In February 2024, ransomware took down roughly 80% of the City of Hamilton, Ontario's network. Property tax processing, business licensing, transit planning, and the fire department's records system all went dark. The attackers demanded $18.5 million. The city refused to pay and spent $18.3 million on recovery instead. A $5 million cyber insurance policy was in place to absorb part of that loss. In July 2025, the insurer denied the claim (Source: allCare IT). The reason was not the attack. It was multi-factor authentication that had been identified as a requirement years earlier and was never fully deployed.
Hamilton is the visible example of something now unfolding quietly inside thousands of organizations. Holding a cyber insurance policy and being covered by it are two different things, and the distance between them is a material financial exposure that most leadership teams are carrying without knowing it.
The Attestation Gap
Cyber insurance underwriting runs on a security questionnaire. Is MFA enforced across all accounts? Is endpoint detection and response deployed on every endpoint? Are backups immutable? Are patches applied within a defined window? Someone in the organization answers yes, an authorized signatory approves the application, and a policy is issued.
That signature carries more weight than most leadership teams recognize. The answers are a contractual attestation, a continuing warranty that those controls are in place and enforced every day the policy is active (Source: allCare IT). The application is not a one-time qualifying exam. It functions more like a policy that requires the organization to keep passing the exam continuously, because when a breach occurs, the insurer conducts a post-incident forensic investigation and compares what was attested against what was actually running in the environment at the moment of compromise.
When those two things diverge, the claim can be denied in full. This is the attestation gap: the distance between the security posture the organization certified and the security posture it can prove was live when it mattered.
The precedent is now settled. In the 2024 Travelers v. International Control Services case, the insurer moved to rescind a cyber policy entirely after finding the company had attested that MFA was deployed across all systems when it was only partially implemented. The court sided with the insurer and the ransomware claim was denied, not because the MFA gap caused the breach, but because the attestation was inaccurate at the time of underwriting (Source: Intelecis). Intent was not a factor. The misrepresentation, even unintentional, was sufficient. That ruling became the template insurers have applied ever since.
This Is Not an Edge Case
The scale is what elevates this from an operational detail to a governance concern. More than 40% of cyber insurance claims filed in 2024 and 2025 were denied, most commonly due to missing security controls or policy misrepresentations (Source: NAIC 2025 Cybersecurity Insurance Report). Incomplete MFA deployment alone accounts for a disproportionate share of those denials (Source: NAIC 2025 Cybersecurity Insurance Report).
Verification has also grown more sophisticated. Some carriers now scan public-facing assets and compare what they observe against what was claimed on the application, so an attestation of MFA everywhere against an external service that does not enforce it can become grounds for denial (Source: ASi Networks). Claims have been rejected because endpoint detection logs retained only 30 days of history when the policy assumed 90 (Source: ASi Networks). The underwriting standard has moved from "does the organization have security" to "prove it, continuously, and prove it was enforced at the moment of the incident."
For a leadership team, the implication is direct. The organization may be reporting cyber risk as transferred and mitigated on the strength of a policy that would not survive a forensic review. That is an exposure sitting on the balance sheet without appearing on it.
Why Well-Governed Organizations Still Get Denied
The organizations getting denied are rarely negligent in the ordinary sense. They invested in tools. Leadership was told the environment was protected. The failure is almost always one of three quieter kinds, and each is a failure of verification rather than intent.
The first is partial deployment. MFA is enforced on most accounts but not the service account an attacker locates. EDR covers managed laptops but not the server where the breach originates. Insurers treat "mostly" as "no," because a single unprotected path is all an attacker requires and all a carrier needs to invoke the misrepresentation clause.
The second is drift. A control that was genuinely in place at application time quietly lapses. A backup job begins failing. A patch cycle slips past its defined window during a demanding quarter. No one surfaces it until the forensic report does, and by then the attestation no longer reflects reality.
The third is the evidence problem. Even organizations that maintained their controls frequently cannot produce the time-stamped logs and configuration records proving those controls were active when the incident occurred. The protection existed, but the proof did not, and to an insurer conducting a forensic review, unprovable protection and absent protection are indistinguishable.
Closing the Gap Requires Controls That Are Verified, Not Merely Owned
The uncomfortable reality beneath all of this is that cyber insurance does not reduce organizational risk. It transfers financial consequences, and only when the underlying controls are real, enforced, and documented. The security program is what determines whether the policy responds. This is why the leadership teams most confident in their coverage are often the most exposed, because confidence built on tools owned rather than controls continuously verified is precisely the confidence the attestation gap punishes.
Closing the gap means treating the controls insurers require as an ongoing operational discipline that is monitored, maintained, and evidenced, rather than a questionnaire completed once at renewal. That is the premise our Complete Package is built on. The controls underwriters now demand map directly onto what the package delivers and sustains as a managed service: MFA and identity monitoring, managed endpoint detection and response with 24/7 oversight from our Canadian-based SOC, immutable backup and recovery, vulnerability scanning with prioritized patching, security awareness training, and the time-stamped logging that produces the evidence a forensic review will require. Strategic cybersecurity leadership sits above all of it, so controls do not drift out of alignment between renewals and so the organization has a defensible, board-ready account of its posture at any point in time.
The Warranty That Responds Before the Claim Does
One further layer is worth understanding at the leadership level, because it addresses the timing exposure the attestation gap creates. Even when a claim is ultimately valid, insurance takes time to investigate, verify, and pay, and that delay falls during the exact window when an organization is absorbing the heaviest recovery costs.
The Complete Package includes a $500,000 Certification Warranty through our partnership with Cysurance. It is designed as a first line of financial response, reimbursing recovery expenses following a qualifying ransomware or business email compromise event across ransomware and BEC costs, compliance penalties, cyber legal liability, and business income loss. Because the warranty is tied directly to the security controls we implement and maintain, it responds quickly when those controls are circumvented, and it can function as a deductible buy-back covering the out-of-pocket costs and waiting periods inside an existing cyber insurance policy. The warranty is the immediate first response. Insurance remains the instrument for catastrophic, large-scale loss. They operate together, and the warranty is not itself an insurance product.
There is a further strategic benefit that closes the loop. Because a certified, warranty-backed security program measurably lowers an insurer's risk, Complete Package clients gain streamlined access to cyber insurance through the Cysurance partnership at significantly reduced premiums, frequently without the lengthy questionnaires that create attestation exposure in the first place. When controls are verified and continuously maintained, the organization presents as a lower-risk insured, and that shows up directly in premium rates and in whether a claim pays.
The Question to Bring to Your Next Renewal
Organizations that discover their attestation gap during a breach discover it at the worst possible moment, when options are narrower and the cost is higher. Those that surface it deliberately, in advance, address it on their own terms and with far more leverage.
So the question worth bringing to the next renewal is not whether the organization holds cyber insurance. It is whether every control the organization attested to is enforced across every account and every system today, and whether the team could prove it if a forensic investigator asked. If leadership cannot answer that with confidence, the uncertainty itself is the exposure, and it is worth resolving before an attacker and an underwriter resolve it first.
We offer a complimentary Security Infrastructure Resilience Assessment that maps an organization's current controls against what insurers now require and identifies exactly where the gaps sit. Start at quickintel.com/assessment/security-infrastructure-resilience-assessment, review the Complete Package at quickintel.com/solutions, or reach us at sales@quickintel.com
