Most small business owners who believe they are too small to be hacked are working from an outdated picture of how attacks happen. Ransomware crews rarely pick a victim by name or revenue. They scan the internet for unpatched firewalls and VPNs, buy stolen passwords in bulk, and send phishing emails by the thousands, then go after whoever lets them in. Verizon's 2026 Data Breach Investigations Report found that roughly 96% of ransomware victims, where the size of the organization was known, were small and medium-sized businesses. Cyber insurers have read the same data, which is why renewal applications now read like a security audit, and why a single "no" can raise your premium, shrink your coverage, or end the conversation entirely.
The good news is that insurers mostly ask about the same handful of controls, and none of them require an enterprise budget. Below are the seven that come up again and again on small business applications, what the underwriter is actually trying to learn, and where businesses tend to get caught out.
Why insurers stopped taking "we're small" for an answer
The Verizon report also shows how those SMB ransomware cases started. Compromised credentials were involved in 38% of them, and unpatched vulnerabilities in edge devices such as firewalls and VPN appliances in 29%. Those two numbers explain most of the questionnaire. An insurer cannot inspect your network, so it asks whether you have closed the doors attackers use most often.
Ransomware is not the only claim they worry about. The FBI's Internet Crime Complaint Center recorded more than $3 billion in reported business email compromise losses in 2025, the second-largest loss category in its annual report. Those losses usually start with one hijacked mailbox and a convincing request to change a vendor's bank details.
1. Multi-factor authentication, everywhere that matters
Expect several MFA questions, not one. Underwriters typically ask separately about email, remote access (VPN, remote desktop, remote support tools), and administrator or privileged accounts. CISA says MFA makes you 99% less likely to be hacked, and insurers treat missing MFA on email or remote access as a near-automatic decline.
The trap is partial coverage. A business turns on MFA for Microsoft 365 but leaves an old shared mailbox, a legacy protocol, or the firewall's admin login without it. If an attacker gets in through the exception, your application answer may be questioned at claim time. Where you can, move to phishing-resistant methods such as FIDO2 security keys or number matching in the authenticator app, since simple push approvals can be defeated by "MFA fatigue" spamming.
2. Backups that ransomware cannot reach
Insurers want to know three things: that backups exist, that at least one copy is offline, immutable, or otherwise separated from your normal network credentials, and that you have actually tested a restore. A nightly copy to a NAS that sits on the same domain is not enough, because modern ransomware looks for backup systems and encrypts or deletes them first.
The question to ask yourself is not "do we have backups?" but "how long would it take to get the accounting system and email running again from a clean copy?" If nobody has timed it, nobody knows.
3. Endpoint detection and response (EDR)
Traditional antivirus matches known malware. EDR watches behavior, such as a process suddenly encrypting files or dumping passwords from memory, and can isolate the machine automatically. Many carriers now ask for EDR by name, and some ask whether it is monitored around the clock. An EDR agent that raises alerts nobody reads at 2 a.m. on a Saturday, a favorite time for attackers to launch encryption, provides much less protection than the checkbox suggests.
4. Patching, especially on internet-facing systems
Here the application often asks how quickly critical patches are applied, sometimes with a specific window such as 14 or 30 days. Verizon found that only 26% of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog were fully remediated in its dataset, and the median time to fix them grew to 43 days. Attackers move much faster than that.
Prioritize the devices facing the internet: firewalls, VPN gateways, remote access tools and any public web server. Then deal with end-of-life software. A Windows server or firewall that no longer receives security updates is a problem no patch schedule can fix, and underwriters increasingly ask about it directly.
5. Email security and payment verification
Expect questions about spam and phishing filtering, whether external emails are tagged, and whether your domain publishes SPF, DKIM and DMARC records, which make it harder for criminals to send mail that appears to come from you. More carriers also ask a procedural question that has nothing to do with software: do you verify changes to payment instructions with a phone call to a known number?
That second question exists because of business email compromise. A filter will never catch every message sent from a genuinely compromised vendor account. A rule that nobody changes bank details on the strength of an email alone will.
6. Limited administrator rights
When everyone in the office logs in as a local administrator, one malicious attachment gets the same power as your IT person. Insurers ask whether staff use standard accounts for daily work, whether admin accounts are separate and protected with MFA, and how many people hold domain or global admin rights. In small businesses the honest answer is often "more than we thought," usually because of former employees, old vendor accounts, or a shared "admin" login that was never retired.
7. Security awareness training and a written response plan
Most applications ask whether employees receive regular security training, and many ask about phishing simulations. Some also ask whether you have an incident response plan. Neither has to be elaborate. Short, regular training sessions tied to real scams employees are seeing tend to stick better than an annual video. A one-page response plan that lists who to call (your IT provider, your insurer's breach hotline, your lawyer) and what not to do (wipe machines, pay a ransom, email the attacker) can save hours when it matters. Call the insurer before you call anyone else outside the business, because many policies require you to use their approved responders.
Answer the application honestly
One of the costliest mistakes is not a missing control but an optimistic answer. A business owner ticks "yes" to MFA on all remote access because the main VPN has it, without realizing a remote desktop port was left open for a vendor. If a claim follows, the insurer's forensic team will find that gap. In our work providing managed IT support on Long Island, the most useful renewal exercise is a simple one: someone who knows the environment reads every question, checks the actual settings, and writes down where the answer is "partly." Those partial answers become the to-do list.
None of these seven controls is exotic. Together they close the routes behind most small business breaches, they lower the odds of a denied claim, and they usually improve the premium. Being small was never protection. Being prepared is the closest thing to it.
About the author: Nathan Spitalny is the CEO of RDE Technologies, a managed IT and cybersecurity provider founded in 2009 and based in Oceanside, New York. RDE supports small businesses, healthcare practices and senior-living facilities with IT management, security and HIPAA compliance.