--- title: "Claim denial: can an insurer refuse a claim over an application answer?" url: https://insuranceposture.com/glossary/claim-denial category: "Glossary, consequence terms" term: "Claim denial" updated: 2026-08-24 --- # Claim denial: can an insurer refuse a claim over an application answer? URL: https://insuranceposture.com/glossary/claim-denial Section: Glossary, consequence terms Term: Claim denial Yes, it can happen, and the honest version of the answer is more useful than the scary one: it is uncommon, it is concentrated on a handful of controls, and it is largely avoidable at signing time. SecValley research team. Reviewed 2026-08-24. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state. ## Definition Yes, a cyber insurer can contest a claim over an inaccurate application answer, either by denying that claim or by rescinding the policy outright, but only where the inaccuracy was material. A claim denial is an insurer's decision that one particular claim is not covered, and in practice a negotiated reduction is more common than an outright refusal. Taken on its own, a denial is a carrier decision that one particular claim is not covered under the policy. An inaccurate application answer can support one, either directly, where the policy makes stated controls a [condition](/glossary/condition-precedent) or excludes loss arising from their absence, or indirectly, where the carrier pursues the broader remedy of [rescission](/glossary/rescission) and unwinds the policy altogether. Denial and rescission are not the same thing. A denial refuses one claim and leaves the policy standing. Rescission removes the policy from inception, taking every claim under it. Carriers sometimes pursue both, seeking rescission and arguing in the alternative that this claim is not covered. ## How it works in a cyber policy The sequence is what makes application answers matter more in cyber than in most lines. A cyber claim of any size produces a forensic investigation, because the carrier funds one. That investigation exists to scope the incident, but it inevitably documents the control state: which credential was compromised, whether it required a second factor, whether the endpoint ran a detection agent, whether backups were reachable from the compromised account, how far back the logs went. The adjuster then has the application on one side and the forensic report on the other, describing the same controls. Nobody has to go looking for a discrepancy. If there is one, it appears in the ordinary course of adjusting the claim, on the controls the form asked about, which are the same controls the attacker used. Where that discrepancy exists and is material, the carrier has options: reserve rights while it investigates, seek rescission, deny on an exclusion or condition, or negotiate a reduced settlement. In practice a negotiated outcome is more common than an outright denial, which is one reason there is so little published case law and so much folklore. ## What these two disputes actually show The two US matters cited most often show how rarely this reaches a decision. Columbia Casualty Co. v. Cottage Health System was dismissed without prejudice in July 2015 on a procedural ground, and the refiled action produced no published merits ruling either. Travelers Property Casualty Co. of America v. International Control Services, Inc. ended in August 2022 with the policy rescinded by stipulation of the parties rather than after a contested hearing. Both are evidence that carriers reach for application answers; neither is precedent about what happens when they do. The full record is on the [rescission page](/glossary/rescission). ## Not legal advice SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state. Statements on this page about what a party did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact; neither matter was decided on the merits. If a live application, renewal, or claim depends on any of this, take advice from a licensed broker and qualified coverage counsel. Last reviewed 2026-08-24. ## What this means for the answer you are about to sign Two proportionate conclusions follow. The risk is real but narrow. It concentrates on a small number of controls that are conditions of quoting and are trivially verifiable after a loss: MFA on email and remote access, MFA on privileged accounts, backup immutability, EDR coverage, and the claims and circumstances disclosures. Almost every dispute worth reading about turns on one of those. And it is largely avoidable before signing, not after. Every one of those controls can be read from the environment on the day the form is completed. An organisation that answers from a dated reading, and declares the gaps it has rather than the posture it intends, has removed nearly all of the exposure that this page describes, without improving a single control. ## Where the evidence for that answer lives The controls that appear in claim disputes are the same ones that appear at the top of every cyber application. The question library covers each of them: what the underwriter is measuring, where the answer lives in Microsoft 365, Entra ID, and Azure, and what separates a defensible yes from an optimistic one. ## Related questions - [Is multi-factor authentication enforced on all email access?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-email-access) - [Is MFA enforced on all privileged / administrative user accounts?](https://insuranceposture.com/questions/multi-factor-authentication/mfa-enforced-privileged-administrative-user-accounts) - [Are backups kept offline (disconnected) or immutable / air-gapped?](https://insuranceposture.com/questions/backup-and-recovery/backups-kept-offline-immutable-air-gapped) - [Awareness of any fact / circumstance reasonably giving rise to a future claim?](https://insuranceposture.com/questions/incident-response/awareness-fact-circumstance-reasonably-giving-rise-future-claim) ## Frequently asked ### Can a cyber insurer deny a claim over a wrong application answer? It can. An inaccurate answer can support a denial where the policy makes the stated controls a condition or excludes loss arising from their absence, and it can support rescission of the whole policy where the inaccuracy was material to the underwriting decision. Whether either succeeds depends on materiality, the policy wording, and the law of the governing state. In practice a negotiated or reduced settlement is more common than an outright denial. ### How would the carrier even find out? Through the forensic investigation it pays for. That report documents the control state around the compromised asset as a matter of course: whether the account required a second factor, whether the endpoint ran EDR, whether backups were reachable. The adjuster reads it alongside the application. ### How often does this actually happen? There is very little published US case law, which suggests these disputes usually resolve privately rather than that they do not occur. The two matters most often cited, Columbia Casualty v. Cottage Health System and Travelers v. International Control Services, both ended without a contested ruling on whether the answers were false. ### What if the wrong answer had nothing to do with the loss? That helps considerably. Several states restrict an insurer's remedy to inaccuracies that increased the risk or contributed to the loss, and a materiality test tends to reach the same place. An inaccurate answer on a control the attacker never touched is a much weaker basis for a denial than one on the control they used. ### What should an organisation do if it discovers an answer was wrong after binding? Raise it with the broker, and take coverage counsel if the answer touched a material control. Correcting the record before a loss is a very different conversation from having it discovered during a claim investigation. Nothing on this page is legal advice, and this is exactly the point at which the organisation wants someone advising on its specific policy. ## Sources - Internet Archive: [Columbia Casualty Co. v. Cottage Health System, complaint filed 7 May 2015 (copy via Internet Archive; docket available on PACER and CourtListener)](https://archive.org/details/031121143231) - Covington, Inside Privacy: [Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016)](https://www.insideprivacy.com/data-security/cybersecurity/cyber-insurer-seeks-to-void-data-breach-coverage-because-of-purported-misstatements-in-policy-application/) - Insurance Journal: [Travelers, policyholder agree to void current cyber policy (30 August 2022)](https://www.insurancejournal.com/news/national/2022/08/30/682564.htm) - Lockton: [Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022)](https://global.lockton.com/us/en/news-insights/travelers-v-ics-underscores-need-to-respond-carefully-to-cyber-insurance) Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015), refiled as No. 2:16-cv-03759 (C.D. Cal.); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill., stipulated judgment August 2022). Dockets are available on PACER and CourtListener. Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship. ## Related terms - [Rescission](https://insuranceposture.com/glossary/rescission) - [Misrepresentation](https://insuranceposture.com/glossary/misrepresentation) - [Condition precedent](https://insuranceposture.com/glossary/condition-precedent) - [Materiality](https://insuranceposture.com/glossary/materiality) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.