We renewed our cyber insurance last month and the questionnaire had a section I had not seen before: evidence of endpoint monitoring, data loss prevention and audit trail retention. Not a yes/no tick box, actual evidence. Our broker was clear that a vague answer would affect the premium. So I sat down to gather it and realised we had nothing. We have antivirus, we have backups, we have a firewall, but nothing that records who accessed what or stops a file going out on a USB stick. Our answer was essentially "we trust our people", which is fine as a culture statement and useless as a control.
That is what pushed us to look properly at security https://octowatchdlp.com tooling rather than treating it as a nice to have. What mattered for the insurance conversation was not the feature list but the audit trail: activity records that can be produced on request, rules that actually block rather than just log, and a defined retention period we could state in writing. We run it on our own server so the data sits with us, which the broker liked because we could describe exactly where it lives and who can access it. The questionnaire went back with real answers instead of adjectives.
If you have a renewal coming up, it is worth checking what your policy actually requires before you are asked for it. Assembling evidence after the fact is much harder than having it already there.