Cyber Insurance — Example Renewals Workflow
How a typical cyber-insurance broker’s renewal cycle looks today, end to end. Used during Tenzi design partner sessions to show the shape of a workflow map deliverable. Anonymised composite — not any one broker’s practice.
Niche. Cyber insurance — first-party data breach response, business interruption, ransom/extortion, third-party liability and regulatory response. Crime / social engineering often sits as a sister policy. Typically 1–2 policy types per client. 90%+ of submissions are manual (security questionnaires by email); the remainder via cyber underwriter portals.
Trigger & setup
The renewal lands in the team’s view, and the file is opened up in the CRM.
Renewal trigger
5–10 min60–90 days before renewal date. Cyber underwriters typically give more notice than other lines because security questionnaires take time to compile. Either underwriter sends a renewal notice, or the team monitors policy schedules manually.
Questionnaire & preparation
The pack goes out, the client returns it, and the broker re-validates security posture against last year’s baseline.
Renewal pack sent to client
30–45 minRenewal cover letter + cyber security questionnaire (often 6–12 pages, sometimes 20+) + crime questionnaire if applicable + compliance docs (FSG, target market determination, terms of engagement, informed consent). Cyber and crime are usually different underwriters, so multiple emails go out.
Client fills out the questionnaire
2–3 hrsBack-and-forth on incomplete or vague answers is the biggest time sink in the entire workflow. “Do you have MFA on all admin accounts?” — client answers vaguely or skips technical questions. Underwriter comes back days later asking for evidence: screenshots, EDR vendor confirmations, backup test logs.
Cyber-specific: security posture re-validation
45–60 minUnderwriters re-validate security controls year on year. Last year’s MFA coverage might have slipped after a SaaS migration. Backup posture might have changed when the company moved to a new MSP. New tools (AI assistants, SaaS platforms) introduce new risk surface. Underwriter may impose new minimums (EDR, immutable backups, MFA on remote access) before agreeing to quote.
Review & quoting
Risk conversation with the client, comparative quoting across cyber underwriters, and the recommendation back.
Broker review meeting
60–90 minOnce the questionnaire is back, schedule a call with the client. Focus on cyber risk landscape, threat trends in their sector, control improvements, M&A activity, new SaaS/AI rollouts that affect cover, regulatory changes. This is where the value sits — but the broker often can’t get to these conversations because admin eats the time.
Comparative quoting
2–3 hrsSubmits to 2–4 cyber underwriters. Most submissions are still email-based; only a minority of carriers expose portals. Waits for quotes plus subjectivities (commonly “subject to evidence of MFA, EDR, immutable backups”). Reviews wording — cyber wordings vary hugely market to market, and the differences matter.
Client recommendation
30–45 minEmail with recommended carrier, premium comparison, coverage summary, uninsured risks called out (often around regulatory fines, reputational harm, or specific exclusions). Attach quote, schedule, policy wording, PDS.
Binding & payment
Confirmation, closing documents, payment chasing, and the certificate that lets the client carry on with their business.
Binding / closing
20–30 minClient confirms by email. Compliance system generates invoice (to client) + closing document (to underwriter — premium breakdown, commission segments). Underwriter sends certificate of currency, invoice, policy docs.
Payment tracking
15–30 min ongoingClients don’t pay on time. Premium not paid = policy not fully bound. Compliance flags outstanding premiums after a fixed window. Broker prefers premium funding (monthly) — gets paid immediately. Upfront payments mean a chasing game.
Certificate of currency
5–10 minCan’t issue until premium is paid. Compliance requirement. Cyber clients often need this urgently — for SOC 2 audits, vendor due diligence, government tenders, M&A processes. The certificate is increasingly a contractual checkpoint rather than a nice-to-have.
Post-renewal
Where the broker wants to spend time — and where the calendar runs out today.
Post-renewal check-ins
aspirationalIdeally 3 / 6 / 9 / 12 month check-ins. Currently doesn’t happen — no time. This is where business changes get missed: new SaaS rollouts, M&A activity, new geographies, new regulated data types, new third-party integrations.