Cyber insurance pricing shows why breach loss is still hard to model

At a glance

What this is: This is an analysis of why cyber insurance demand is rising while underwriting remains difficult, with breach costs, partial coverage, and security audit pressure at the centre of the argument.

Why it matters: It matters because identity, access, and control assurance increasingly shape both insurability and loss tolerance, especially where exposed credentials, privileged access, and weak governance increase breach impact across NHI and human identity programmes.

By the numbers:

• Target said costs associated with its 2013 holiday season data breach are closing in on a whopping $300 million.
• A Forbes Insight report showed 46% of companies suffered damage to their reputations and brand value as a result of a cyber breach.

👉 Read SentinelOne's analysis of cyber insurance, breach losses, and underwriting pressure

Context

Cyber insurance pricing depends on loss modelling, but breach frequency, hidden incidents, and uneven disclosure make those models brittle. The article argues that insurers are trying to price a risk that changes faster than historical claims data can capture, which leaves organisations facing both higher premiums and more demanding audits.

For identity and access teams, the lesson is that insurability increasingly depends on provable control quality, not just policy language. Where credentials, privileges, and access paths are poorly governed, the business absorbs both breach exposure and the downstream cost of proving risk to underwriters.

Key questions

Q: What makes cyber insurance difficult to price for security teams?

A: Cyber insurance is difficult to price because breach frequency, loss severity, and disclosure quality vary widely across organisations. Underwriters rarely get consistent, objective evidence about access control, incident scope, or downstream business loss. That means teams with weak identity evidence often face less favourable terms because insurers cannot clearly measure the risk they are being asked to cover.

Q: Why do identity controls affect cyber insurance terms?

A: Identity controls affect insurance terms because access records help prove what was exposed, how far an attacker could move, and whether the organisation can contain loss quickly. Strong lifecycle governance for human and non-human identities gives insurers more confidence that incident scope is measurable. Weak controls create uncertainty, which usually pushes premiums and audit demands up.

Q: What do security teams get wrong about breach cost?

A: Teams often focus on technical recovery alone, but breach cost also includes legal fees, notification, call centres, customer compensation, reputation damage, and lost sales. If access evidence is incomplete, those costs rise because the organisation spends longer proving scope and impact. Identity governance is therefore part of loss containment, not just compliance.

Q: Who is accountable when privileged access failures affect a cyber insurance claim?

A: Accountability usually sits with whoever owns access governance, security operations, and the system that granted or retained the privilege. In practice that often spans IAM, PAM, platform teams, and business owners. If no one can produce evidence quickly, the organisation inherits both operational and financial exposure.

Technical breakdown

Why cyber insurance models struggle to price breach loss

Cyber insurance underwriting depends on objective, repeatable indicators, but cyber risk is noisy, underreported, and highly variable. Historical claims data only captures incidents that were detected, disclosed, and measured in ways insurers can compare. That makes actuarial modelling weak when attackers change tactics quickly or when losses include non-technical costs such as litigation, notification, and brand damage. The insurance problem is therefore partly an observability problem: if controls and incidents cannot be measured consistently, the pricing model cannot be stable.

Practical implication: security leaders should expect insurers to ask for evidence of control maturity, not just a cyber policy summary.

How breach costs extend beyond direct remediation

A breach does not end with forensics or system restoration. Notification, call centres, legal defence, credit monitoring, crisis communications, and sales decline can dominate the final cost. In identity-heavy breaches, the damage also includes the effort needed to prove whether access was legitimate, how credentials were used, and whether privileged accounts were involved. That is why identity governance becomes a financial control as much as a security one: weak identity evidence widens the cost envelope and slows containment decisions.

Practical implication: build incident evidence and access telemetry into the same governance process that supports claims and post-breach review.

Why security audits are becoming part of insurance availability

Insurers increasingly use security audits to separate organisations with demonstrable controls from those with unknown exposure. That means access review, credential hygiene, logging, and endpoint protections become underwriting signals, not just compliance tasks. For identity programmes, the overlap is direct: service accounts, privileged users, and delegated access paths all affect both breach likelihood and the insurer’s confidence in loss control. Cyber insurance is therefore pulling operational security closer to governance, where evidence matters as much as intent.

Practical implication: align identity controls and audit evidence so they can satisfy both risk management and underwriting questions.

Threat narrative

Attacker objective: The attacker objective is to compromise valuable data at scale and force the organisation into expensive containment, disclosure, and recovery efforts.

1. Entry occurred through the kinds of security failures that create large-scale breach losses, including weak access control and compromised data paths.
2. Escalation followed as attackers reached systems or records valuable enough to create major notification, legal, and recovery costs.
3. Impact was measured not only in direct remediation but also in reputational damage, customer loss, and partial insurance recovery.

