Topic starter
10/12/2025 1:08 pm
TL;DR: Insurers now require specific security controls for coverage, and 70% of security leaders reported higher cyber insurance costs when renewing or applying, according to Delinea and Censuswide. Identity security maturity, especially PAM and access controls, is becoming a financial as well as operational gate for insurability.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Cyber insurance trends: What IT security leaders must prepare for in 2026”.
By the numbers:
- Almost all organisations, 99.5%, reported that insurers required specific security controls, activities, or processes to secure coverage.
- 70% of respondents reported cost increases when applying for or renewing their cyber insurance policies.
Key questions
Q: What breaks when identity controls are weak in cyber insurance underwriting?
A: Weak identity controls break the insurer’s ability to trust that access risk is bounded.
Q: Why do insurers focus so heavily on privileged access management?
A: Because PAM is one of the clearest indicators that an organisation can restrict, observe, and revoke elevated access.
Q: How should organisations prepare identity evidence for a cyber insurance renewal?
A: They should prepare a control pack that shows MFA coverage, privileged access reviews, secret handling, and offboarding discipline.
Practitioner guidance
- Document privileged access evidence Maintain current proof of privileged access management, access review completion, and access approval workflows so underwriting teams can verify control operation.
- Map control requirements to policy language Compare insurer control requests against your identity governance, incident response, and authorisation evidence to find gaps before renewal.
- Remove standing privilege where possible Reduce persistent elevated access and replace it with task-scoped approval and review processes that can be shown to insurers.
Bottom line: The article shows that cyber insurance is now acting as a governance test for identity maturity, especially where privileged access and access control are concerned.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:17 am
Identity maturity is now a commercial control, not just a security metric: insurers are using identity and access governance as a proxy for enterprise risk. That changes the function of PAM, access review, and authorisation controls from internal hygiene to external eligibility criteria. The implication is that identity programmes must be measured in risk terms the business can defend, not just in control completion terms.
A question worth separating out:
Q: What is the difference between having cyber insurance and being insurable?
A: Having a policy means coverage exists on paper. Being insurable means the organisation can still satisfy the insurer's control expectations, maintain eligibility at renewal, and avoid exclusions or denials when identity governance, privilege, or response discipline is weak.
👉 Read our full editorial: Cyber insurance is making identity maturity a coverage requirement