A critical content management system vulnerability alert issued on 10 July 2026 put a live exposure in front of any client running an unpatched system. Alerts like this are routine in security circles, but they carry a consequence many clients never see coming until they lodge a claim: an unpatched system can quietly void the cover they thought they were paying for.
The statistic that should stop every broker is this. 40% of Australian cyber claims were denied in 2024, and the leading cause was not obscure fine print. It was failure to maintain basic security controls. Clients assume denials come from clever policy wording. In practice they come from the insured not doing the housekeeping the policy assumed they would.
Patching sits at the centre of that housekeeping. Most market-standard cyber wordings limit cover for known vulnerabilities where a patch was available and not applied within roughly 30 days. Insurers increasingly want critical vulnerabilities addressed within 48 hours as a core underwriting condition. When an alert like the July CMS notice lands, the clock a client is running against is measured in hours, not weeks.
Patching is only one of the controls being scrutinised. Backups are another. Coalition data shows 94% of ransomware victims had their backups targeted, which is why immutable or offline backups have moved from good idea to underwriting non-negotiable. If an attacker can encrypt the backup along with the live system, the backup was never protection.
Email is the other front. Around 60% of cyber claims originate from business email compromise, so email authentication through SPF, DKIM, and DMARC is heavily weighted at underwriting. These are unglamorous configuration settings that most SME clients have never heard of, and their absence is a red flag an underwriter can spot in seconds.
The financial stakes keep climbing. Australian Signals Directorate data puts cybercrime costs for medium businesses up 55% year on year, with the average incident costing around $100,000. For a mid-sized client, that is not a nuisance cost. It is the kind of loss that decides whether the business survives the year.
The broker’s role in all of this is to close the gap between what a client believes they are covered for and what the policy actually requires them to do. A client who patches within the window, runs offline backups, and has authenticated email is not just safer. They are far more likely to have a claim paid. We covered the buying-side of this in why 2026 is the window for SMEs to lock in better cyber cover.
Placing cyber well means matching a client’s real control posture to the right market and wording, which is precisely what our placement support and streamlined systems and technology are set up to help with. If you want a hand navigating a cyber placement or an underwriter’s control requirements, reach out to the team.