You work with an agent who helps you determine what you need. Maybe you ask a fellow business owner, or maybe you feel like you know enough to go it alone. You sign on the dotted line, pay the premium, and tuck the certificate in a folder. You feel covered, then something goes wrong, you call to file a claim, and suddenly your coverage is nowhere to be found.
That's what I call a ghost policy because it looks real on paper, but it vanishes right when you need it, which is really unfortunate for small businesses who don’t understand the ins and outs of an ever-evolving online landscape.
Of course, not every policy does this, and I'm not here to scare you away from cyber insurance because I'm a big believer in it, especially as AI gains more momentum. I just want you to know where the spooky fine print hides. It is October, after all. BOO!
Why a policy goes missing
Most "ghost" moments come down to a handful of surprises:
The application answers weren't true: Insurers ask whether you use multi-factor authentication (MFA), keep backups, update your software, and more. If those answers don't match reality when you file a claim, the insurer can deny it. Remember the password manager and MFA talk from week one? This is where it comes back to haunt you or help you, if you did it. If you have an IT person, run it by them. They should be able to help you proactively navigate this. If you don’t, shameless plug, I do!
The safeguards didn't stay in place: Some policies expect you to maintain protections, not just promise them once, which can be hard amid the day-to-day demands of running a business. Some insurers will also ask about email protection like SPF, DKIM, and DMARC on applications. Not sure how to see where you stand? EasyDMARC is a great resource for this. That MFA you turned off for one stubborn login last spring? That, “I’ll get to my domain’s DNS records soon” thought? Your insurer may care, and honestly (and humbly), you should, too!
The coverage was never what you thought: Many policies handle data recovery differently than lost income from downtime. Some will cap it low, and it’s worth paying attention to. The same goes for an employee getting tricked into wiring money to a criminal. Limits and exclusions can vary widely, and unfortunately scams are getting harder to identify, even for the most reputable professionals and their teams.
There's no cyber coverage at all: Many small business owners are surprised to find that general business policies often don't cover cyber events, or only cover a small portion of them.
The email settings your insurer may ask about
Some applications ask whether you've set up SPF, DKIM, and DMARC. I know, a little alphabet soup here. Here's what they mean: they're settings that help prove an email really came from your business, so hackers and other online criminals can't easily send fake invoices or payment requests that look like they came from you. You can see how detrimental that could be.
If your answer is "I have no idea," you're in good company. Ask your IT person to check it, or run your domain through a tool like EasyDMARC to see where you stand. You can test yours below, no sales pitches or follow ups!
Five questions to ask your insurance agent or IT support person this week
You don't have to be “techy” for this; you just need to ask. Copy and paste these if it helps:
What security controls did my application say I have, and do I have every one of them today?
Does my policy cover lost income from downtime, not just data recovery? What's the limit?
What's covered if someone tricks my team or me into sending money through fake invoices, spoof emails, or other phishing attempts?
Do I have to notify you within a certain time, or use your approved vendors, before I call for help? What is my process? Is it documented? Where is it kept?
Which safeguards must stay in place for my coverage to apply? Any nuances I should be aware of if I need to make a claim?
Get the answers in writing, and future you will be grateful because I hate to confirm your worst nightmare, but cybersecurity incidents are more common than you think. You’re not too small to be compromised, you’re too small to make the news!
Do a little ghost hunting
Here's a simple way to check your own policy:
Find your policy and your application. If you don't have a copy of the application, ask your agent for it.
Compare the answers to what's actually true today. MFA on? Backups running? Software updated? Using AI more than before? Be honest. Nobody is grading you.
Ask the five questions above.
Close the gaps, starting with the big ones. A password manager, MFA, and email authentication are a great start. Tested backups are another one insurers care about.
Need a hand with the technical side? Not sure where your setup stands? This free, self-guided IT Gap Check shows where your policies and systems are strong and where they need work. CISA also has a helpful page on turning on MFA.
One last thing: I'm an IT guy, not an attorney or insurance agent, so your policy language and your agent have the final word. I had to leave you with that disclaimer. You know your business better than anyone. Don’t be afraid to proactively advocate for it!
The bottom line
Cyber insurance is worth having and not worth assuming. Getting it wrong carries huge risk. A 20-minute check today beats a very bad surprise that affects your productivity and bottom line later.
Have a question or want a hand getting started? Get in touch here, and I'll be happy to give you the best guidance for your unique situation.
Missed the first two? Read The Scariest Thing in Your Business is a Reused Password and What Are Passkeys? All Treat, No Trick! link to blog when live
About the author: Kevin Dutkiewicz is the founder of TechBrews, providing practical IT and cybersecurity guidance to small businesses in Stow and across Northeast Ohio.