Breaches seen in the wild

• Salt Typhoon US telecoms breach — Salt Typhoon APT used stolen credentials and Cisco CVE to breach US telecoms.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Breach cost modelling is increasingly an identity governance problem. The article focuses on insurance economics, but the underlying issue is whether organisations can prove who or what had access, when, and under what control. That is especially relevant where NHIs, service accounts, and delegated credentials create ambiguous access paths that are hard to measure after an incident. Practitioners should treat identity evidence as part of loss modelling, not only part of authentication hygiene.

Standing access creates financial uncertainty as well as security risk. Insurers are reacting to the fact that uncontrolled access makes breach scope difficult to estimate and harder to defend in underwriting. When credentials, tokens, or privileged accounts persist without strong lifecycle governance, the organisation cannot easily show what was exposed or whether the attacker moved laterally. That weakens both breach containment and the case for favourable coverage terms. Practitioners should reduce standing access where possible and keep audit-ready evidence of its use.

Cyber insurance is pushing security teams toward measurable controls, not abstract maturity claims. The article shows that premiums and audits are rising because underwriters want objective evidence, not promises. That aligns with the broader identity security trend: access review quality, credential rotation, and privileged account monitoring matter because they can be measured and defended. Practitioners should expect insurance questionnaires to converge with identity governance evidence requirements.

The real constraint is not policy availability, but verification trust gap. Insurers cannot price what they cannot observe, and many enterprises cannot produce a reliable record of access, privilege, and exposure at the moment of loss. That gap is especially visible in NHI-heavy environments where machine credentials and automation expand faster than governance. Practitioners should assume that future underwriting will reward demonstrable control telemetry over paper-based assurance.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• From our research: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• That visibility gap makes insurance-grade evidence harder to assemble, so 52 NHI Breaches Analysis is the next reference point for control failure patterns and incident scope.

What this signals

Credential evidence will matter more in underwriting. As insurance markets mature, the teams that can prove who accessed what, when, and with which credential type will be better positioned than those relying on static policy statements. That creates a practical incentive to unify IAM, PAM, and NHI telemetry so breach reconstruction is possible without manual forensic scramble.

The underwriting conversation is likely to sharpen around control assurance rather than headline breach counts. Organisations should expect questions about credential rotation, access review cadence, privileged session logging, and third-party delegated access because those controls are easier to evidence and harder to dispute after an incident.

For practitioners

• Map insured loss scenarios to identity control evidence Document which access logs, privilege records, rotation history, and offboarding events would be needed to reconstruct a breach for underwriting and claims. Treat this as a control test, not a paperwork exercise.
• Reduce standing privilege across human and non-human identities Review service accounts, API keys, tokens, and admin accounts for persistent access that can inflate both breach scope and insurer uncertainty. Prioritise systems where access has no clear expiry or owner.
• Align incident telemetry with insurance questionnaires Make sure audit logs, identity lifecycle records, and privileged access reviews can answer the same questions insurers ask about control maturity and loss containment. If the evidence is fragmented, coverage negotiations will be harder.
• Use breach scenarios to justify control investment Connect likely remediation costs, notification effort, and reputational loss to specific control gaps such as weak credential rotation or missing access review. That framing helps security teams translate technical risk into business terms.

Key takeaways

• Cyber insurance is becoming a test of whether organisations can prove control quality, not just buy coverage.
• The most expensive part of a breach is often the long tail of legal, notification, reputation, and customer recovery costs.
• Identity evidence, especially around privilege and non-human access, is increasingly part of both loss containment and underwriting confidence.

Key terms

• Cyber insurance: Cyber insurance is a policy that helps absorb financial losses from a cyber incident, including response costs, legal exposure, and business interruption. It does not replace security controls. In practice, insurers use a buyer’s identity, access, and recovery maturity to decide whether risk is acceptable and how much it should cost.
• Loss Modelling: Loss modelling is the process of estimating how much money a breach could cost under different attack scenarios. It combines direct technical recovery costs with legal, operational, and reputational impacts, which is why incomplete identity and access evidence makes estimates less reliable.
• Standing Privilege: Standing privilege is persistent elevated access that remains available outside a specific task or time window. It increases breach impact because attackers who capture the credential or session can move quickly, and it makes post-incident scope harder to reconstruct when access is not tightly time-bound.
• Identity Evidence: Identity evidence is the record set that proves who or what accessed a system, when they did it, and under what permissions. It includes logs, entitlement history, rotation records, and offboarding events, and it is increasingly important for both breach investigation and underwriting confidence.

What's in the full article

SentinelOne's full article covers the operational detail this post intentionally leaves for the source:

• How the article breaks down insurance market pressure across premium growth, underwriting scrutiny, and supply constraints.
• The Target breach cost breakdown, including the split between covered and uncovered losses.
• The discussion of insurer audits, policy exclusions, and why some fraud or espionage scenarios fall outside coverage.
• SentinelOne's endpoint protection positioning and how it ties attack prevention to claims avoidance.

👉 SentinelOne's full article covers the breach cost breakdown, coverage gaps, and insurer responses in more detail.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to translate governance into measurable control outcomes across identity programmes.