Cyber insurance readiness now hinges on identity and recovery controls

At a glance

What this is: This is a readiness guide for cyber insurance that maps insurer expectations to practical security controls, with identity and recovery controls emerging as the biggest gating factors.

Why it matters: It matters because IAM, PAM, NHI governance, backup validation, and incident response evidence increasingly determine whether coverage is approved, priced, or renewed.

By the numbers:

• Claim frequency rose 7% year-over-year in 2025 to its highest level since 2021.
• Third-party liability claims jumped 70% in 2025.
• Companies with under $25 million in revenue saw a 26% increase in average claim severity in 2025.

Context

Cyber insurance is now a governance problem as much as a financial one. Insurers are not only pricing cyber risk, they are using the application and renewal process to test whether an organisation can prove control over identity, access, endpoints, backups, and response.

For IAM and security leaders, the practical issue is evidence. A policy can cover incident costs, but coverage terms increasingly depend on whether least privilege, MFA, access reviews, timely deprovisioning, and recovery controls are actually operating, not just documented.

Key questions

Q: How should organisations use cyber insurance loss control services to improve identity security before policy renewal?

A: Organisations should treat loss control services as a practical extension of their security programme, not just an insurance benefit. Start with an identity risk assessment, then use the findings to close MFA gaps, tighten privileged access, and improve controls around non-human identities and service accounts. The goal is to reduce claim likelihood, lower incident severity, and enter renewal with a stronger, better evidenced risk posture.

Q: Why do weak cybersecurity controls increase the cost of cyber liability insurance?

A: Weak controls increase the chance and expected cost of a claim, so insurers price in that exposure. A poor risk profile, prior incidents, weak vendor security, and limited monitoring all suggest higher likelihood of breach, downtime, legal expense, and restoration costs. In practice, insurers use these signals to distinguish between organisations that can absorb incidents and those likely to generate larger losses.

Q: What breaks when backup recovery testing is skipped?

A: Without restore drills, teams often discover too late that backups are incomplete, misconfigured, or too slow to meet recovery targets. That creates false confidence, extended downtime, and failed incident response when an actual disruption occurs. Testing also exposes whether staff know the recovery process and whether backup jobs are completing as expected.

Q: How can MSPs support client cyber insurance requirements without taking over the policy decision?

A: MSPs should focus on the technical evidence the insurer needs, not on approving coverage. That means maintaining control documentation, verifying MFA and recovery settings, and surfacing gaps before renewal. The client, broker, and insurer still own the policy decision, but the MSP can determine whether the technical story is credible.

Technical breakdown

Why insurers focus on identity controls

Cyber insurance underwriting often starts with identity because attacker entry commonly starts there. Insurers want proof that privileged access is constrained, remote access is protected, and cloud applications are not exposed through weak authentication. In practice, this means the insurer is testing whether the organisation can control who or what is allowed to act, not just whether credentials exist. For MSPs, that scrutiny extends into client environments because one weak access path can affect multiple insured parties. The real technical issue is whether identity governance is enforced consistently across humans, service accounts, and remote access surfaces.

Practical implication: treat identity evidence as an underwriting input and verify MFA, least privilege, and deprovisioning before renewal.

Why backup evidence matters more than backup existence

Backups only reduce loss if they survive the same attack that disables production systems. Insurers therefore look for offline or isolated backup copies, immutable storage, and restore testing that proves recovery is possible under pressure. The technical distinction matters because a scheduled backup job can still fail governance if ransomware can encrypt, delete, or tamper with the restore chain. That is why recovery time objectives and documented restore procedures matter alongside the existence of backup infrastructure. Without proof of recoverability, the control is operationally weaker than policy language suggests.

Practical implication: test restores, isolate backup copies, and document recovery evidence before you submit an insurance application or renewal.

How email and remote access become underwriting signals

Business email compromise and remote access abuse are attractive because they bypass many perimeter assumptions. Insurers therefore inspect SPF, DKIM, and DMARC, plus MFA enforcement on remote access and cloud applications, because those controls reduce spoofing and account takeover opportunities. In MSP environments, the question is not whether the controls exist somewhere in the estate, but whether they are consistently enforced across tenants and high-risk paths. A partial rollout often fails the insurer's test because it leaves the most likely entry paths intact.

Practical implication: prioritise the email and remote access paths most likely to be abused and close the enforcement gaps first.

