If you renewed cyber insurance for your Houston small business in the last twelve months, you saw the changes firsthand. The questionnaire ballooned. The premium climbed. The exclusions tightened. And for some businesses, the renewal didn't happen at all.
Here's what local brokers are reporting, what underwriters are actually scoring, and how to qualify without paying enterprise pricing.
What 2026 underwriters are scoring
Cyber insurance pricing in 2026 is driven by a small number of risk factors. If you can document them, your premium is reasonable. If you can't, it isn't.
- MFA enforcement — on every account, including email and remote access. This is the single biggest factor.
- EDR coverage — on every endpoint, not just servers. Underwriters now ask which product and which version.
- Email filtering — with anti-phishing and attachment scanning.
- Backup strategy — offsite, tested, immutable preferred.
- Security awareness training — recurring, with a record of phishing simulation results.
- Patching cadence — documented SLA for critical patches.
- Privileged access controls — admin accounts separated from daily-use accounts.
- Incident response plan — written, tested, with current contact information.
The 20-question short-list to run before renewal
Three to six months before your policy renews, walk through these with whoever runs your IT. If any answer is "no" or "not sure," that's a gap to close before the questionnaire arrives:
- Is MFA enforced on every email account?
- Is MFA enforced on every remote access tool (VPN, RDP, RMM)?
- Is MFA enforced on every privileged / admin account?
- Does every laptop and server run EDR (not just antivirus)?
- What's the brand and version of your EDR?
- Is your email filter blocking phishing and malicious attachments?
- Are backups stored off-site or in a separate cloud tenant?
- Are backups immutable (cannot be deleted by an attacker)?
- When was the last test-restore?
- How long did that test-restore take?
- Do you have a written incident response plan?
- When was it last reviewed or tested?
- Do all employees take security training? How often?
- Do you run simulated phishing campaigns?
- What's your click-through rate in the last simulation?
- How quickly do you apply critical patches?
- Are admin tasks done from separate admin accounts?
- Have you had a security incident in the last 3 years? Documented?
- Do you have a documented vendor/supply-chain security program?
- Is there a designated security owner inside your business?
Controls that move premium the most
If you can only invest in three controls before renewal, in this order:
- MFA everywhere. Single biggest premium reducer. Often the difference between "quoted" and "declined."
- EDR on every endpoint. A close second. Underwriters know that traditional antivirus doesn't stop modern attacks.
- Immutable, off-site backups with documented restore tests. This caps your downside, which insurers love.
How to negotiate when premiums spike
If your renewal quote came back 30-60% higher than last year, you have a few moves:
- Get competing quotes. Different carriers weight different controls. The same risk profile can yield very different premiums.
- Show recent control improvements. If you added MFA / EDR / training in the last 90 days, ask for a re-quote with documentation.
- Adjust deductibles. A higher self-insured retention often drops the premium meaningfully without changing the catastrophic protection you actually need.
- Right-size coverage. Don't pay for $5M of coverage if your realistic ransomware exposure is $500K.
What to do next
Most Houston small businesses we work with are paying less for cyber insurance than they would on their own — not because we have a magic relationship with carriers, but because being on managed services with documented controls makes the questionnaire trivial to fill out.
If your renewal is in the next 6 months, book a free discovery call and we'll tell you which controls you're missing and how much you'd save by closing the gaps.
Aspendora Technologies provides managed IT services, cybersecurity, and data backup for Houston-area small businesses since 2010.