Cyber Insurance in Australia Is Getting Harder to Get

Three years ago, getting cyber insurance in Australia was relatively straightforward. You filled in a form, ticked a few boxes about having antivirus software, and the policy landed in your inbox. Those days are gone. Underwriters have paid out billions in ransomware claims, business email compromise losses, and data breach costs, and they are now treating cyber risk the same way they treat any other actuarial problem. If your IT controls are weak, you either pay significantly more, get excluded from key coverage areas, or get declined outright.

This is not a scare tactic. It is the current market reality for businesses of all sizes across Australia. Understanding the cyber insurance australia requirements that underwriters now enforce is essential for any business that wants real coverage at renewal time, not a policy full of holes.

Why Cyber Insurance Requirements Have Changed So Dramatically

The cyber insurance industry in Australia has been shaken by several years of record claims. Ransomware attacks on Australian businesses skyrocketed between 2020 and 2024, with publicly reported incidents at Medibank, Latitude Financial, Optus, and dozens of smaller organisations costing insurers hundreds of millions of dollars. Underwriters responded the only way they could: by tightening requirements and pricing risk more accurately.

Where insurers once accepted a self-reported questionnaire at face value, many now require evidence of controls. Some are sending their own technical assessors to verify claims. Others are using external scanning tools to check your internet-facing infrastructure before issuing a quote. The gap between what businesses think they have and what they actually have in place is where most renewals are falling over.

The other shift is that coverage exclusions have become far more specific. Policies now regularly exclude coverage for incidents that result from known vulnerabilities that were not patched within a defined timeframe, for incidents where MFA was not enabled on remote access systems, and for ransomware events where offline backups were not maintained. Read your policy carefully. The exclusions are where the real story lives.

What Underwriters Now Assess Before Issuing a Policy

When you apply for cyber insurance in Australia today, underwriters are looking at a specific set of technical controls. The exact requirements vary between insurers, but the following areas come up consistently across the market.

Multi-Factor Authentication

MFA is now considered a baseline, non-negotiable requirement by almost every cyber insurer operating in Australia. This applies specifically to email access (particularly Microsoft 365 and Google Workspace), remote access systems such as VPNs and RDP, administrative and privileged accounts, and cloud management consoles. If you are running Microsoft 365 without MFA enforced across all users, do not be surprised if your renewal comes back declined or priced very differently from last year.

Patching and Vulnerability Management

Underwriters want to know how quickly you apply security patches to operating systems and third-party applications. The benchmark most insurers are using is patching critical vulnerabilities within 14 days of release and high-severity vulnerabilities within 30 days. Businesses that cannot demonstrate a documented patching process are considered high risk, because the data consistently shows that most successful attacks exploit known vulnerabilities for which patches already exist.

Backup Controls

The backup requirements from insurers have become very specific. Insurers want to see that backups are tested regularly, that at least one backup copy is stored offline or immutably (so ransomware cannot encrypt it), and that a documented recovery process exists. The common standard referenced is the 3-2-1 backup rule: three copies of data, on two different media types, with one copy stored offsite. Businesses that back up to a single cloud destination without offline or immutable copies are leaving themselves exposed both to ransomware and to claim rejection.

Endpoint Detection and Response

Basic antivirus is no longer sufficient for most insurers. Many are now requiring endpoint detection and response (EDR) solutions that provide behavioural monitoring, not just signature-based detection. Solutions like Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne meet this requirement. Legacy antivirus products from a decade ago typically do not.

Privileged Access Management

Underwriters are asking whether your administrative accounts are separated from standard user accounts, whether privileged access is time-limited and audited, and whether you follow the principle of least privilege. This is often where smaller businesses fall down, because it requires discipline and the right configuration, not just the right software.

The Essential Eight Connection

For Australian businesses, the ASD’s Essential Eight framework has become the de facto reference point for cyber insurance underwriting. The Essential Eight covers application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting admin privileges, patching operating systems, MFA, and regular backups. These eight controls map almost directly onto what underwriters are now requiring.

Essential Eight compliance at Maturity Level One is increasingly the minimum threshold that insurers expect to see in place. Maturity Level Two or Three significantly improves your risk profile and can have a direct impact on your premium. If your business has never had an Essential Eight assessment conducted, that is where the conversation needs to start before your next renewal.

Otto IT provides managed cybersecurity services that specifically cover the Essential Eight controls, including assessment, gap remediation, and ongoing management. Getting to a documented maturity level is not just good security practice; it is now a commercial necessity if you want to maintain adequate cyber insurance coverage.

What Happens If You Do Not Have the Required Controls

The outcomes for businesses that cannot demonstrate adequate controls at renewal time range from inconvenient to seriously damaging. Understanding these outcomes helps frame the urgency of getting your controls in order before the renewal conversation happens.