Threat narrative

Attacker objective: The attacker aims to monetise access through extortion, fraud, or downstream liability while increasing the cost and complexity of recovery.

1. Initial access often begins through compromised credentials, spoofed email, or exposed remote access rather than a complex exploit chain.
2. Credential abuse then expands into privileged systems, backup consoles, or cloud control planes if access reviews and MFA enforcement are weak.
3. Impact follows when attackers encrypt systems, steal data, or trigger fraud and third-party liability claims that extend beyond the original compromise.

Breaches seen in the wild

• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.
• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cyber insurance underwriting is becoming a proxy test for identity maturity. The insurer is no longer just asking whether controls exist, but whether the organisation can prove that access is governed, privileged paths are constrained, and deprovisioning actually happens. That turns IAM, PAM, and lifecycle evidence into commercial controls, not only security controls. The practitioner conclusion is simple: if you cannot evidence identity control, you will struggle to evidence insurability.

Backup controls are only meaningful when the recovery path is isolated from the compromise path. The article makes clear that insurers care about offline or immutable copies, but the deeper point is that recoverability is a trust problem, not a storage problem. If the backup system can be altered by the same access that reaches production, the control has already failed conceptually. Practitioners should treat restore assurance as part of access governance around backup infrastructure.

Third-party and MSP exposure create a governance chain, not a point control. When an MSP manages multiple client environments, one weak privileged account, remote access method, or monitoring gap can cascade across insured entities. That concentration changes how insurers read responsibility, because the provider's control posture influences multiple policies and renewals at once. The practitioner takeaway is that vendor and client readiness now live in the same risk conversation.

Identity evidence is the new underwriting language for cyber readiness. MFA, least privilege, lifecycle offboarding, and access reviews are no longer background hygiene. They are the proof points that determine whether an insurer believes the environment can withstand common attack paths without turning every incident into a coverage dispute. Organisations that treat these controls as audit artefacts rather than operating discipline will face the hardest renewals.

What this signals

Identity assurance is becoming underwriting evidence. Cyber insurance questionnaires increasingly translate technical control maturity into commercial access to coverage, renewal terms, and pricing. Organisations that cannot show enforced MFA, privileged access governance, and lifecycle offboarding are effectively presenting an incomplete risk profile to the market.

Backup recoverability is a governance issue, not a storage issue. Insurers are looking for isolated, immutable, and tested recovery paths because ransomware routinely targets backup systems before encrypting production. If the restore path is not independently proven, the backup control does not materially reduce exposure.

MSP concentration changes the risk conversation. When one provider manages access and recovery across multiple client environments, the provider's control posture becomes part of each client's insurability. That makes shared evidence, not verbal assurance, the only defensible basis for renewal conversations.

For practitioners

• Document identity controls for underwriting Map privileged access, remote access, and cloud authentication controls to the insurer's questionnaire before the renewal window opens.
• Test restore paths and isolate backups Validate that backups are offline or immutable, then perform restore exercises and retain the evidence that recovery actually works.
• Close email authentication gaps Confirm SPF, DKIM, and DMARC are enforced on all customer-facing domains and not only on a subset of mail flow.
• Formalise access review and deprovisioning Ensure access reviews cover privileged accounts and that user lifecycle offboarding removes stale access before a renewal or claim review.
• Prepare MSP evidence for client renewals Keep control evidence current for the shared services you manage so clients can answer insurer questions without gaps or contradictory records.

Key takeaways

• Cyber insurance is increasingly enforced through identity, backup, email, and response controls rather than policy language alone.
• The article ties rising claims pressure to more detailed underwriting, including stronger scrutiny of MSP environments and third-party exposure.
• Practitioners need evidence, not assumptions: insurers want proof that controls are enforced, tested, and documented before renewal.

Key terms

• Cyber Insurance Underwriting: Cyber insurance underwriting is the assessment an insurer performs to decide whether to cover an organisation, on what terms, and at what price. Underwriters evaluate identity controls, backup resilience, endpoint protection, patching, and incident response maturity. Weak access governance, exposed remote services, or poor recovery evidence can increase exclusions, premiums, or denial.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Immutable Backup: An immutable backup is a copy that cannot be altered or deleted during its retention period. It protects recovery points from ransomware and accidental deletion, but it only delivers value when the organisation can restore from it successfully during an incident.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.