I keep thinking about how this conversation used to go.

A broker would send over a renewal. Someone would glance at the premium, maybe wince, maybe shrug, and then it would get filed away with everything else that feels important but not urgent. Cyber insurance lived in the same mental drawer as “fire extinguishers” and “we should probably update that policy binder someday.” Necessary, sure. But not something you talked about at the desk, or in the service drive, or during the morning huddle.

Now it is different. Not dramatically different, either. It is more annoying than dramatic. More detailed than scary. More persistent than urgent. That is part of what makes it so disruptive.

Because the questions have changed.

Not “Do you have antivirus?” but “Do you have endpoint detection and response, and is it centrally monitored?” Not “Do you back up your data?” but “How often do you test restoration, and where is the evidence?” Not “Do you train employees?” but “How do you track training completion, and what happens when someone fails a phishing test?”

And the hidden question underneath all of those is the one most stores are not prepared for.

Who owns this, really?

Not who is responsible for fixing it when it breaks. Who owns it in the sense of governance, documentation, accountability, continuity. Who can prove it. Who can show receipts.

That is why cyber insurance has become such a strange pressure point for dealerships. It is not just a policy anymore. It is a mirror.

And mirrors can be rude.

The insurance company is not asking for comfort. It is asking for proof.

When a dealership says, “Our IT guy has it covered,” I know what they mean.
I have heard it a hundred different ways.

He is sharp.
She is reliable.
They know our systems.
They have been here forever.
They have saved us more times than we can count.

All true, sometimes very true.

But here is the thing insurance carriers are quietly saying, without saying it directly.

We do not insure how confident you feel. We insure how controlled your risk is.

That sounds cold, and it is. Carriers are not in the business of feelings. They are in the business of probability. And probability hates single points of failure.

So if your entire cyber posture, compliance posture, documentation posture, and incident response posture live inside one person’s day, one person’s memory, one person’s bandwidth, one person’s availability, the carrier does not see “trusted employee.” They see “fragile system.”

Does that feel harsh? Maybe. But it is also fair. If that person gets sick for a week, what happens? If they leave, what happens? If something hits at 2:00 a.m., what happens? If the carrier asks for evidence tomorrow morning, can you produce it without that person sitting beside you?

And this is where the room usually goes quiet, because everyone suddenly realizes something.

We are not talking about a technical problem. We are talking about an organizational one.

The quiet reality is that cyber insurance underwriting has become a compliance interview.

A few years ago, you could get away with broad answers. It was like being asked if you “lock the doors.” Most people said yes, because of course you lock the doors.

Now it is more like being asked, “What brand are the locks? Who has keys? When were they last changed? Do you have cameras, and do they record? If a key goes missing, what happens next?” That is not a checkbox. That is a system.

Cyber insurance is moving in that direction, and dealerships are feeling it.

The FTC Safeguards Rule changed the tone. Ransomware changed the math. Claims changed the patience level. And carriers, especially the ones that have been paying out real money, are done with guessing.

They want to see that your dealership can do a few things consistently:

Prevent what is preventable.
Detect what slips through.
Respond with structure, not improvisation.
Document what you do so it can be verified.
Review vendors and access so risk is not outsourced by accident.

If you read that list and think, “That sounds like a team,” you are not wrong.

Let’s talk about the “one IT guy” model, the way it actually looks inside the store.

It usually starts innocently. Someone with technical aptitude ends up owning more and more. Maybe it is a parts manager who knows networks. Maybe it is a service advisor’s cousin who “knows computers.” Maybe it is a real IT hire who starts with helpdesk and grows into everything because, well, somebody has to.

Then the dealership expands. More rooftops. More devices. More vendor tools. More integrations. More remote access. More systems that touch customer data. More reporting needs. More compliance pressure. More everything.

But the IT structure does not expand the same way. It stays the same person, doing more, juggling harder, becoming the glue.

At first, everyone sees this as loyalty and grit. The IT person is always there. They answer the phone. They fix the issue. They keep the plates spinning.

Over time, it becomes dependency.

And dependency is a weird thing because it does not feel like risk. It feels like stability. It feels like, “We have our guy.”

Until the insurance application lands. Or the renewal gets delayed. Or the carrier asks for a vulnerability scan report. Or a broker says, “They want MFA everywhere, and they want it confirmed.” Or someone says, “Do we have an incident response plan?” and everyone looks around and realizes the plan is basically, “Call IT.”

That is not a plan. That is a person.

A thought that keeps coming back to me…..

If your security program goes on vacation when one employee goes on vacation, you do not have a security program.

You have a routine.

And routines fall apart under pressure.

Carriers know this. Attackers know this too, by the way, but carriers are the ones forcing the conversation because they control the leverage. They can deny coverage. They can raise premiums. They can reduce limits. They can add exclusions that basically make the policy useless when you need it most.

So the dealership gets stuck between two bad options.

Option one: try to keep the “one IT guy” model and hope the carrier is lenient.
Option two: scramble at the last minute to bolt on controls, buy tools, chase documentation, and pray it satisfies underwriting.

Neither feels good. Neither is sustainable.

