A Utah construction company gets hit with a business email compromise attack. An attacker impersonates a vendor and redirects a $180,000 payment to a fraudulent account. The owner files a claim with their cyber insurance — and gets denied because they didn’t have multi-factor authentication enabled, which was a requirement of their policy.

Cyber insurance is one of those things that sounds straightforward until you read the fine print. Here’s what Utah business owners actually need to know.

What Cyber Insurance Covers

A standard cyber insurance policy typically includes two types of coverage:

First-party coverage — your direct costs:

• Incident response and forensic investigation
• Data restoration and system recovery
• Business interruption losses (lost revenue while systems are down)
• Ransomware payments (though some policies now exclude these)
• Breach notification costs (legal requirement in Utah for personal data)
• Credit monitoring for affected individuals
• PR and crisis management

Third-party coverage — claims from others:

• Legal defense costs from lawsuits filed by affected customers or partners
• Regulatory fines and penalties
• Settlements or judgments
• Payment Card Industry (PCI) fines if card data is compromised

What It Doesn’t Cover

This is where many business owners get surprised:

Failure to maintain security standards. If your policy requires MFA, patching, or backup testing and you haven’t done it, claims can be denied. This is the most common reason for denial.

Known vulnerabilities left unpatched. If you knew about a vulnerability and didn’t fix it, most policies won’t cover the resulting breach.

Social engineering losses (sometimes). Some policies exclude BEC/wire fraud unless you’ve purchased specific social engineering coverage as an add-on.

Infrastructure failures. Hardware failures, power outages, and non-malicious system crashes are typically not covered by cyber insurance.

War and state-sponsored attacks. Most policies have “war exclusion” clauses that can be invoked for attacks attributed to nation-state actors.

What Insurers Require Before They’ll Cover You

Cyber insurance applications have gotten dramatically more detailed over the past three years. Insurers now ask specific technical questions about your security controls, and the answers determine both your eligibility and your premium. Here’s what most carriers require:

Multi-factor authentication (MFA) on all remote access, email, and admin accounts. This is non-negotiable for virtually every carrier. No MFA = no policy.

Endpoint detection and response (EDR). Traditional antivirus is no longer sufficient. Insurers want to see behavior-based detection on all endpoints.

Regular backup testing. Having backups isn’t enough — you need to prove you test them. Some carriers ask for restoration test documentation.

Employee security awareness training. Regular phishing simulations and training sessions demonstrate that you’re addressing the human factor.

Patch management. A documented process for applying security updates within a reasonable timeframe (typically 30 days for critical patches).

Incident response plan. A documented plan for handling a security incident, including roles, communication procedures, and recovery steps.

How to Get the Best Rate

Improve your security posture first. Every additional control you implement reduces your premium. MFA alone can drop your rate by 10-15%.

Work with a broker who specializes in cyber. Generic business insurance brokers often don’t understand the technical questions. A cyber-specialized broker can help you present your security posture accurately and find carriers that fit your risk profile.

Bundle with your existing business insurance. Some carriers offer better rates when cyber is added to an existing commercial policy.

Know your data. Understand what types of data you hold (PII, PHI, financial, intellectual property), how much of it there is, and where it’s stored. This directly impacts your coverage needs and premium.

Get Cyber Insurance Ready

At Brivy IT, we help Utah businesses both qualify for and maintain cyber insurance coverage. We’ll audit your current security posture against common insurer requirements, implement the controls you’re missing, and provide the documentation carriers ask for during the application process. Reach out for a free security assessment — we’ll tell you exactly where you stand and what you need to qualify.