Baltimore business owners are getting cyber insurance claims denied over missing paperwork, most often proof that a required security control was in place when the incident happened. This piece looks at what insurers are checking in 2026 and why the human side of the business draws the closest scrutiny when a claim gets reviewed.
What insurers check before paying a cyber insurance claim
Fitch Ratings’ 2024 US cyber analysis found that only 26% of US cyber insurance claims closed in 2024 resulted in an indemnity payment, down from 35% the year before, even as the number of claims filed jumped nearly 60%. More policies are being triggered by real incidents. Fewer of them are resulting in a payout, and the pattern shows up across claim sizes, including smaller incidents that never make headlines. A denied claim tends to make next year’s renewal harder too.
Insurers weigh whether the business can prove its controls were in place at the time of the incident more heavily than the size of the loss itself. Coalition, one of the larger cyber insurers, names multi-factor authentication and cybersecurity training among its core requirements for coverage and points out that most breaches start with a human mistake somewhere in the chain, whether that’s a clicked link, a reused password, or a payment request approved without a second look. Backup and access controls round out its checklist, and we covered the fuller Maryland requirements picture last year. What’s changed since then is enforcement. Insurers now expect written documentation at renewal, with dates, completion records, and evidence the control was live at the time of an incident. Smaller businesses without a dedicated IT team are the ones most likely to have skipped that step. A 10-person operations firm and a 75-person distribution company get held to the same standard on this point, even though only one of them typically has staff whose job is to track it.
Why human error draws the closest scrutiny
Verizon’s 2026 Data Breach Investigations Report found that software vulnerabilities passed stolen credentials as the most common way attackers get in, the first time that’s happened in the report’s 19-year history. Software gets patched on a schedule. Attention doesn’t work the same way, and insurers know it. The same report found that mobile-based social engineering, fake texts and phone calls, is now succeeding 40% more often than before. Attackers didn’t move away from people. They moved to a channel employees are trained to trust more and watch less, which is exactly the kind of shift a static, once-a-year training video was never built to catch. The same report also flagged a sharp rise in employees using unapproved AI tools at work, another human habit that technical controls alone can’t fully account for and that a well-run training program can address directly.
IBM’s Cost of a Data Breach Report puts the average US breach cost at $10.22 million, an all-time high, and the global average at $4.44 million. That figure gives insurers a direct financial reason to check whether the human layer was covered as closely as the network perimeter before a claim gets paid. A firewall shows up cleanly on a security audit. Whether an employee would spot a fraudulent payment request over a text message is harder to verify, which is precisely why insurers are asking for records they can pull up during a claim review. Training is also one of the few requirements on the list that costs relatively little to put in place, which is part of why it has now become a baseline expectation on most policies.
What documented employee training looks like
Insurers want proof that each employee completed training on a set schedule, along with phishing simulation results showing how staff responded when tested. A completion log paired with those simulation results is the kind of record that holds up at renewal. A single video shown during onboarding two years ago doesn’t produce that. A recurring tracked program does, and it happens to be the one control on the list that a business can build without waiting on new hardware or a vendor contract.
TTP Cyber Hub was built to provide exactly this for Baltimore SMBs. It delivers short monthly modules with built-in phishing simulations and keeps a completion record for every employee, so when a broker asks for proof at renewal, the answer is a report the broker can file. New modules roll out on a set schedule, so the program stays current without anyone in the office having to manage it by hand, and the same records that satisfy an insurer also give ownership a clearer read on where the team’s weak spots are. Our guide to building a repeatable training schedule walks through how to structure that cadence across a small team, and you can see how the platform itself works on the cybersecurity awareness training page.
This requires proof that the habits and tools already in place are documented clearly enough for an insurer, or a business owner reading their own policy for the first time, to see them. A renewal questionnaire is a strange thing to fill out under pressure, and most owners only look closely at it once, right after a claim has already gone sideways. If you want a second look at your renewal questionnaire before it goes back to your broker, we’re happy to walk through it with you.