The most common outcome is a significantly higher premium. Insurers price risk, and if your controls are weak, the price will reflect that. Some businesses are seeing premiums double or triple compared to previous years, not because of their own claims history, but because the market has repriced the risk category.

The second outcome is restricted coverage. Insurers may offer a policy that excludes specific attack vectors, such as ransomware coverage or social engineering coverage, if the controls that would mitigate those attacks are not in place. A cyber policy that excludes ransomware coverage is of limited value given that ransomware represents the majority of significant cyber incidents.

The third and most serious outcome is declined coverage. Some businesses are finding that they cannot obtain a policy at any price because their control environment is too weak. This leaves them entirely self-insured against a risk category that can easily result in six-figure or seven-figure losses.

There is also the claims rejection scenario to consider. Even if a business has a policy in place, a claim can be rejected if the insurer finds that a required control was not active at the time of the incident. Buying cyber insurance and then having a claim denied because MFA was not turned on is a situation nobody wants to be in.

How to Get Compliant Before Your Next Renewal

The good news is that most businesses can get to a satisfactory control baseline with focused effort over a period of weeks rather than months. The key is starting before the renewal notice arrives, not after.

The first step is an honest assessment of where you currently stand. This means looking at your MFA coverage across all users and systems, reviewing your patching cadence, auditing your backup configuration and testing it, assessing your endpoint protection across all devices, and reviewing privileged access controls. Most businesses discover gaps they were not aware of during this process.

The second step is prioritising remediation based on what insurers weight most heavily. MFA is always first. Backups and patching processes are typically next. EDR and privileged access controls follow. Working through this list methodically and documenting what you have done gives you something concrete to present at renewal.

The third step is engaging your IT provider in this process if they are not already leading it. Your IT support provider should be able to map your current state against insurer requirements and manage the remediation work. If they are not familiar with cyber insurance requirements and Essential Eight compliance, that is worth knowing.

Otto IT works with businesses across Melbourne to assess their current security posture, identify gaps against cyber insurance requirements, and implement the controls needed to get covered and stay covered. This is not about ticking boxes; it is about building a security foundation that actually reduces your risk.

Our managed IT support includes ongoing security management that keeps your controls active and documented, which is exactly what insurers are looking for at renewal time.

The Bottom Line on Cyber Insurance Australia Requirements

Cyber insurance in Australia is not optional for most businesses anymore. It is a risk management necessity. But a policy that looks good on paper and pays out when you need it are two different things. The gap between those two outcomes is filled by your IT controls.

Underwriters are smarter, more demanding, and better resourced than they were five years ago. The businesses that approach renewal with documented, well-maintained controls will get better coverage at better prices. The businesses that approach renewal with gaps will pay more, get less, or get nothing.

If your renewal is coming up in the next six months, now is the time to get your IT controls assessed. Not next month. Now.

Book a security assessment with Otto IT and find out exactly where you stand against current cyber insurance requirements. We will tell you what you have, what you are missing, and what it takes to fix it before the underwriter comes knocking.

Frequently Asked Questions

How much does cyber insurance cost for an Australian SMB?

Premiums vary significantly based on your industry, revenue, number of staff, and the security controls you have in place. A small professional services business with basic security controls might pay $2,000 to $5,000 per year for a basic policy. Businesses with higher risk profiles, larger revenue, or weaker controls pay considerably more. Businesses that have implemented strong controls — MFA, endpoint detection, patched systems, staff training — generally receive better premiums and broader coverage.

What is typically excluded from a cyber insurance policy?

Common exclusions include incidents arising from known, unpatched vulnerabilities that the business had been advised to remediate, insider threats where the organisation had not implemented basic access controls, and events resulting from the failure to maintain security standards specified in the policy schedule. War and state-sponsored attacks are also commonly excluded. Read the exclusions carefully and ask your broker to explain any that are relevant to your environment.

Can I get cyber insurance without implementing multi-factor authentication?

Increasingly, no. MFA for email and remote access is now a near-universal baseline requirement for cyber insurance in Australia. Insurers discovered that a disproportionate number of claims came from businesses without MFA on their email platform, and the requirement has become standard. Some insurers will still offer coverage without MFA but at higher premiums and with significantly reduced limits. The fastest way to improve your insurability and reduce your premium is to implement MFA across all cloud applications.

Does achieving Essential Eight compliance guarantee that I can get cyber insurance?

Essential Eight compliance significantly improves your insurability, but it does not guarantee coverage. Insurers conduct their own assessments and may have additional requirements beyond the Essential Eight framework. Compliance with the Essential Eight does demonstrate a serious approach to security governance, which will be viewed favourably during underwriting. If you are working toward compliance, document your progress — even partial compliance with evidence is better than no documentation at all.