A cyber insurance carrier that does not want to continue covering you, or does not want to pay a claim, sends a letter. The letter is written by people who choose words carefully, because the words have legal consequences. To the person who receives it, the letter often reads as a wall of polite, impenetrable insurance language. It is not impenetrable. It is a small set of specific phrases, each of which means something precise and each of which has a different correct response.
We read these letters with clients more often than we would like. Here is the translation.
"Material misrepresentation": the most serious phrase in the letter.
If the letter uses the words "material misrepresentation," "rescission," or "the policy is void from inception," stop and read carefully, because this is the most serious thing a cyber letter can say. It does not mean the carrier is declining to renew. It means the carrier is asserting the policy was never validly in force, because the application contained a statement that was materially false.
The landmark illustration is Travelers v. International Control Services. As Lockton's analysis of the case describes, the insured had represented on its application that it used multi-factor authentication. After a loss, it emerged that MFA was deployed on the firewall but not on the servers. The carrier moved to rescind the policy entirely on the grounds that the application's MFA representation was a material misrepresentation. The court's handling of the case made the point unambiguous: an inaccurate control answer on the application is not a technicality. It can void the entire policy, retroactively, leaving the insured with no coverage for the loss it just suffered.
What to do when you see this language: this is the phrase that warrants coverage counsel, not a phone call to the broker alone. Rescission is a legal assertion with legal defenses. Whether the misrepresentation was actually material, whether it was made knowingly, and whether the carrier relied on it are all contestable questions. But they are contested through counsel, on a clock, and the worst response is to argue the technical facts informally with the adjuster before understanding the legal posture.
"Inadequate security controls": a declination, not an accusation.
If the letter declines to offer renewal terms (or offers them at terms you cannot accept) and cites "inadequate security controls" or "the risk does not meet our underwriting guidelines," this is a different and less severe situation. The carrier is not asserting you lied. It is saying that, on the controls it can see, it does not want this risk at a price you will pay.
The Insurance Journal's coverage of the Arctic Wolf Cyber Insurance Outlook Report quantified how common this is: 26% of client rejections were attributed to inadequate security controls and 21% to insufficient documentation. Note the two are distinct. "Inadequate controls" means the controls are not there. "Insufficient documentation" means the controls may be there but the carrier could not verify them. These call for different responses, and the letter usually signals which one you are dealing with.
What to do: this is remediable, and the existence of a competitive market matters here. Marsh's market commentary describes an environment with ample capacity, which means a declination from one carrier is not a declination from the market. The correct response is to (a) determine from the letter whether the problem is missing controls or unverifiable controls, (b) close or document the specific gap, and (c) remarket the account with the gap addressed and the evidence assembled. A declination on inadequate controls is a fixable problem with a defined fix, not a verdict.
"Failure to maintain stated controls": the post-binding trap.
A third phrase appears on claim denials specifically: language to the effect that coverage is denied because the insured "failed to maintain the controls represented at binding." This is distinct from misrepresentation. The carrier is not saying the application was false when submitted. It is saying the control was true at binding and was allowed to lapse before the loss.
This is the version of the problem we see most often in practice, because it does not require anyone to have lied. MFA was enforced when the policy bound. A migration, a vendor change, or a configuration drift carved out an exception. The exception was the entry point. The carrier's position is that the policy was conditioned on maintaining the represented posture, and the posture was not maintained.
What to do: this is partly a coverage-counsel question and partly a factual-evidence question. The defense lives in the evidence: if the control was maintained and the carrier is wrong about the lapse, the contemporaneous evidence (configuration history, change logs, monitoring records) is what proves it. This is precisely why a continuously maintained evidence record matters before a claim, not after. The insured who can produce dated evidence that the control was operating at the time of loss is in a fundamentally stronger position than the one reconstructing the history under denial.
"Non-disclosure of risk" and the policy-terms denials.
The Insurance Journal data also surfaced two other claim-denial categories worth naming: 25% of claim rejections fell outside policy terms, and 17% cited non-disclosure of risk on applications. The first is the cleanest: the loss was a type the policy does not cover, and the dispute, if any, is about policy interpretation. The second is a softer cousin of material misrepresentation: not an affirmative false statement, but a failure to disclose something the application asked about.
What to do: policy-terms denials are interpretation disputes; coverage counsel reads the policy language against the loss facts. Non-disclosure denials sit closer to the rescission category and warrant the same caution: do not concede the materiality of the non-disclosure informally before understanding whether it was actually material and actually asked.
What you can actually do after any of them.
Regardless of which phrase the letter uses, the insured is not without recourse. The NAIC's consumer guidance is explicit that state Departments of Insurance investigate unfair claim delays and denials, as well as cancellations or non-renewals the policyholder believes are unjustified, and that an insurer cannot retaliate against a policyholder for filing a complaint.
The practical sequence after a denial or non-renewal letter:
- Identify the phrase. Misrepresentation/rescission is the most serious and warrants counsel immediately. Inadequate controls is remediable. Failure to maintain is an evidence question. Policy-terms is an interpretation question.
- Preserve everything. Do not have an informal technical argument with the adjuster before you understand the posture. What you say can become the carrier's evidence.
- For declinations, remarket. A competitive market means one carrier's no is not the market's no. Fix the cited gap, assemble the evidence, and re-approach the market.
- For denials, escalate correctly. Coverage counsel for the legal questions; the state Department of Insurance complaint process for unfair-denial or unjustified-nonrenewal questions.
The letter is designed to be read as final. It is more accurate to read it as a specific assertion in specific language, each version of which has a specific and often productive response. The worst outcome is treating a remediable declination as a verdict, or treating a rescission assertion as a misunderstanding to be cleared up casually with the adjuster. Translate the phrase first. The right response follows from the words the carrier actually chose.