What Arizona builders need to know about buying, keeping, and actually collecting on cyber insurance in 2026
I was catching up earlier this month with an insurance broker friend of mine, listening to him describe a renewal he was oddly happy about.
His client had signed an annual cyber policy the year before at around $6,000. During that policy year, they got hit twice. Not by ransomware, not the kind of story that ends up in a newspaper. Just two of the everyday breaches every business is dealing with now. When renewal came up, the premium jumped to $10,000. A 67% increase.
And he was pleased.
“With that claims history,” he told me, “I was happy the market gave them a renewal at all.”
That sentence stuck with me. Because if you translate what he was actually saying, it goes something like this: your client could have paid double the premium, or worse, been told they were uninsurable, and you would have been standing there with no coverage and no leverage.
Now, that client was a law firm. But everything about that story is what I want every Arizona builder reading this to understand. Because construction is standing in the exact same spot the legal industry was standing in about three years ago.
The soft market that builders enjoyed on cyber premiums is ending. The underwriting standard that replaced it is stricter than most contractors realize. And the gap between the policy you bought and the policy you can actually collect on is bigger than it has ever been.
If you carry cyber insurance today, or you’re about to shop for it, this one’s for you.
Where the Market Actually Is
Let me set the table with real numbers, because there is a lot of noise on this subject and it is worth being specific.
The last five years of cyber insurance were a rollercoaster. From 2020 to 2023, the market hardened brutally in response to ransomware. Premiums doubled. Underwriters got surgical. Firms that had never once been asked about MFA suddenly could not renew without it. Then things eased. By late 2025, Marsh reported the eleventh consecutive quarter of cyber rate decreases. Coalition, one of the largest cyber carriers, was actively growing its book. Underwriters were more willing to write coverage.
Then the trend line broke.
S&P Global Ratings is now forecasting a 15 to 20 percent premium increase across 2026 following a 126 percent rise in ransomware incidents in the first quarter of 2025 alone, and an 800 percent surge in credential theft attacks. Construction was the most-targeted sector for ransomware in September 2025. Coalition’s 2026 Cyber Claims Report found that business email compromise and funds transfer fraud accounted for 58 percent of all cyber claims last year.
For construction firms, the market is still relatively affordable. Small and mid-size Arizona contractors are looking at annual premiums in the $1,000 to $2,500 range for a starter policy, or $3,500 to $15,000 for firms with real revenue and more exposure. Compared to healthcare or financial services, construction gets off cheap.
But that’s the premium. It is not the story.
The story is what the underwriter now requires you to prove before they write the policy, and what the claims team requires you to prove before they pay out.
The Application Has Become an Audit
Here is the shift most contractors have not caught up to yet.
Three years ago, a cyber insurance application was a one-page checklist. Do you have MFA? Do you have backups? Do you train your employees? Check, check, check, sign here. You paid your premium, hung the certificate on the wall, and hoped you never had to use it.
That is not how it works anymore.
The application in 2026 is closer to a compliance audit. Insurers now require documented proof of specific security controls, not self-reported assurances. You are not answering “do you have MFA” with a yes or no. You are being asked for screenshots showing MFA is enforced and active across specific categories: email, remote access, privileged administrative accounts, and cloud applications. You are being asked for documentation of backup testing, not just confirmation that backups exist. You are being asked for evidence that your incident response plan has been walked through, not just that a template lives somewhere on a shared drive.
This is the part that separates a paid claim from a denied claim.
Because here is what happens when you file. A cyber team goes back to your application, pulls up your answers, and starts comparing them to what your environment actually proves. If you said MFA was enforced on all remote access, and the forensic team finds a Remote Desktop connection sitting exposed on the public internet, that is not a small wording issue. That is a claim defensibility issue. The insurer’s position is that you materially misrepresented your controls. And in an industry with premiums this low, an insurer has very little reason to bend over backwards to pay a claim they can plausibly deny.
