A cyber insurance claim denied after an attack usually traces to 1 of 6 causes. An application answer that wasn’t accurate. A security promise that lapsed. Late notice. A vendor the carrier never approved. An exclusion. A sublimit. This guide walks through each one, with the proof Dallas-Fort Worth owners should keep. If you haven’t started yet, begin with our guide to cyber insurance readiness for Dallas-Fort Worth businesses.
A cyber insurance claim gets denied when the carrier decides the loss sits outside the policy or the business broke a promise it made on the application. Nobody can argue their way out of that after an incident. You show it on paper, or you don’t.
I’ll start with what I can’t promise. No IT provider can guarantee a claim gets paid. The carrier decides, the policy wording decides, and sometimes a judge decides.
What I can do is explain where the fights happen. They cluster in a few predictable places. If you run a company in Dallas, Fort Worth, Plano, Irving or anywhere else in the metroplex, the same few mistakes cost the same few kinds of money, and you can usually spot them long before anyone files a claim.
Why do cyber insurance claims get denied?
A cyber insurance denial is the carrier’s written decision that it won’t pay all or part of a claim, either because the policy doesn’t cover the loss or because the insured didn’t meet a condition. Rescission goes further. The carrier treats the policy as if it never existed.
Reed Smith’s June 2023 review of pressure points in cyber insurance policies maps the disputes that reach lawyers. Six matter here.
- An application answer that wasn’t accurate, which can lead to a denial or an attempt to rescind the whole policy.
- A minimum security standard the policy says you must maintain, paired with an exclusion that bites when a control slips.
- Notice that reached the carrier late.
- Incident response vendors you hired before the carrier agreed to them, so the early bills go unpaid.
- A named exclusion such as war or hostile acts, which the NAIC’s 2024 cyber report says U.S. policies typically include.
- A sublimit that caps something you assumed was covered, like damaged hardware or legal fees beyond working out who to notify.
Look at what’s missing from that list. Nothing on it says “you got hacked.” Being breached isn’t why a carrier walks away. What you said before, what you kept doing, and what you did in the first few days are. It’s conduct.
How often do carriers actually deny cyber claims?
Less often than the scary statistics suggest. And nobody publishes a clean denial rate.
The closest public number sits in the NAIC’s 2025 cybersecurity insurance report, which covers 2024 data. U.S.-domiciled insurers closed 28,555 claims without payment and 9,941 with payment. That’s nearly 3 to 1. It looks damning. Then you read what’s being counted. NAIC reports closures, not causes. A claim closed without payment could be a denial, but it could just as easily be a loss smaller than the deductible, a withdrawn claim, or a precautionary notice from a company that never lost anything at all.
The market context moved in 2025. Insurance Journal’s October 27, 2026 write-up of the NAIC’s newest report says the cyber loss ratio worsened to 53 from 48.7, on about $9.5 billion of direct premium including surplus lines, so losses took a bigger bite of every premium dollar even as the market kept growing. That doesn’t read as stinginess.
You’ll also see “40% of cyber claims get denied” in vendor blogs. I couldn’t trace that figure to the NAIC, a carrier filing, or any dataset a reader can check. I wouldn’t repeat it.
Here’s my read. Flat denial is rarer. The ones that worry me are quieter, like a reduced payout, an argument over which vendor bills count, or a reservation of rights letter that hangs over a claim for months while you’re trying to run a business.
What did Travelers, Cottage Health and Merck teach businesses?
Three disputes get cited again and again, and they teach three different things. None of them is a Texas ruling, so treat them as warnings about how carriers argue, not as predictions about how a Dallas or Fort Worth court would rule if your policy and your facts ever landed in front of one.
| Dispute | What the carrier argued | How it ended | What it means for a DFW business |
|---|---|---|---|
| Travelers v. International Control Services (C.D. Ill., filed July 6, 2022) | The April 2022 application said MFA protected administrative or privileged access. After a May ransomware attack, Travelers said ICS used MFA only on its firewall. | On August 26, 2022 the parties stipulated to rescission, “null and void, from its inception,” with no coverage for past, present or future claims. | An MFA answer has to be true for every account the question covers, and you need a dated report that shows it. |
| Columbia Casualty v. Cottage Health (C.D. Cal., filed May 2015) | After a $4.125 million breach settlement, the carrier sought reimbursement under a “Failure to Follow Minimum Required Practices” exclusion. | Reed Smith reports no outcome, and I couldn’t find a published ruling on the exclusion. | Security promises are ongoing. A control you had at signing and let slip can still be used against you. |
| Merck and its insurers (New Jersey courts, NotPetya) | Insurers invoked a hostile or warlike action exclusion on about $700 million of a property program. | An appeals court held the insurers hadn’t shown the attack was hostile or warlike, and Merck later reportedly settled, on confidential terms. | Exclusions are written broadly and fought narrowly. It was a property policy, so read your cyber policy’s own war wording. |
The facts of the first row come from Insurance Journal’s filing report and its coverage of the stipulation. The Merck facts are from Claims Journal’s January 2024 report. Travelers’ claims in the filing were allegations until the parties settled. Allegations, not findings. Nobody tested them at trial.
Hypothetical, not a client. Picture a 60-person freight broker in Irving. The application says MFA covers all administrative access, and email admins have it and so does the firewall, but the backup console and two domain admin accounts don’t, because a token got lost in 2024 and the exception never got reversed. Nobody lied. Every answer was true for whichever system the person happened to check.
That’s the ICS pattern, and it’s ordinary. It’s also the one we can prevent.
What do DFW businesses need to prove when something goes wrong?
