The cyber insurance you do not have
The insurer's online portal shows the risk questions, each with a switch for yes and one for no. Are all stationary and mobile work computers equipped with current software against malware? “Yes.” Are available security updates installed without culpable delay? “Yes.” The head of IT dictates the answers, the broker enters them.
On that day the company's network contains machines running Windows 2003 that serve as central storage and have no antivirus protection. The SQL server behind the web shop runs Windows 2008, and the vendor's security updates have expired. One domain controller has received no update and no antivirus protection since March 2019 and is still in its as-delivered state.
The Windows 2008 server becomes the entry point for the attackers. The insurer rescinds the contract, and the Regional Court of Kiel rules in its favour on 23 May 2024 (case no. 5 O 128/21): the contract is void for fraudulent misrepresentation, and the insurer owes nothing. According to published reports, the appeal before the Higher Regional Court of Schleswig was unsuccessful (case no. 16 U 63/24).
The company had a policy. It was never insured.
The same question, the other outcome
One year earlier the Regional Court of Tübingen decides a case that begins almost identically (judgment of 26 May 2023, case no. 4 O 193/21). The insurer had asked eight risk questions, and seven were answered yes, including the question about security updates. After a ransomware attack the court-appointed expert finds that 11 of 21 forensically secured servers lacked current security updates. The insurer withdraws from the contract.
The court orders it to pay just under EUR 2.86 million.
The judgment rests on two reasons. The first is causation. The attackers exploited a weakness in Windows that exists regardless of patch level, and the attack succeeded on 16 of the 21 servers, including current Windows Server 2019 machines. According to the expert, installing the missed updates would neither have stopped the attack nor reduced the damage. The insurer was therefore not allowed to refuse payment.
The second reason is fault. The court could not establish fraudulent intent. After an event held before signing, the staff had come away with the impression that the requirements for IT security were low. Several witnesses remembered the statement that “any Fritzbox” would do as a firewall.
What separates the two cases
The quality of the IT hardly separates them. Both companies ran outdated systems. In Kiel the court found the answers to be wrong. In Tübingen, on the court's assessment, at most the answer to the question about updates could have been wrong.
What separates them is what the company knew about its own state when it answered. In Kiel the head of IT testified that the Windows 2003 machines had been “deliberately overlooked” when answering. By his own account he had not checked the systems beforehand. The court calls this answering “ins Blaue hinein”, meaning statements made without any basis, and treats it as fraudulent misrepresentation. Anyone taking out cyber insurance, it says, will readily see that the insurer's risk assessment depends on antivirus protection and security updates.
The expert in Kiel explained that the security state of the network could have been checked before answering “relatively easily at a glance”. The central console of the antivirus software would have shown it. In the WSUS system the machines without updates would have stood out.
The check was possible. The head of IT did not carry it out.
Three commitments attached to a policy
Anyone taking out cyber insurance tells the insurer something about their IT at three points.
Before signing, it is the answers in the risk questionnaire. Under section 19 of the German Insurance Contract Act (VVG), the known risk circumstances the insurer asked about in text form must be disclosed. Whoever breaches this duty risks, depending on the degree of fault, the insurer's withdrawal, termination, or an adjustment of the contract. In a case of fraudulent misrepresentation the insurer keeps the right to rescind under section 22 VVG and section 123 of the German Civil Code. That was the route taken in Kiel.
During the term, it is the obligations. The model terms of the German Insurance Association (GDV) (AVB Cyber, as of February 2024) list them in section A1-16. Administrative access is reserved “exclusively for administrators and exclusively for administrative tasks”. The terms require malware protection that is kept current automatically, and patch management that installs relevant security updates promptly. Backups run at least weekly, and no system and no authorisation level may be able to alter or destroy originals and duplicates alike. Restoration must be tested regularly. Individual insurers' terms differ; what counts is your own policy.
The consequences are graded in section 28 VVG. In a case of intent the insurer can be released from payment; in a case of gross negligence it may reduce payment in proportion to the severity of the fault. It remains liable to the extent the breach affected neither the occurrence or establishment of the insured event nor the establishment or scope of the payment. Under the model terms the policyholder has to prove this. With fraudulent intent, even that does not help.
Changes add the question of increased risk. Under section 23 VVG, after submitting the contractual declaration the policyholder may not increase the risk without the insurer's consent. If they realise afterwards that they have done so, or if the increase occurs independently of their will and they become aware of it, they must notify the insurer without undue delay.
The Tübingen case was decided on proof that the possibly wrong answer had no causal effect, the Kiel case on rescission for fraudulent misrepresentation. In both proceedings experts established after the loss what state the systems were in.
How the gap arises
A risk questionnaire looks like a form. Legally, every answer is a disclosure to the insurer. The questions are short, the answer is a switch.
In both judgments the answer described an assumption about the IT. In Kiel the head of IT stated that he had relied on staff and an external service provider. The court was not convinced. In Tübingen those involved assumed that the insurer asked for little.
Then there is time. The answer in the questionnaire describes the state before the contract; the obligations apply on every day after it. An administrator account granted for a project and never withdrawn changes the state. A backup server that is joined to the same Active Directory as the systems it backs up changes it as well: the model terms name integration into a single management system as an example of what must not be the case for backups over the network.
It is the same pattern as with the questionnaire in a GRC tool: what is evidenced is that somebody answered. With insurance, the cover depends on it.
What follows from this
Treat every answer in the risk questionnaire like a statement in an audit. Each one needs evidence from the system, a date, and the name of the person who checked.
If nobody in-house does this regularly, an external CISO can lead the check.
The evidence usually exists already. The antivirus console shows which machines are covered. Patch management shows which systems no longer receive updates. The directory service provides the list of accounts with administrative rights. The log of the last restore test shows whether a restore from the backup succeeded.
Repeat the check before every renewal and after every major change to the IT. If the measurement differs from the answer, raise it before a loss occurs. What then has to be declared to the insurer is a matter for your broker or your lawyer. This article is not legal advice.
OdySecure has 23 connectors to connected systems. The report of a cloud check with Prowler, for example, is stored as evidence on the control, with a freshness state that shows how old the measurement is. The Kiel case turned on whether somebody had looked. How the state can be established before signing or renewal is described on the page about the cybersecurity assessment.
The test
Take the risk questionnaire of your policy and have the evidence for every answer pulled from the system today.
Where none can be pulled, your policy contains an assumption.
Sources: Regional Court of Tübingen, judgment of 26 May 2023, 4 O 193/21; Regional Court of Kiel, judgment of 23 May 2024, 5 O 128/21, court announcement and published reasons; GDV, AVB Cyber, as of February 2024; VVG sections 19, 22, 23, 28. The decision of the Higher Regional Court of Schleswig (16 U 63/24) is reported from third-party accounts. As of 12 October 2026. The statement about OdySecure describes what the platform can do, not a commitment about the scope or availability of any individual installation.