I want to say this as plainly as I can, because it is the most expensive misunderstanding I see in Arizona construction right now.
The policy you bought is not the policy you have. The policy you have is the one your environment can prove up on the day of the claim.
What Underwriters Actually Require in 2026
If you are looking at a renewal in the next twelve months, or shopping cyber for the first time, here is what carriers writing construction accounts in 2026 will expect you to have in place. This is not aspirational. These are the controls that get you insurable at a reasonable rate.
Multi-factor authentication, enforced everywhere it matters. Email. Remote access, meaning VPN and any remote desktop path. Privileged administrative accounts. Cloud applications like Microsoft 365 and Autodesk Construction Cloud. The specific word that matters here is “enforced.” Not “available.” Not “recommended.” Enforced.
Endpoint detection and response on every device. This is the successor to antivirus. It monitors for behavior that looks like an attack, not just files that match a known signature. If your MSP or IT provider is still positioning basic antivirus as adequate, they are three years behind the underwriting requirement.
Backups that are offline or immutable, and tested. The last part is the one people miss. Backups that “run every night” and show green in a dashboard are not the same thing as backups that have been restored in a test within the last ninety days. Ransomware operators actively hunt for and delete backup connections before they encrypt anything. If you cannot demonstrate a real restore, the underwriter is going to assume you cannot do one when it counts.
Annual phishing and awareness training, documented. Not a video everyone watched once in 2022. A running program with attendance records, phishing test results, and completion tracking.
A written incident response plan with assigned roles and tested contacts. Who calls the insurer’s breach hotline. Who takes systems offline. Who talks to clients. Who talks to the news if it comes to that. This lives in a document, not a person’s head.
Those are the five things every construction firm needs to be able to prove on paper. And the trap is not that most Arizona contractors do not have them. The trap is that most contractors think they have them and cannot actually prove it under scrutiny.
The Construction-Specific Risks You Are Paying to Cover
Construction cyber policies are cheaper than most industries because contractors historically held less regulated data than banks or hospitals. That is still true. But the risk profile is not the same as it was five years ago. Here is what your policy is actually protecting you against on a job in 2026.
Wire fraud, by a wide margin. This is the single largest cyber loss type in construction. A fraudster spoofs a subcontractor’s email, sends “updated banking instructions” to your AP team, and you wire the next payment to an account in Ohio you have never seen before. Wire fraud losses across construction and real estate have risen from $9 million to $446 million over the past decade. This is not a hypothetical. This is happening to a mid-size Arizona GC roughly every quarter. And here is the sneaky part: most standard cyber policies cover this under a “social engineering” or “funds transfer fraud” sublimit that defaults to $100,000. On a job where a single sub payment can be $250,000, that sublimit is a placeholder, not a solution. Ask your broker to explicitly increase your social engineering coverage. It is one of the most common gaps I see.
Ransomware on project systems. Your Procore instance. Your Sage or Foundation. Your Bluebeam sets. Your Autodesk Construction Cloud environment. When these get encrypted, project schedules stop, submittals stall, subs stop getting paid, and every downstream project on your board takes a hit. Average construction ransom payment in 2025: $254,000. Total incident cost including recovery, business interruption, and legal, commonly $1M to $5M for a mid-size firm.
Subcontractor supply chain risk. Your security is only as strong as your least-protected trade partner. A fraudster who compromises a small subcontractor’s email account gets legitimate access to your project communications, banking discussions, and document exchanges. The credentials are real. That is what makes these attacks hard to catch.
Contract-required coverage. Federal contracts, most large GCs, and increasingly bonding companies now require proof of cyber insurance to bid. A well-run contractor without a policy can lose a bid to a less-qualified firm that has one. This alone has moved cyber from “smart to have” to “cost of doing business.”
Questions to Actually Ask, Before You Sign
When you sit down with your broker for a new policy or a renewal, here is the set of questions that separates a policy that will pay from one that just looks good in the certificate.
