By Gregory Lemmon | Managing Director, UBIQUITY Ltd
Cybersecurity & Disaster Recovery Consultants to the Caribbean
There is a conversation happening in insurance offices across the Caribbean that most business owners never hear about until they are sitting in one.
A business has experienced a cyberattack. Systems are down. Data is compromised. The financial damage is mounting. The business owner picks up the phone and calls their insurer relieved that they had the foresight to take out a cyber liability policy.
And then the claim gets denied.
Not delayed. Not partially covered. Denied.
The reason? The business did not meet the security requirements written into the policy they signed. Requirements they either did not read carefully, did not understand fully or assumed their general IT setup satisfied without anyone ever checking.
This is not a rare outcome. It is becoming one of the most consistent and costly surprises in Caribbean business risk management. And it is almost entirely preventable if the conversation happens before the incident rather than after it.
Cyber liability insurance has grown rapidly as a product across the Caribbean market over the past several years. More Caribbean businesses carry some form of cyber coverage today than at any point previously which is genuinely positive progress.
The problem is what happens between purchasing the policy and actually needing it.
Most Caribbean business owners buy cyber insurance the same way they buy any insurance product. They speak with a broker. They receive a policy document. They pay the premium. They file the document. They move on.
What very few do is read the security requirements embedded in that policy the conditions that must be continuously met for coverage to apply. And what almost none do is verify that their actual IT setup satisfies those conditions at the time of purchase and maintains them throughout the policy period.
Insurers are not passive parties in this relationship. They are making actuarial calculations about risk. When a claim arrives, the first thing their assessors look for is whether the policyholder maintained the security posture they represented when the policy was issued.
If the answer is no and in a significant proportion of Caribbean cyber claims it is the policy does not respond.
Cyber liability policies issued in 2026 contain specific, measurable security requirements. These are not vague recommendations. They are contractual conditions. The most common ones and the ones most frequently cited in claim denials include the following:
Multi-Factor Authentication
MFA is now a standard requirement on virtually every cyber liability policy issued in the current market. Not a recommendation. A requirement. Specifically on email, remote access systems, financial platforms and privileged administrative accounts.
A business that experiences a breach through a compromised email account and does not have MFA enabled has almost certainly breached a policy condition. The claim will be examined against this specific requirement. If MFA was not active the insurer has grounds to deny.
Patch Management
Policies require that operating systems, software and firmware are kept current typically within 30 to 90 days of patches being released. A system running unpatched software that is subsequently exploited through a known vulnerability gives the insurer a clear basis for denial. The vulnerability was known. A patch existed. The business did not apply it.
Backup and Recovery
Most cyber policies require that the insured maintains regular, tested backups stored separately from primary systems. The word tested is significant. An untested backup that fails during a ransomware recovery is not just an operational problem it may be a policy compliance problem if the policy required verified backup capability.
Access Management
Policies increasingly require that access controls are actively managed meaning former employee credentials are revoked promptly, privileged access is limited to those who require it and user accounts are reviewed regularly. A breach that enters through a dormant former employee account will be examined against this requirement.
Security Awareness Training
A growing number of policies require that staff receive documented cybersecurity awareness training at defined intervals typically annually. A phishing attack that succeeds against an untrained team in a business that has never run a training programme gives the insurer a legitimate basis to question coverage.
Incident Response Planning
Some policies now require that the insured maintains a documented incident response plan. A business that has never produced one and handles the incident in a chaotic, undocumented way may find that the absence of a plan affects how the claim is assessed.
Here is where it becomes genuinely complicated for Caribbean businesses.
Each of these requirements, taken individually, might seem manageable. But insurers do not assess them in isolation. They look at the aggregate security posture of the business at the time of the incident.
A business that has MFA enabled but has not patched systems in eight months, has never tested backups, has three former employee accounts still active and has never run staff training is not a business that has broadly met its policy requirements with one gap. It is a business with a pattern of non-compliance.
Insurers and their forensic assessors are experienced at building this picture quickly. The post-incident investigation is thorough. Log files, system configurations, access records, patch histories all of it gets examined. What looks like a cybersecurity claim quickly becomes a compliance review.
And when the compliance review reveals a pattern of unmet requirements, the insurer’s position shifts from processing a claim to defending a denial.
There is a dimension to this that Caribbean business owners rarely understand and urgently need to.
