Why your IT setup now affects what your business insurance costs

Somewhere in your last business insurance renewal form, a new question appeared: Do you have endpoint detection and response software deployed across all devices?

For most directors and practice managers at Scottish SMEs, that question came out of nowhere. But getting it wrong now has real consequences, and most business owners have not caught up with how much the rules have changed.

What insurers now require

What insurers require	What it means in practice	Risk if absent
Multi-factor authentication (MFA)	Enforced on all accounts, email, VPN, and cloud platforms	Claim denial or refusal of cover
Endpoint detection and response (EDR)	Active threat monitoring on every device, not standard antivirus	Required by 88% of carriers as a minimum
Tested backups	Regularly taken and tested for recovery, with documented results	Ransomware coverage may be excluded
Patch management	Systems updated on a regular, documented schedule	Flagged as a significant risk indicator
Incident response plan	A written plan for when something goes wrong	Increasingly a condition of coverage

Why is now so important?

UK cyber insurance claim payouts reached £197 million in 2024, up from £59 million the year before. Insurers responded by tightening the criteria, and 21% of claims were denied or partially paid in 2025. The most common reason was straightforward: businesses had confirmed controls were in place that were not.

One widely referenced case involved a firm that confirmed MFA was enforced across all administrative access. After a ransomware attack, investigators found a single server where it had not been enabled. The insurer denied the entire claim. One overlooked login path, and the full cost of recovery landed on the business.

Firms that cannot demonstrate the required controls at renewal are also seeing premium increases of 30 to 50%, or finding ransomware coverage removed from their policy altogether.

What it means for your IT setup

MFA, endpoint monitoring, tested backups, patching schedules, and documented processes are not specialist security extras. They are the basics of well-managed IT. Across 30 to 100 users, keeping all of it consistent and accountable is not a job for whoever in the business is most comfortable with technology.

The UK Cyber Security and Resilience Bill, introduced to Parliament in November 2025, will tighten compliance expectations further. The gap between firms whose IT is properly managed and those making do is going to become harder to ignore.

What do consider before your next renewal

How your IT setup now affects what your business insurance costs and can you confirm MFA is enforced on every account in your organisation? That EDR is running on every device? That your last backup was tested and the results documented? If any of that is uncertain, it is better to find out now than at renewal.

At Innovec, we work with professional services firms, healthcare and dental practices, construction businesses, recruitment agencies, and third sector organisations across Scotland. If you want a straightforward conversation about where your business stands, we are ready to have it.

Call 01292 427 420 or email hello@innovec.co.uk

Frequently asked questions

Do Scottish SMEs need cyber insurance?

If your business handles client or patient data, processes payments, or runs across multiple staff and devices, the short answer is yes. 43% of UK businesses experienced a cyber breach in the past twelve months, and at 30 to 100 employees, an incident is significantly harder to absorb than most owners expect.

What IT controls do cyber insurers require?

The five baseline controls are enforced MFA, EDR on all devices, tested backups, documented patch management, and a written incident response plan. Requirements vary by insurer, but these are the starting point for most UK policies.

Can my IT setup lead to a claim being denied?

Yes. If controls stated on your application are found to be incomplete during a claims investigation, your insurer can deny the claim in full. It is currently the most common reason for denial in the UK market.

How does a managed IT provider help?

A managed IT provider maintains the controls, monitoring, and documentation that insurers check at renewal, and keeps them current as requirements change. It removes the risk of gaps appearing unnoticed across your organisation.