Why cyber insurance cares about compliance details that feel annoying.

Because those details are where real incidents live.

Multi-factor authentication. It sounds simple, but the difference between “we have MFA” and “we enforce MFA everywhere, including admin accounts, VPN, email, and vendor remote access” is the difference between a close call and a disaster.

Backups. Everyone says they have backups. The carrier wants to know if they are offline or immutable, how often they are tested, and what your recovery time actually is. Not what you hope it is. What it is.

Vendor access. Dealerships are vendor ecosystems. DMS providers, CRM providers, digital retailing, phone systems, printers, key tracking, service tools, inventory tools, accounting integrations. A carrier is thinking, “How many doors into this environment exist, and are they controlled?”

Training. Not “we told everyone not to click weird links,” but “we have a program, we track completion, and we test behavior.”

Incident response. Not “we will figure it out,” but “here is the documented plan, here are the contacts, here is how we isolate systems, here is how we preserve evidence, here is how we communicate internally, here is how we work with legal.”

That is what compliance looks like under insurance scrutiny. It is boring. It is administrative. It is also the difference between being insurable and being a walking exclusion.

Here is the part most people miss.

Insurance underwriting is not just about whether you get coverage. It is about whether you keep it.

A dealership might pass underwriting this year with some promises and a few controls. Then next year the carrier tightens again. Or your claim history in the industry shifts. Or the carrier changes its appetite. Or your dealership grows and your exposure changes.

If you are still relying on one IT person to hold all of it together, you end up in a cycle of panic every renewal season. That panic has a cost. It steals time. It steals focus. It creates rushed decisions and half-finished implementations.

And it exhausts the IT person, the same person everyone depends on.

That person becomes the crutch, and the dealership becomes the patient that refuses physical therapy. You can limp for a while. You cannot limp forever.

So what actually changes the situation?

Not a tool. Not a shiny security product. Not a new checkbox.

Structure changes it.

The dealerships that get cyber insurance renewals done smoothly, the ones that do not get hammered on premium, the ones that do not get non-renewed or buried under exclusions, tend to have a few things in common.

They can show what they do.
They can prove it is consistent.
They can demonstrate continuity.
They can point to process, not personality.

And they are not relying on a single person to be the entire program.

That does not always mean they have a huge internal team. It means they have coverage. They have a model. They have redundancy. They have someone watching after hours. They have someone who can produce documentation. They have someone who can run vulnerability scans and interpret them. They have someone who can coordinate vendors and lock down access without breaking operations.

In other words, they have a real operating model.

A question that every dealer principal and GM should ask, and then sit with.

If the insurance carrier asked us for evidence tomorrow, could we provide it quickly, calmly, and confidently, without calling one person and hoping they can pull it together?

If the answer is, “Probably,” that is not a yes.

If the answer is, “We think so,” that is not a yes.

If the answer is, “We would have to check,” that is definitely not a yes.

And the carrier hears those answers even when you do not say them out loud, because the documentation, or lack of it, tells the truth.

This is not about insulting the IT person. It is about finally supporting them.

I have met a lot of dealership IT people. Most of them are grinders. They are loyal. They take the job personally. They feel responsible for keeping the store running because, frankly, they are.

That is exactly why the “one IT guy” model is so dangerous. It exploits the best traits of the person in the role. It creates hero culture. It turns stress into normal.

The fix is not to replace that person. The fix is to stop making them the entire risk strategy.

Support looks like process. Support looks like monitoring that continues when they are asleep. Support looks like documented incident response. Support looks like vendor oversight that does not get lost in the noise. Support looks like a compliance calendar that runs even when the day gets chaotic.

Support looks like not having to answer an insurance underwriter’s questionnaire with one person’s memory.

Why this matters more than people want to admit.

Because dealerships are not just selling cars anymore. They are processing financial transactions, storing sensitive data, integrating dozens of vendors, and operating digital systems that customers assume will work instantly.

When systems slow down, sales suffers. When service tools fail, throughput drops. When F and I cannot print, deals stall. When email goes down, half the building feels paralyzed.

Now layer insurance on top of that.

If you cannot get cyber insurance, or if your carrier limits coverage, or if your premiums become painful, you feel it immediately. It hits the budget. It hits the boardroom. It becomes a real business constraint.

And it all traces back to a simple reality.

A dealership can be a complex, high-risk, high-velocity environment, or it can have a single person as its entire cyber program. It cannot be both for much longer.

Where to take this next?

If you are reading this and thinking, “Okay, this is uncomfortably accurate,” good. That reaction is useful. It means you are seeing the gap clearly.

The next step is not panic. The next step is clarity.

Get honest about what the carrier is asking for.
Get honest about what you can prove today.
Get honest about what is dependent on one person.

Then build an operating model that makes compliance repeatable.

Because cyber insurance is not getting easier. It is getting stricter, more detailed, more evidence-driven. The dealership that treats it like a strategic requirement will be insurable. The dealership that treats it like paperwork will eventually hit a wall.

And when that wall shows up, it will not matter how good your IT guy is.

It will matter whether your dealership has a real, auditable, resilient compliance program.

That is the difference between being covered and being exposed.