The sad reality is that in today’s digital economy, cyberattacks happen. It’s not a question of if your business will be hit but when…and how much it will be disrupted. In September, the Cyber Insurance Report,a survey of 300 businesses, revealed that 62% of businesses surveyed had filed a cybersecurity insurance claim in the past 12 months. 27% have filed multiple claims in the past 12 months, highlighting the ongoing nature of these threats.

If you haven’t yet faced a cyberattack, you’re among a shrinking minority. Cybercriminals don’t discriminate based on the size of your business or the industry you’re in. Your data holds value, and criminals want it.

47% of these attacks that led to an insurance claim were linked to identity or privilege compromises.

Identity Security – 25%

Whether it’s an easy-to-guess password (the top 10 compromised passwords in 2024 include 123456, qwerty, and password), or a password that is shared with other accounts like social media, criminals know the easy way inside your network is with a valid password. Insurers are responding to this by increasing their underwriting requirements to ensure policyholders are proactively managing identity security risks. Simply put, you’re going to have to show your insurance company that you are already using multi-factor authentication (MFA) on as many systems as possible and have plans to migrate to MFA as quickly as possible on the remaining systems.

Privilege Security – 22%

When you create accounts for your employees, systems should require you to select a privilege level for that account. Privileges should be tailored to specific roles and the lowest privilege level required for that role should be assigned. Security-relevant functions should be restricted to select IT users. Rank and file employees should have privilege levels that enable them to do their jobs but not make system configuration changes. Different vendors have different names for these separate privilege levels, and some systems default to high privilege levels. The danger is that when employees have accounts with higher privileges than they need, and those accounts are compromised, the criminals now have access to the ability to change security settings, install malware, and access sensitive data.

Insurers Increasing Requirements

Nearly all those surveyed said their cyber insurance provider has some form of identity security requirement and 41% said their insurers now require them to have a least-privilege access control process in place before issuing a policy. Other security controls that insurers are requiring include:

• Threat detection and incident response plan
• Monitoring and audit trails
• Credential/password management
• Secure remote/third-party controls
• Multi-factor Authentication (MFA)

Maintaining Security Controls Is Required

Respondents to the survey indicated several situations in which insurers can void the coverage and deny any claims. Those include:

• Not maintaining security controls
• Misconfiguration
• Not following compliance procedures
• Not reporting to the insurance company within the required time frame

So while it’s harder to get a cybersecurity insurance policy, it’s also going to take continued dedication to keep it.

Prepare Now for Your Renewal

With insurance companies refusing to renew policies until these new requirements are met, your business can’t afford to wait until renewal time to get started. The 2025 planning and budgeting season is about to begin, so now is the time to audit your current identity and privilege security status and build any improvements into your 2025 plans. The good news from the survey is that forward-thinking companies can negotiate lower rates. Companies that adopted AI-enhanced security solutions in the areas of threat detection and monitoring, behavioral analytics and auditing, and contextual MFA reported lower premiums as a result. Cyber insurance is designed to work in concert with your internal security controls and processes. The more you invest to prevent and minimize attacks, the less you’ll spend on premiums.