Key takeaways
- Cyber insurance underwriting has shifted decisively from questionnaires to evidence. Carriers in 2026 verify what you have, not just what you tick.
- For critical infrastructure customers, the questions cluster around four areas: exposed services, MFA on remote access, network segmentation, and proof of off-device logging and backups.
- Getting these wrong is no longer just a premium issue. The City of Hamilton was denied an $18 million payout because MFA had not been fully implemented across affected systems; Travelers voided a claim entirely after one server was found without MFA despite a blanket attestation.
- A Netcelero deployment answers the four core technical questions natively, with verifiable architectural evidence rather than a written attestation.
The cyber insurance market has changed shape. Five years ago, underwriting was a ten-question form. In 2026, it is a technical audit. According to research cited by Coalition, 82% of claims in recent years involved organisations without MFA in place. According to Aon, 96% of carriers now mandate enforced MFA across remote access, email, RDP, cloud applications and admin accounts. S&P Global projects 15 to 20% premium growth across the market in 2026 as carriers tighten further.
For decision makers responsible for renewable energy, water, transport, CCTV-monitored sites or any other critical infrastructure asset, the practical implication is that connectivity architecture is now an underwriting line item. The questions on the application form translate directly into properties of the network you have built around your sites.
This post translates the most common 2026 underwriter questions into the architectural answers that satisfy them, and shows where a Netcelero deployment makes those answers structural rather than aspirational.
What underwriters are actually asking
Reviewing application forms from Beazley, Coalition, Corvus, Chubb, AIG, Hartford, Travelers and others, four categories of question dominate for critical infrastructure customers:
- Exposed services. Are any management interfaces (firewalls, RDP, VPNs, admin portals, NVRs, RTUs, HMIs) reachable from the public internet? Underwriters now run their own external attack surface scans during quoting; about 73% of insurers do this routinely. The questionnaire and the scan must agree.
- MFA on remote access, comprehensively. Not “MFA enabled”. Not “MFA on email”. Enforced MFA across VPNs, RDP, SSH, email, cloud consoles and every privileged account. Carriers ask for the percentage of accounts protected, exception handling for service accounts, and proof from the identity provider.
- Network segmentation between critical systems and general network. Underwriters specifically ask whether OT, payment, CCTV and corporate IT systems sit on separate, firewalled segments. Flat networks behind a single perimeter are now a re-rating event.
- Logging, backups and incident response evidence. Is access to critical devices logged? Where do the logs live? Are backups tested and offline? Is there a written incident response plan with a tabletop exercise inside the last 12 months?
The shift is from “do you have this control” to “show us proof, dated and exportable”. Two cases from the public record explain why.
Why the answers matter financially
In 2024, the City of Hamilton was denied an $18 million cyber insurance payout after a ransomware attack because MFA had not been fully implemented across the affected systems. In Travelers v. ICS (2022), the carrier voided the entire claim after forensic investigators found a single server without MFA enabled, despite the attestation that MFA was enforced across all administrative access. In a 2025 case widely cited in the underwriting press, a $2.3 million claim was denied after a VPN account without MFA was exploited, despite a blanket attestation on the application.
The lesson from the case law is consistent. Partial implementation is not partial coverage; it is no coverage. An attestation that does not survive a single forensic check voids the policy, not just the claim. For a critical infrastructure operator, the question is not whether the architecture you have today is secure; it is whether it survives the underwriter’s external scan and a forensic team’s log review after the worst day of the year.
How a Netcelero deployment answers the four questions
The connectivity architecture we deploy on critical infrastructure sites is not designed primarily for the underwriter, but it answers their core questions natively. Each of the four categories above has a structural answer rather than a process answer.
Exposed services. The i-ctrl device itself exposes no SSH, web GUI or API on its public WAN interface. Device management runs entirely over an outbound VPN tunnel: the CPE initiates this tunnel from site back to our core network on boot, and all Netcelero administration of the device happens over that private management tunnel, in our Dublin or Amsterdam data centres, never via the public IP.
The public IP is a separate, client-configured data path. Depending on the client’s requirements, it can be bridged directly to the client’s own firewall, or have specific port forwards set up to individual devices on site (NVR, RTU, HMI, EMS, BMS, and so on). Where that configuration is in place, those specific services are reachable on the public IP by design, because that is the access the client has requested. Nothing beyond that configured scope is exposed.
An underwriter’s external scan against the site’s public IP will reflect exactly what has been configured: the specific bridge or port forwards the client has set up, and nothing more. There are no additional management interfaces, backdoors, or administrative surfaces on the public IP beyond that configuration. The questionnaire and the scan agree.
MFA on remote access. Customer portal access uses individual user accounts with MFA available. Support staff access to the i-ctrl is RADIUS-authenticated with MFA enforced on Netcelero’s side. No support staff member can reach the device without VPN access into Netcelero’s core plus an individual MFA-protected account. There are no shared credentials, and the management plane has no path that bypasses MFA.
Network segmentation. Our Dual Static IP feature on the i-ctrl places the OT control network and the safety, security or staff network on independent public IPv4 addresses, with no Layer 3 path between them. Inside each zone, VLANs and port isolation on managed switches separate sub-systems. For an underwriter, this is the cleanest possible answer to the segmentation question: not policy, but topology.
Logging, backups and IR evidence. Authentication events, configuration changes, tunnel state, failover events and connection attempts are logged back to the Netcelero customer portal, retained for six months in our core network. Customers receive auditable, exportable evidence of who accessed which device when, on demand, in the format underwriters and forensics teams expect.
For sites that need to demonstrate IEC 62443 alignment or NIS2 Article 21 compliance alongside their insurance attestation, the same architecture produces the evidence both audiences require, on the same connectivity device, without a separate firewall project.
What this means for the renewal conversation
For an asset owner, IPP, O&M provider or installer working with critical infrastructure customers, three observations are worth taking into the next renewal cycle.
First, the cheapest control to implement now is the architectural one, because it is permanent and produces its own evidence. Adding an i-ctrl to a site removes a class of underwriter questions for as long as that site is in operation, rather than requiring annual re-attestation that nothing has drifted.
Second, the renewal application itself is now an audit document. If the connectivity layer is structurally clean, the application gets shorter and the supporting evidence pack writes itself. If the connectivity layer is partially clean, the application becomes a long process of caveats and compensating controls, all of which the carrier can verify externally.
Third, the gap between the insured and the not-insured is widening. Carriers are moving capacity towards customers with strong, evidenced defences and moving away from those without. For critical infrastructure operators, being on the wrong side of that line is now a balance-sheet question, not just an IT one.
The Netcelero engineering team works with asset owners, IPPs, O&M providers, installers and brokers to design connectivity that satisfies underwriter scrutiny on day one and continues to satisfy it through every renewal.
If you would like to walk through your existing estate or a specific renewal application against the four questions above, please talk to your Netcelero account manager, or contact our team directly.
