Factors That Affect Your Cyber Insurance Premium

What Underwriters Actually Look At

Across the industry, a consistent set of factors shows up in how cyber liability insurance gets priced:

• Annual revenue, as a proxy for potential loss severity
• Industry and sector risk
• Volume and sensitivity of data held, including customer PII, health records, and payment card data
• Security controls in place, especially multi-factor authentication (MFA), endpoint detection and response (EDR), and patching practices
• Prior claims history
• Coverage limit and deductible selected

Why MFA Gets Singled Out

Multiple industry sources describe multi-factor authentication as one of the single most heavily weighted controls in cyber underwriting today. The logic is straightforward: a large share of claims trace back to compromised credentials, and MFA directly closes that door. Some applications now ask pointed yes/no questions about MFA on email, remote access, and privileged accounts specifically because it moves the needle on risk that much.

Claims History

A prior claim doesn’t just affect your renewal with the same carrier, it can affect pricing across the market for several years. The exact percentage impact varies by claim severity and isn’t something any carrier publishes as a fixed table, but the general pattern (a claim raises future premiums, and repeat claims can lead to non-renewal) is well established.

What You Can Actually Control

Revenue and industry are fixed. Security controls are not. Enabling MFA everywhere it’s offered, keeping systems patched, and training employees on phishing are the levers most likely to show up favorably on your next application.