Proof comes in 3 piles. What was true when you signed, what you did in the first days, and what the incident cost. The control-by-control evidence for the first pile is in our guide to cyber insurance application questions. I’ll stick to the incident.
| Moment | What the policy or the law tends to expect | What to have in hand |
|---|---|---|
| First sign of trouble | Prompt notice to the carrier. Deadlines are set by your policy, and Reed Smith advises reporting right away. | A printed copy of the notice clause and the claims hotline number, kept where a ransomware lockout can’t reach it. |
| Hiring responders | Prior written consent for vendors that aren’t pre-approved. Early costs can go unpaid without it. | A forensics firm, breach counsel and your IT provider agreed with the carrier or broker in writing before you need them. |
| A ransom demand | Carrier involvement, and per Reed Smith some carriers require proof that the payment was reasonable. | A written record of who decided, when, and what the alternatives were. |
| Texas notices | 60 days to notify affected people, and 30 days to notify the Attorney General once 250 or more Texans are involved. | A notice plan your counsel has already reviewed. These clocks run separately from your carrier’s. |
| Proof of loss | Documented costs, downtime and the timeline of events. | Invoices, payroll records for idle staff, and an incident log with timestamps. |
| The controls themselves | The state of your security on the day of the incident, matching what you wrote on the application. | Microsoft Entra sign-in and Conditional Access exports, Microsoft Defender coverage reports, and backup job history that cover that date. |
The Texas deadlines come from Chapter 521 of the Business and Commerce Code. Read them next to your policy, because the carrier’s notice window and the state’s clocks have nothing to do with each other, and the carrier’s can be much shorter. Different clocks entirely.
Our average response time is 5 minutes. That’s a number about the help desk. It says nothing about who phones the carrier. Unless the runbook names a person and a phone number, nobody makes that call, and an alert that was triaged in minutes turns into a notice problem three weeks later that nobody connected to the claim.
Then there’s the signature. In the ICS matter the application was signed by the company’s CEO and by a person responsible for network and information security. That’s the right instinct. Whoever signs is vouching. An outside provider can supply the evidence but can’t sign for you. Proof first. Signature second.
What should you do before your next renewal?
Our cyber insurance renewal checklist covers the paperwork side. For claims, these are the moves I’d put first.
- Audit your own MFA answer. Count every system the question covers, then count the ones that actually enforce it.
- Pick your forensics firm and breach counsel now, and ask your broker to confirm them in writing.
- Print the notice clause, the claims hotline and your broker’s cell number. One copy goes in the office, and one goes in a password manager that doesn’t depend on your domain.
- Get the full policy, not the summary, and read the exclusions and conditions pages with a pen.
- Run a one-hour tabletop on a single question. Who calls the carrier?
Here’s the correction. “Answer the application honestly” is necessary and not enough. Controls drift between the day you sign and the day something breaks, which is the ground the Cottage Health carrier chose to stand on when it pointed to a “Failure to Follow Minimum Required Practices” exclusion after the breach.
If you want a second set of eyes, our cybersecurity services in Dallas and managed security services in Fort Worth include checking the answers on your application against what your systems really do on an ordinary Tuesday. And if you already have a security lead who exports these reports every month, you probably don’t need us for this part. For the broader picture of what a policy pays for, read what cyber insurance covers, and for the day it all goes wrong, our data breach response plan for Texas businesses. You can also contact us directly. Comparing providers first? Our ranking of the best IT companies for cyber insurance in Dallas-Fort Worth shows how 11 of them score.
Questions DFW owners ask about denied claims
Can a carrier deny my claim over a mistake on the application?
Yes. Inaccurate application answers are a recognized ground for denial or rescission, and the Travelers policy at issue in the ICS case ended up void from inception over an MFA answer. Outcomes depend on policy wording and Texas law. Get counsel involved early.
Is a claim closed without payment the same as a denial?
No. Closure isn’t denial. The NAIC counts claims closed without payment but doesn’t say why they closed. A denial is one reason, and a loss below the deductible is another. That’s why the 28,555 versus 9,941 split in its 2024 data can’t be read as a denial rate.
If we don’t have MFA everywhere, will the carrier refuse a ransomware claim?
Not automatically. It depends on what you told the carrier and what the policy requires. The trouble in the ICS case was the gap between a written answer and the real setup. A control you disclosed as missing is a different conversation from one you said was in place.
How soon do I have to tell the carrier?
Check your notice clause today, because deadlines differ by policy. Reed Smith’s advice is to report incidents immediately and to negotiate extended reporting periods of at least 30 days. Texas breach notices follow their own clocks, with 60 days to notify affected people and 30 days to notify the Attorney General once 250 or more Texans are involved, and your carrier’s deadline doesn’t pause for either of them. Neither clock waits.
Can I bring in my own forensics firm?
Only with the carrier’s consent if your policy requires it. Reed Smith warns that carriers may refuse early costs for vendors hired without prior consent, so get your preferred firms approved before an incident.
Who should sign the application, my broker, my IT provider or me?
An officer of the company signs, with IT evidence behind each answer. In the ICS matter the CEO and a person responsible for network and information security signed. We’ll pull the reports, but we won’t tell you to sign something your own systems contradict, and a good broker won’t either.
What should I do the day a claim is denied?
Ask for the decision in writing, with the policy provisions the carrier relied on, and call coverage counsel before you reply. Anything you say in that first response can end up in the file the carrier builds, so let counsel shape it. Then gather your evidence. Logs roll over. A reservation of rights letter is not a denial yet, but it tells you where the carrier is looking.
Want to know whether your answers would survive a claim? We’ll compare what your cyber insurance application says with what your Microsoft 365 tenant, devices and backups can actually show, and put every gap in writing. You keep the findings either way.
Book a Security Controls Review