When a cyber liability policy is issued, the insured makes representations about their security posture. Some of these representations are made explicitly on application forms that ask specific questions about MFA, backup, patch management and access controls. Others are made implicitly by accepting policy conditions.
If those representations are inaccurate whether through misunderstanding, incomplete information or genuine misrepresentation the insurer may have grounds not just to deny the claim but to void the policy entirely.
Policy voidance is a different and significantly worse outcome than claim denial. A denied claim means the specific incident is not covered. A voided policy means the entire coverage is treated as if it never existed potentially including previous claims.
Most Caribbean business owners who have completed a cyber insurance application have answered questions about their security controls based on what they believed to be true. Many of those beliefs are sincere. Some of them are inaccurate.
The application asked: “Do you have Multi-Factor Authentication enabled on your email systems?”
The business owner said yes because they enabled it on their own account when they set up the business. They did not know that three staff members who joined later never had it configured. The insurer’s assessors will find this discrepancy.
Having worked with businesses across the Caribbean on cybersecurity for over a decade, the gaps that create insurance exposure are consistent and, more importantly, correctable.
Treating insurance as a substitute for security rather than a complement to it
Cyber insurance is not a replacement for a security strategy. It is a financial backstop for when a security strategy, despite being properly implemented, still results in an incident. A business that carries cyber insurance but has not built the security posture the policy requires has not transferred risk. It has paid a premium for coverage it will not be able to access when it needs it.
Not reading the policy security requirements before purchasing
Every cyber liability policy contains a schedule of security requirements. Many Caribbean business owners have never read it. Their broker explained the coverage, not the conditions. The conditions are where the risk lives.
Not verifying that current security controls meet policy requirements
There is a gap between what a business believes its security posture is and what it actually is. That gap exists in most of the businesses I have assessed. The insurance policy was written against a representation. The actual environment may not match the representation. Nobody has checked.
Not maintaining security controls throughout the policy period
A business that met all policy requirements at the time of issuance and gradually fell out of compliance as staff changed, systems expanded, patches were deferred is still exposed. The policy requires continuous compliance. Not just compliance at the point of purchase.
Not understanding the exclusions
Cyber liability policies contain exclusions that are often broader than business owners realise. War and nation-state exclusions. Prior known circumstances exclusions. Unencrypted data exclusions. Insider threat exclusions. Social engineering sublimits that cap coverage for business email compromise at a fraction of the total policy limit typically the category most likely to affect a Caribbean SMB.
The conversation that should happen before a Caribbean business purchases or renews cyber liability coverage is a security assessment conducted against the specific requirements of the policy they are considering.
This means understanding exactly what the policy requires, evaluating whether the current security posture meets those requirements in practice, identifying the gaps between the policy requirements and the actual environment and addressing those gaps before the policy is bound.
It means reading the exclusions carefully particularly the social engineering and business email compromise sublimits, which are often where businesses need coverage most.
It means establishing ongoing processes to maintain compliance throughout the policy period not just at renewal.
And it means someone taking ownership of this conversation as a business priority rather than a document to be filed in and forgotten.
The businesses that successfully claim on their cyber liability policies are not the ones that had the most expensive coverage. They are the ones that understood what their policy required and built their security posture to match and exceed it.
Cyber liability insurance is genuinely valuable. A properly structured policy, held by a business with a security posture that meets its requirements, provides meaningful financial protection against an increasingly expensive category of risk.
But across the Caribbean market, there is a significant gap between the number of businesses that carry cyber insurance and the number that would successfully claim on it if they needed to today.
That gap is not the insurer’s fault. It is an information gap and a verification gap. Caribbean businesses are purchasing products they do not fully understand and implement, against requirements they have not verified, to protect against risks they have not adequately assessed.
Closing that gap does not require a large budget or a costly technical team. It requires a conversation, specific, honest and conducted before the incident makes it urgent.
The most expensive cyber insurance claim is not the one that gets paid. It is the one that gets denied after the incident has already occurred, when the options have narrowed and the damage is already done.
UBIQUITY Ltd works with Caribbean businesses to build security postures that meet cyber insurance requirements, close the gaps that lead to claim denials and ensure that coverage actually responds when it is needed.
Cybersecurity Assessments are available for Caribbean businesses including a review of existing cyber liability policy requirements against your current security controls.
Contact Us-
📧 Email: info@ubiquityltd.com
📞 Phone: +1 (284) 547-6754
Calendly Link- https://calendly.com/glemmon-wpi/15min?month=2026-07
