MFA isn’t enough for your cyber renewal any more

A few years ago, answering “yes” to the multifactor authentication question on a cyber application went a long way. It signaled a basic level of control and often moved a quote from declined to offered. Today it is the minimum. Underwriters still ask, but they now ask what sits behind the yes, and the rest of the application decides your terms.

Why MFA alone stopped being enough

Attackers adapted. Phishing kits now capture session tokens, some campaigns flood users with approval prompts until one is accepted, and stolen credentials for systems without MFA remain easy to buy. Underwriters see the claims that result, and their questions follow the pattern of those losses. MFA is still valuable, but a carrier no longer treats it as proof that the company is well defended.

What underwriters ask about now

Applications vary, but in our experience the following topics appear on most, and the answers affect price, retention and sublimits.

• Where MFA applies. Email, remote access and VPN, privileged and administrator accounts, and access to backups are commonly asked about one by one. A blanket “yes” that hides exceptions can be a problem at claim time.
• Backups. Are they kept offline or immutable, are they tested and how long would a restore take?
• Endpoint detection and response. Traditional antivirus is often no longer accepted as a substitute.
• Patching. How quickly do you apply critical security updates, and what is your process for systems that cannot be updated?
• Privileged access. Who holds administrator rights, and are those accounts separate from daily-use accounts?
• Incident response. Is there a written plan, and has it been rehearsed?
• Vendor risk. How do you assess the third parties that hold your data or access your systems?

Prepare in the 60 days before renewal

Cyber underwriting has become more of a technical review than a form-filling exercise, and the companies that fare best treat it as a project with a deadline. We suggest this sequence.

• Ask your IT lead or managed service provider to answer a mock application, with evidence for every yes.
• List the gaps and decide which ones you can close before the submission goes out.
• Close the inexpensive ones first. Enforcing MFA on remaining accounts and removing dormant administrator accounts are often quick.
• For gaps you cannot close, write a short note on the compensating control or the plan and timeline. Underwriters respond better to a credible plan than to silence.
• Send the submission with the evidence attached, not promised.

What good preparation buys

Carriers differ, so there are no guarantees, but strong answers can mean a wider choice of markets, lower retentions, better ransomware terms and, in some cases, a smaller premium increase than the market average. Weak answers can lead to sublimits, coinsurance or exclusions on the exact events you care most about.

The market has also moved toward outside scanning. Many carriers run an external scan of your domain before quoting, looking for open remote access ports, out-of-date software and exposed services. It is worth running a similar scan yourself, or asking us to arrange one, so the first time you see the results is not in the quote.

The controls that pay off beyond insurance

Nothing on this list exists only to satisfy an underwriter. Offline backups, endpoint detection and enforced MFA reduce the chance and cost of an incident whether or not you buy cover. We encourage clients to think of the renewal as a forcing function. It provides a date, an audience and a reason to finish security work that keeps slipping down the list.

A note on honesty

We have seen applications where a well-meaning executive ticked “yes” to a control that was deployed on most systems but not all. When a loss followed, the exception became the story. Our advice is to answer precisely, describe exceptions and let us negotiate from an accurate position.

If your renewal is coming up, send us the last application and the current policy. We will mark the questions most likely to have changed and tell you what evidence to gather.