence are best placed to see that, but there is no guaranteed reduction.
Evidence: Weak
Low effort
Can show this renewal
Using the carrier's security services
Can lower retentions and keeps renewals clean
Coalition introduced lower retentions for funds transfer fraud reported within 72 hours, and says fast reporters recover more.
Evidence: Moderate
Low effort
Can show this renewal

How the score works

The gauge is 0 to 100. Up to 35 points come from your business profile (sector, revenue, records, jurisdictions, stack, claims history), which you mostly cannot change before a renewal. Up to 65 points come from control gaps: each lever has a weight from 1 to 5 that we set from the sources below, adjusted for your profile (for example, OT separation only counts for an OT stack, and SOC 2 counts more for a SaaS company whose customers ask for it). A lever's rank is the points it would remove divided by its effort. These weights are PlayCISO's judgement, not any insurer's rating plan.

Pricing context: Marsh reports global cyber rates fell 4% in Q2 2026, the twelfth quarterly decline in a row (US -2%), and Gallagher describes most buyers seeing flat rates in 2026 with healthcare the exception. In that market, the controls mainly decide which carriers will quote and on what terms.

Frequently asked questions

Does getting certified lower your cyber insurance premium?

Not by a fixed amount that any insurer publishes. We found no public source that ties a set discount to SOC 2 or ISO 27001. One insurer, Vouch, reports 40% lower claims frequency among its SOC 2 customers, which is a reason it may price them better, but underwriters price the controls they can verify (MFA, EDR, backups, patching, exposure), not the certificate. A certificate makes those answers easier to prove.

What lowers a cyber insurance premium the most?

The levers with the strongest public evidence are closing internet-facing remote access (Coalition found 58% of 2024 ransomware claims started with a VPN or firewall; At-Bay found on-premise VPN users 3.7x more likely to suffer ransomware), MFA on email, all remote access and every admin account, EDR monitored 24/7, isolated and tested backups, and patching critical flaws within days. A higher retention also lowers premium, but only by moving loss to you.

What makes a cyber insurance premium go up?

Sector (healthcare saw single-digit increases in 2026 while most buyers were flat, per Gallagher), revenue, the number and type of records you hold, operating in the US or EU class-action and fine regimes, prior claims or ransomware, OT exposure, end-of-life systems, and a poor outside-in scan result. Corvus, for example, lists its security scan score as a premium factor.

Do staff certifications like CISSP lower the premium?

We found no public underwriting source that prices individual staff certifications. Applications ask what controls run and who owns security. A certified security lead helps you answer those questions well, which is the real value.

Can unpatched or end-of-life systems reduce my cover?

Yes. Law firm Allens notes many market-standard wordings limit cover for losses through a known flaw left unpatched for a set period (commonly 30 days) or through end-of-life systems, sometimes down to 5-10% of the limit. Chubb's Neglected Software Exploit endorsement gives a 45-day grace period, after which the policyholder carries a growing share of the risk.

Is the premium pressure score a quote?

No. It is a relative score from 0 to 100: up to 35 points from your business profile and up to 65 from control gaps, using weights we set from the cited sources. It shows which levers matter more for your company, not what you will pay.

Sources

Educational, not insurance or legal advice. Policy wordings differ by carrier and country; confirm terms with your broker.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout