Claim denial: can an insurer refuse a claim over an application answer?

SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state.

Definition

Taken on its own, a denial is a carrier decision that one particular claim is not covered under the policy. An inaccurate application answer can support one, either directly, where the policy makes stated controls a condition or excludes loss arising from their absence, or indirectly, where the carrier pursues the broader remedy of rescission and unwinds the policy altogether.

Denial and rescission are not the same thing. A denial refuses one claim and leaves the policy standing. Rescission removes the policy from inception, taking every claim under it. Carriers sometimes pursue both, seeking rescission and arguing in the alternative that this claim is not covered.

How it works in a cyber policy

The sequence is what makes application answers matter more in cyber than in most lines.

A cyber claim of any size produces a forensic investigation, because the carrier funds one. That investigation exists to scope the incident, but it inevitably documents the control state: which credential was compromised, whether it required a second factor, whether the endpoint ran a detection agent, whether backups were reachable from the compromised account, how far back the logs went.

The adjuster then has the application on one side and the forensic report on the other, describing the same controls. Nobody has to go looking for a discrepancy. If there is one, it appears in the ordinary course of adjusting the claim, on the controls the form asked about, which are the same controls the attacker used.

Where that discrepancy exists and is material, the carrier has options: reserve rights while it investigates, seek rescission, deny on an exclusion or condition, or negotiate a reduced settlement. In practice a negotiated outcome is more common than an outright denial, which is one reason there is so little published case law and so much folklore.

What these two disputes actually show

The two US matters cited most often show how rarely this reaches a decision. Columbia Casualty Co. v. Cottage Health System was dismissed without prejudice in July 2015 on a procedural ground, and the refiled action produced no published merits ruling either. Travelers Property Casualty Co. of America v. International Control Services, Inc. ended in August 2022 with the policy rescinded by stipulation of the parties rather than after a contested hearing.

Both are evidence that carriers reach for application answers; neither is precedent about what happens when they do. The full record is on the rescission page.

What this means for the answer you are about to sign

Two proportionate conclusions follow.

The risk is real but narrow. It concentrates on a small number of controls that are conditions of quoting and are trivially verifiable after a loss: MFA on email and remote access, MFA on privileged accounts, backup immutability, EDR coverage, and the claims and circumstances disclosures. Almost every dispute worth reading about turns on one of those.

And it is largely avoidable before signing, not after. Every one of those controls can be read from the environment on the day the form is completed. An organisation that answers from a dated reading, and declares the gaps it has rather than the posture it intends, has removed nearly all of the exposure that this page describes, without improving a single control.

Where the evidence for that answer lives

The controls that appear in claim disputes are the same ones that appear at the top of every cyber application. The question library covers each of them: what the underwriter is measuring, where the answer lives in Microsoft 365, Entra ID, and Azure, and what separates a defensible yes from an optimistic one.

Frequently asked

Can a cyber insurer deny a claim over a wrong application answer?

It can. An inaccurate answer can support a denial where the policy makes the stated controls a condition or excludes loss arising from their absence, and it can support rescission of the whole policy where the inaccuracy was material to the underwriting decision. Whether either succeeds depends on materiality, the policy wording, and the law of the governing state. In practice a negotiated or reduced settlement is more common than an outright denial.

How would the carrier even find out?

Through the forensic investigation it pays for. That report documents the control state around the compromised asset as a matter of course: whether the account required a second factor, whether the endpoint ran EDR, whether backups were reachable. The adjuster reads it alongside the application.

How often does this actually happen?

There is very little published US case law, which suggests these disputes usually resolve privately rather than that they do not occur. The two matters most often cited, Columbia Casualty v. Cottage Health System and Travelers v. International Control Services, both ended without a contested ruling on whether the answers were false.

What if the wrong answer had nothing to do with the loss?

That helps considerably. Several states restrict an insurer's remedy to inaccuracies that increased the risk or contributed to the loss, and a materiality test tends to reach the same place. An inaccurate answer on a control the attacker never touched is a much weaker basis for a denial than one on the control they used.

What should an organisation do if it discovers an answer was wrong after binding?

Raise it with the broker, and take coverage counsel if the answer touched a material control. Correcting the record before a loss is a very different conversation from having it discovered during a claim investigation. Nothing on this page is legal advice, and this is exactly the point at which the organisation wants someone advising on its specific policy.

Sources

Every statement about a court case on this page is drawn from the documents and reporting below. Links open on the publisher's own site.

• Columbia Casualty Co. v. Cottage Health System, complaint filed 7 May 2015 (copy via Internet Archive; docket available on PACER and CourtListener) Internet Archive
• Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016) Covington, Inside Privacy
• Travelers, policyholder agree to void current cyber policy (30 August 2022) Insurance Journal
• Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022) Lockton

Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015), refiled as No. 2:16-cv-03759 (C.D. Cal.); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill., stipulated judgment August 2022). Dockets are available on PACER and CourtListener.

Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship.

Related terms

Back to the glossary