Michael J. Bannach: Before You Sign a Cyber Insurance Application, Ask for the Evidence

In July 2022, Travelers asked a federal court in Illinois to rescind a cyber insurance policy it had issued to International Control Services. According to Travelers, the company’s application and a signed MFA attestation said it required multifactor authentication for employee email, all remote network access, and administrative access to its servers, backups and network infrastructure. After a ransomware attack, Travelers alleged that the company had protected only its firewall with multifactor authentication, leaving the server the attackers reached without it. In August 2022, the parties agreed to void the policy from its inception, leaving no coverage for the claim. The case ended in an agreement, and it does not mean every inaccurate answer voids a policy. It does show what an insurer can do when the application and the network disagree.

For Michael J. Bannach, President and CEO of Stealth Technology Group (STG), the case is the clearest illustration of a shift most executives have not absorbed. “Leaders treat the insurance application as paperwork their IT person fills out,” said Bannach, a CISSP with more than 25 years in enterprise IT and cybersecurity. “It’s a set of promises the company makes about its controls, and the insurer is going to check them at the worst possible moment: after the claim.”

Why the Questions Got Harder

Cyber insurers learned expensive lessons during the ransomware surge, and their applications show it. Renewal questionnaires now ask in detail about multifactor authentication, endpoint detection and response, offline or immutable backups, privileged account management, patching timelines and employee training.

The questions are specific because the losses are. Ransomware was present in 48 percent of breaches in Verizon’s 2026 Data Breach Investigations Report, and the 2025 edition found it in 88 percent of breaches at small and mid-sized businesses. Among the breached organizations IBM studied for its 2026 Cost of a Data Breach Report, the average cost reached a record $4.99 million.

Where Honest Companies Get It Wrong

Most misstatements are not lies, Bannach said. They are imprecise answers to precise questions. “Do you require an MFA?” gets a yes because email has it, while the VPN, the backup console and a service account do not. “Are backups tested?” gets a yes because a restore worked two years ago. “Is endpoint protection deployed on all devices?” gets a yes that does not account for the machines nobody inventoried.

“The gap between ‘we have MFA’ and ‘every remote path and every admin account has MFA’ is exactly where ransomware gets in,” Bannach said. “It’s also exactly where a coverage dispute starts.”

The consequences land on leadership. At ICS, the chief executive signed the application. The answers become part of the basis for the policy, and a denied claim or a rescinded policy turns a security incident into a balance-sheet event.

Treat the Application Like a Financial Statement

Bannach’s advice is to run the application through the same discipline a CFO applies to financial reporting. Give each answer an owner and a piece of evidence: a multifactor coverage report, a restore test log, an asset inventory reconciled against the endpoint console. Define the terms before answering. If the application asks about all remote access, list every path and confirm each one.

Where the honest answer is “not yet,” say so and attach the remediation plan with dates. Bring the broker in early rather than at the deadline, because a broker can often place a company that is candid about a gap and has a plan to close it. Then keep the evidence current between renewals. The application describes the company on one day, and an incident can happen on any other.

That last point is the thinking behind STG’s Stealth 360°™ Continuous Assurance model, which gives leadership current, documented evidence of what is working rather than an annual snapshot.

“A renewal questionnaire is a list of promises,” Bannach said. “I want every client to be able to hand their broker the evidence behind each answer on the day it’s asked, and to know it’s still true a month later.”

Before the Next Renewal

For a mid-market company, the cyber policy is often the main financial backstop after a ransomware event. A misstatement can turn that protection into a denied claim, and the signature on the application is often an executive’s. The time to test the answers is before the renewal is signed, not after the ransom note arrives.

“Read your application the way a claims adjuster will read it after an incident,” Bannach said. “Then make sure you can prove every answer.”

Michael J. Bannach is President and CEO of Stealth Technology Group (STG), one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies and defense suppliers. STG is a Cyber AB Registered Practitioner Organization with teams serving Tampa, Sarasota, Boston and Greater Philadelphia. A CISSP with more than 25 years in enterprise IT and cybersecurity, Bannach also holds CCNP Enterprise and CCNP Collaboration certifications, a certificate in AI products and services from MIT, and an Executive MBA from Saint Joseph’s University. Learn more at michaelbannach.com and stealthtech365.com.