Cyber Insurance Carriers Are Asking About Your VPN Now — and Small Firms Aren't Ready

There is a familiar ritual in American small-firm accounting: the procurement conversation. A practice partner reviews a quote for a new fleet of laptops — BitLocker enabled, TPM 2.0 chips, endpoint detection pre-installed — and signs off without blinking. The same partner then renews the firm's VPN subscription on price alone, choosing whichever service appeared first in a search result.

This isn't irrational so much as it is misaligned. The laptop is visible, tangible, and easy to justify. The VPN is an abstraction — until someone asks about it in writing.

What the Questionnaire Actually Asks

Cyber liability applications have grown more granular over the past three years, and several major carriers now include questions that map directly to remote-access infrastructure. A representative sampling from applications we've reviewed:

• "Describe how remote employees access client tax data, including encryption standards applied in transit."
• "Does your organization use a commercially provided VPN? If so, is the provider's logging policy documented and reviewed annually?"
• "Has multi-factor authentication been implemented for all remote access points?"

The third question gets all the attention. The second is the one that should worry firms running a no-logs-in-name-only consumer VPN. If a carrier asks you to attest to a provider's logging practices and you cannot produce a privacy policy, an independent audit, or a jurisdictional analysis — you've just certified something you can't substantiate. Misrepresentation on an insurance application is grounds for claim denial in most states.

The Engagement Letter Nobody Reads Closely

It isn't only insurers. Larger clients — particularly public companies and entities with their own compliance departments — increasingly embed data-handling language in engagement letters. We've reviewed language requiring service providers to "maintain commercially reasonable safeguards, including encrypted connections for all remote access to client systems."

That clause is satisfied by nearly any VPN on paper. But in discovery following a breach or a malpractice claim, "commercially reasonable" becomes a factual question. Opposing counsel will ask what service you used, who operates it, where it is incorporated, and what it retains. "It was the cheapest one" is not a strong deposition answer.

The Arithmetic of Backwards Spending

Consider the actual numbers. A fully loaded encrypted laptop might run $2,500–$7,500 depending on the configuration. A reputable, independently audited VPN costs roughly $40–$100 per year per user. For a five-person firm, the annual premium over a bargain-bin provider is perhaps $200.

Yet the laptop protects one endpoint. The VPN governs every connection the firm makes — from the coffee shop in the airport during extension season, from the hotel Wi-Fi during a field audit, from the home office where a staff accountant logs into a client's QuickBooks file at 10 p.m. on April 10th. The exposure travels with the connection, not the machine.

What We'd Tell a Firm Partner

If a managing partner asked us where to redirect attention, the list is short:

1. Know your provider's jurisdiction. Where is the company incorporated, and under what legal regime can your connection logs be compelled?
2. Demand an audit trail. Independent audits of no-logs claims exist; providers that submit to them are signaling seriousness.
3. Match the tool to the attestation. If you sign questionnaires or engagement letters referencing encrypted remote access, your VPN choice should be defensible in that exact language.
4. Stop treating it as a commodity. The $3 subscription is cheap because somebody is subsidizing it — figure out who, and with what.

The laptop looks like security because it has a spec sheet and a serial number. The VPN looks like an expense because it has a monthly invoice. Carriers, auditors, and plaintiffs' attorneys have figured out which one reveals more about a firm's actual posture. It's past time small firms caught up.