THE COVERAGE QUESTIONS
- What is my social engineering and funds transfer fraud sublimit, and is it enough to cover a single day’s largest possible payment on my biggest active project?
- Is business interruption coverage included, and how many days of downtime does it actually pay for?
- Does the policy cover contingent business interruption if the incident happens at a critical vendor (like Procore, my accounting platform, or a major sub)?
- What are the specific exclusions? What events or circumstances would leave me with no coverage?
- Is there a breach response team included, or do I coordinate lawyers, forensics, and PR on my own after an incident?
THE UNDERWRITING QUESTIONS (ABOUT YOU)
- Which of the underwriter’s required controls does my firm currently meet, and which do I need to close before this policy binds or renews?
- If I have to file a claim, what specific evidence will the insurer ask me to produce to prove my controls were in place?
- What is my broker’s role if a claim is disputed, and how many construction claims has this specific carrier paid in the last two years?
THE ONGOING DISCIPLINE QUESTIONS (THE ONES NOBODY ASKS)
- When and how do we review our answers to the application throughout the year, so we do not walk into a claim with a stale attestation?
- Who owns the discipline of keeping the underlying controls in place, and what is the review cadence?
- What happens at renewal if we’ve quietly drifted out of compliance during the year?
That last set is the one that separates contractors who collect on claims from contractors who fight for months and get denied.
A Framework, Not a Purchase
The most important shift I want every Arizona builder to make about cyber insurance is to stop thinking about it as a product you buy and start thinking about it as a discipline you maintain.
The policy is not the thing. The policy is a representation of a set of controls you keep running. If the controls stay in place, the policy pays. If the controls drift, the policy is decoration.
That framework has three parts.
Acquisition. Work with a broker who understands construction specifically, not a generalist. Get real numbers on your current gaps before you fill out the application, so your attestations match reality. Increase your social engineering sublimit. Read the exclusions. Ask about the specific carrier’s construction claims record.
Implementation. Close the control gaps that came up during the application. This is where an MSP that understands construction environments earns its keep. MFA is not a switch you flip once. It is a design decision across your email, your remote access, your admin accounts, your Autodesk, your Procore, your Sage. Backups are not a green dashboard. They are a tested restore. An incident response plan is not a document. It is a rehearsed sequence.
Maintenance. Schedule a quarterly review of your control posture. Document changes. If you add a new SaaS tool, extend MFA to it before the underwriter asks. If you hire a new admin, add them to the IR plan. Every renewal is a chance to either tighten or slip. The firms that tighten are the ones the insurers write policies for at reasonable rates. The firms that slip are the ones that find out they were uninsured the day the wire went to the wrong account.
Back to the Story
The broker I opened this piece with was happy about a 67% premium increase because the alternative would have been “no coverage at all.” Two breaches in a policy year is not unusual anymore. What was unusual was that the claims got paid, because the firm had done the underlying work to make sure they were paid.
They had MFA on the systems that mattered. They had backups that had been tested. They had documentation of the training their team went through. They had an IR plan they had walked through. So when the incidents happened, the insurer paid, the firm recovered, and they got a renewal offer at all.
That is not luck. That is discipline.
The construction firms that are going to come out the other side of the 2026 hardening cycle in one piece are the ones treating cyber insurance the same way they treat every other kind of insurance on a job. As a system that requires ongoing attention, not a certificate that lives in a folder.
You would never bid a job and skip inspecting the work as it goes up. Do not renew a cyber policy and skip inspecting the controls that make it worth anything.
The policy you bought is not the policy you have. The policy you have is the one your environment can prove up on the day of the claim.
Make sure they are the same policy.
For over 20 years, Computer Dimensions has been the trusted IT partner for Arizona’s architecture, engineering, and construction industry. We help AEC firms communicate better, collaborate smarter, and actually use the technology they’ve invested in. Because in construction, the tools only work if your team does.
IT Built For Builders.
