Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Ransomware accounted for 58% of large cyber insurance claims in 2024, while breaches such as Change Healthcare and CDK Global drove insurers to raise premiums and demand proof of stronger identity controls, according to Veza. Identity programmes that cannot demonstrate visibility, least privilege, and NHI governance are now underwriting risks, not just security gaps.
NHIMG editorial — based on content published by Veza: Ensuring Insurability, How to Strengthen Your Cyber Insurance Posture
By the numbers:
- Ransomware made up 58% of large cyber insurance claims in 2024.
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams prove identity controls during cyber insurance renewal?
A: Focus on evidence, not policy statements.
Q: Why do NHIs complicate cyber insurance and identity governance?
A: NHIs complicate governance because they are numerous, frequently over-permissioned, and often lack clear human ownership.
Q: What breaks when least privilege is missing?
A: When least privilege is missing, a single compromised identity can reach far more systems and data than the task requires.
Practitioner guidance
- Map underwriting questions to identity evidence Translate insurer requests into specific evidence for MFA, least privilege, access reviews, and NHI ownership so responses are consistent and repeatable.
- Inventory all non-human identities Create a single inventory for service accounts, API keys, tokens, and certificates, with named owners, business purpose, and revocation paths.
- Prove least privilege across privileged access Document how privileged access is scoped, reviewed, and time-bounded across human and machine identities, then retain the evidence in a format usable for audit and underwriting.
What's in the full article
Veza's full whitepaper covers the operational detail this post intentionally leaves for the source:
- How the whitepaper maps cyber insurance requirements to identity controls such as MFA, least privilege, and NHI visibility
- Why the authors connect ransomware loss trends to underwriting expectations and premium pressure
- What evidence organisations can present to prove access governance maturity during insurer review
- How identity-centric controls are framed as a way to reduce denied coverage risk and financial exposure
👉 Read Veza's whitepaper on strengthening cyber insurance posture with identity controls →
Cyber insurance and NHI controls: what IAM teams need to prove?
Explore further
25/08/2026 6:11 pm
Cyber insurance underwriting is now a test of identity evidence, not policy intent. Insurers are not buying security narratives; they are pricing proof. If an organisation cannot demonstrate who can access what, how quickly access is revoked, and whether NHIs are under control, the underwriting conversation becomes an exposure assessment. Practitioners should treat insurance readiness as an extension of access governance, not a separate risk domain.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own cyber insurance readiness across security and identity teams?
A: Ownership should sit across security, IAM, legal, risk, and procurement, because the insurer is evaluating all of them indirectly. Security supplies the technical evidence, IAM supplies identity control maturity, and risk and legal translate that into acceptable terms. No single team can prove insurability on its own.
👉 Read our full editorial: Cyber insurance is now an identity control problem for NHIs
