Cyber insurance questionnaires are now identity audits in practice

At a glance

What this is: Cyber insurance underwriting is now treating MFA and related identity controls as evidence-based requirements, not checkbox claims, with emphasis on enforcement, coverage scope, and phishing-resistant methods.

Why it matters: IAM, PAM, and NHI teams need defensible control evidence because insurers are evaluating whether identity protections actually reach privileged accounts, remote access, and machine-facing paths.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Secret Double Octopus' analysis of why cyber insurance now depends on provable MFA

Context

Cyber insurance has become an identity governance test because carriers are no longer satisfied with broad statements that MFA exists somewhere in the environment. The real question is whether MFA is enforced on the access paths that matter, whether the method is phishing-resistant, and whether the organisation can prove both.

That shift exposes a familiar IAM problem: control design is often broader on paper than in reality. Privileged accounts, remote access, and machine-facing workflows are where gaps usually hide, which is why insurers are now treating identity evidence as underwriting evidence rather than administrative formality.

Key questions

Q: What breaks when MFA is used only at sign-in and not for privileged actions?

A: The main failure is stale trust. A user may authenticate once and then remain authorized for hours or days, which is too broad for account deletion, payment approval, or access to secrets. Without re-authentication at the point of action, an attacker who inherits the session can complete high-risk operations without facing a fresh challenge.

Q: Why do phishing-resistant MFA methods matter if attackers can still get in?

A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths. But they do not stop an attacker who already controls a valid session through social engineering, stolen tokens, or compromised administrators. The practical goal is to reduce entry opportunities and then limit post-login blast radius.

Q: How do security teams know whether their MFA programme is actually defensible?

A: They know it is defensible when they can prove enforcement across the access paths insurers and attackers both care about, especially remote access and privileged accounts. Evidence should include policy exports, sign-in logs, and coverage reports that reconcile exceptions. If the proof is fragmented, the control is likely weaker than the questionnaire suggests.

Q: Who is accountable if an organisation misstates MFA coverage to an insurer?

A: Accountability sits with the organisation that certified the control, typically shared across security, IAM, and risk leadership depending on how the questionnaire was approved. Misstatement can trigger rescission, exclusion disputes, or denied claims. That is why control attestation must be treated like governed evidence, not casual administrative input.

Technical breakdown

Why phishing-resistant MFA changes the underwriting test

Phishing-resistant MFA such as FIDO2 or WebAuthn binds authentication to the origin, which means a reverse-proxy phishing kit cannot relay the same challenge through a fake domain. That matters because adversary-in-the-middle attacks defeat passwords, TOTP, and push approvals by stealing the post-authentication session rather than the secret itself. From an underwriting perspective, the difference is not academic. Carriers are evaluating whether the control can survive the attack path most likely to bypass standard MFA.

Practical implication: treat phishing-resistant MFA as a distinct control class and evidence it separately for privileged and remote access.

Why coverage scope matters more than checkbox MFA

A control that exists only on email or a subset of users does not materially reduce loss exposure on VPNs, jump boxes, admin consoles, or service accounts. Underwriters care about the access paths attackers use to reach high-value systems, not the easiest place to turn a setting on. That is why partial MFA coverage can still leave the policy vulnerable to exclusions, sub-limits, or attestation disputes. The control only counts when it covers the paths actually used for compromise.

Practical implication: map MFA enforcement to remote access, privileged access, and machine-adjacent workflows before renewal.

How insurance evidence is converging with IAM audit evidence

Cyber insurance questionnaires are increasingly functioning like lightweight audits because carriers want artefacts, not assertions. That means conditional access exports, sign-in logs, privilege coverage, and documented enforcement logic carry more weight than screenshots or policy statements. For IAM teams, the implication is that governance, auditability, and operational enforcement are becoming one requirement. If the evidence cannot be exported, reviewed, and tied to real access paths, it will not help in underwriting or in a post-incident dispute.

Practical implication: build an evidence pack that ties policy text to enforcement logs and privileged access scope.

Threat narrative

Attacker objective: The attacker wants authenticated access that looks legitimate to the identity provider while bypassing the control the insurer expects to be in place.

1. Entry begins with adversary-in-the-middle phishing, where the victim is sent through a reverse proxy that relays the real login page and captures the authentication flow.
2. Escalation occurs when the attacker replays the session cookie and gains access without re-triggering the original MFA challenge, bypassing controls that only protect the login step.
3. Impact follows when the attacker uses the authenticated session to move through privileged systems or exfiltrate data while the organisation still believes MFA was effective.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cyber insurance is now a proxy audit of identity maturity. The market is no longer pricing the presence of MFA alone. It is pricing whether MFA is enforced on privileged access, whether it is phishing-resistant, and whether the organisation can prove it at underwriting time. That makes cyber insurance a governance stress test for IAM, PAM, and access review discipline, not just a financial product decision. Practitioners should expect proof-based underwriting to keep expanding into adjacent identity controls.

