Can a small business get cyber insurance without an IT department?

Yes, and most do. The controls are products, not headcount: MFA is a setting in Microsoft 365 or Google Workspace, endpoint detection is a subscription, and immutable backups are a feature of the backup service. An outside IT provider can put all five in place, and the application asks who that provider is.

Does the cyber application ask about AI tools?

Increasingly. Technology and professional forms now ask whether AI is used in the product or service, which models, and how customer data reaches them, and several carriers have added AI wording to the policy itself. A business that uses AI on customer data should expect the question and want the affirmative wording.

How long does a cyber quote take?

A day or two when the controls are in place and the application says so plainly, because most cyber carriers quote from the questionnaire without an underwriter call. A week or more when an answer is missing or "in progress", because the carrier waits or declines.

A small office desk at dusk with a laptop showing a security settings screen with multi-factor authentication switched on, a hardware security key, an external backup drive and a printed questionnaire with its boxes ticked

What does a cyber insurance application ask, and what do you need in place to be quoted?

A cyber application in 2026 is a security questionnaire more than an insurance form. It asks whether every email account and remote login uses multi-factor authentication, whether every computer runs endpoint detection rather than plain antivirus, whether backups exist that ransomware cannot reach and when you last restored from them, and whether staff are trained to spot phishing. Then it asks about the business: revenue, how many personal records you hold, whether you take card payments, and any incidents in the last three to five years. The controls decide whether you can be quoted at all. The business questions decide the price.

Call/Text(626) 344-2158

MFA on. Key on the desk. Backup drive plugged in.Five controls open the door. The application is a check that they are real.

/ Start here

Cyber liability, explained.

What the policy pays for, the limits that fit, and the questions a licensed agent walks you through.

Cyber liability, explained

/ Don’t want to read all this?

Send us what you have. We’ll tell you if it’s right.

Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.

Have it reviewed Call/Text(626) 344-2158

The detail

In 2026 cyber insurers require multi-factor authentication, endpoint detection and response on every endpoint, immutable tested backups, a written incident response plan and security awareness training.
Consilien, "Cyber Insurance Requirements: 2026 Readiness Checklist"
MFA on all remote access and all privileged accounts is the single most consistently cited control in cyber underwriting, and full coverage of email and remote access is the baseline; partial deployment no longer satisfies most underwriters.
Huntress, "Cyber Insurance Requirements: 10 Controls Carriers Expect and How to Meet Them"
The backup question has moved from whether backups exist to whether they are immutable, offsite and tested for restoration; a backup ransomware can encrypt does not count.
Decryption Digest, "Cyber Insurance Requirements 2026: MFA, EDR, Logging"
Misrepresenting controls, even unintentionally, is the single biggest cause of cyber claim denials, and carriers can rescind coverage when attested controls were not maintained on the day of the loss.
Armour Cyber, "Why Cyber Insurance Applications Get Rejected or Repriced"
The cyber and technology applications in this agency's bank ask, beyond the controls, for annual revenue, the count of records holding personal or health information, payment-card handling and PCI status, use of outside IT providers, and prior incidents, and the technology forms add questions about contracts, subcontracted development and the use of AI in the product.
Boring Insurance question bank, 237 applications read, measured 2026-09-25

What this means for you

Fix the five controls before you apply, not after.An application that says no to MFA or to tested backups is declined or priced with a ransomware exclusion. Turning MFA on takes an afternoon; a tested backup takes a week. The quote you get afterwards is a different quote.
Answer as of today, and keep it true.The application is a warranty. If MFA was on when you applied and someone turned it off for a contractor in March, the July claim can be denied on the March change. Put the controls on a checklist someone owns.
Count your records honestly.The number of people whose personal or health information you hold sets the limit you need and part of the price. It is customers, employees, applicants and patients, not just the ones in the current system.

Go deeper on any of these

Need this handled?

Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.