Notifications
Clear all
Topic starter
25/08/2026 9:13 am
TL;DR: Cyber insurers have moved beyond accepting checkbox MFA claims and now reward only provable enforcement, phishing-resistant methods, and coverage across privileged and remote access, according to Secret Double Octopus. The underwriting lesson is that identity assurance, not policy language, now determines whether the risk is insurable at all.
NHIMG editorial — based on content published by Secret Double Octopus: No MFA, No Policy: How Cyber Insurance Quietly Became an Identity Audit
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do phishing-resistant MFA methods matter if attackers can still get in?
A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths.
Q: How do security teams know whether their MFA programme is actually defensible?
A: They know it is defensible when they can prove enforcement across the access paths insurers and attackers both care about, especially remote access and privileged accounts.
Practitioner guidance
- Inventory every MFA enforcement point Map MFA across email, VPN, remote desktop, admin consoles, privileged accounts, and any exempted legacy paths so you know what is actually covered.
- Separate phishing-resistant MFA from generic MFA Document which users and systems use FIDO2 or WebAuthn, and keep that evidence distinct from SMS, TOTP, or push-based access.
- Prepare an underwriting evidence pack Export conditional access policies, sign-in logs, and privileged access reports that prove enforcement rather than merely showing settings exist.
What's in the full article
Secret Double Octopus' full article covers the operational detail this post intentionally leaves for the source:
- The insurer-facing evidence patterns behind MFA attestation, including what carriers ask to see during renewal.
- The policy mechanisms that can turn MFA failures into rescission, exclusions, or reduced sub-limits.
- The specific examples of how phishing-resistant MFA changes underwriting outcomes compared with basic MFA.
- The practical gaps in coverage for privileged, remote, and legacy access paths that the article walks through.
👉 Read Secret Double Octopus' analysis of why cyber insurance now depends on provable MFA →
Cyber insurance MFA proof: are your identity controls defensible?
Explore further
25/08/2026 9:14 am
Cyber insurance is now a proxy audit of identity maturity. The market is no longer pricing the presence of MFA alone. It is pricing whether MFA is enforced on privileged access, whether it is phishing-resistant, and whether the organisation can prove it at underwriting time. That makes cyber insurance a governance stress test for IAM, PAM, and access review discipline, not just a financial product decision. Practitioners should expect proof-based underwriting to keep expanding into adjacent identity controls.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, which shows how quickly unmanaged identity exposure turns into repeated operational risk.
A question worth separating out:
Q: Who is accountable if an organisation misstates MFA coverage to an insurer?
A: Accountability sits with the organisation that certified the control, typically shared across security, IAM, and risk leadership depending on how the questionnaire was approved. Misstatement can trigger rescission, exclusion disputes, or denied claims. That is why control attestation must be treated like governed evidence, not casual administrative input.
👉 Read our full editorial: Cyber insurance questionnaires are now identity audits in practice