Checkbox MFA has lost signalling value because enforcement is what separates risk. If almost every applicant claims MFA, the binary control stops differentiating one organisation from another. The meaningful question becomes where MFA is applied, what type it is, and whether it covers the paths that actually lead to compromise. This is the same pattern we see across NHI governance: presence is not assurance, and assurance is not evidence unless it is verifiable.

Privilege scope is the underwriting variable that matters most. The article makes clear that insurers care about admin accounts, remote access, and the places where a missed exception creates disproportionate loss potential. That is a governance lesson, not just an insurance one. Access programs that cannot show complete privileged coverage will continue to fail both actuarial scrutiny and internal control scrutiny.

Identity assurance is converging across human, privileged, and machine access. Although the article is framed around human MFA, the governance logic extends to non-human identity and service account access as well. If a control can be claimed without being enforced on the exact access paths that matter, the same failure mode will recur across API keys, service principals, and automation accounts. Practitioners should stop treating identity assurance as a channel-specific problem.

Proving control enforcement is becoming part of the control itself. Carriers are now asking for logs, exports, and attestation that can survive challenge. That shifts the burden from policy design to operational evidence, which is exactly where mature identity programs should already live. Teams that cannot demonstrate control operation will increasingly pay for the gap in pricing, exclusions, or claim disputes.

From our research:

• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, which shows how quickly unmanaged identity exposure turns into repeated operational risk.
• For a deeper breach lens, see 52 NHI Breaches Analysis for root causes that mirror the same governance failure pattern.

What this signals

Cyber insurance is becoming an external validation layer for IAM maturity. That means teams will increasingly need one evidence model that satisfies both internal governance and external underwriting. The gap is no longer whether MFA exists, but whether identity controls are demonstrably enforced on the paths that matter. For practitioners, the priority is to align control telemetry, access reviews, and renewal evidence before the next questionnaire arrives.

Control scope will matter more than control slogans. A policy statement about MFA has little value if privileged access, service accounts, or remote administration remain outside its enforcement boundary. The organisations that win here will be the ones that can show complete coverage and exception governance, not just broad adoption language.

Phishing-resistant assurance is the new baseline for high-value access. As insurers and auditors converge on proof, the most defensible programmes will pair phishing-resistant MFA with clear evidence trails. That same evidence pattern maps cleanly to Ultimate Guide to NHIs , Regulatory and Audit Perspectives for teams formalising governance across identity classes.

For practitioners

• Inventory every MFA enforcement point Map MFA across email, VPN, remote desktop, admin consoles, privileged accounts, and any exempted legacy paths so you know what is actually covered.
• Separate phishing-resistant MFA from generic MFA Document which users and systems use FIDO2 or WebAuthn, and keep that evidence distinct from SMS, TOTP, or push-based access.
• Prepare an underwriting evidence pack Export conditional access policies, sign-in logs, and privileged access reports that prove enforcement rather than merely showing settings exist.
• Audit service and machine access for MFA blind spots Review non-interactive accounts, service principals, and automation paths that are outside user MFA policy but still carry sensitive access.

Key takeaways

• Cyber insurance is now evaluating whether MFA is enforced and provable, not merely declared.
• Phishing-resistant methods and complete privileged coverage are the controls most likely to survive underwriting scrutiny.
• Identity teams need audit-ready evidence because control attestation is increasingly part of the risk decision itself.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Condition Precedent: A policy requirement that must be satisfied for coverage to apply to a claim. In cyber insurance, control failures linked to a condition precedent can void recovery for the affected loss while leaving the wider policy intact for other events.
• Attestation: Attestation is verifiable evidence about a workload’s execution context, such as where it is running, who started it, and whether it matches policy. In agent governance, attestation can be used to bootstrap enrollment and to justify access decisions that need to change as the workload behaves differently.
• Privileged Access: Privileged access is any elevated entitlement that can change systems, data, or security settings. When privilege is excessive or poorly scoped, a single compromised identity can create outsized blast radius across environments.

What's in the full article

Secret Double Octopus' full article covers the operational detail this post intentionally leaves for the source:

• The insurer-facing evidence patterns behind MFA attestation, including what carriers ask to see during renewal.
• The policy mechanisms that can turn MFA failures into rescission, exclusions, or reduced sub-limits.
• The specific examples of how phishing-resistant MFA changes underwriting outcomes compared with basic MFA.
• The practical gaps in coverage for privileged, remote, and legacy access paths that the article walks through.

👉 The full Secret Double Octopus article covers underwriting shifts, claim mechanics, and the MFA evidence carriers expect.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.