Impress Your Cyber Insurance Underwriters With These Essential Tips

Cyber insurance is a safety net which protects businesses from the potentially catastrophic costs of ransomware, data breaches and other digital threats. Which is true - as long as an organisation manages to satisfy the increasingly rigorous security controls to meet the coverage qualification criteria.   

By Joseph Carson

In the face of accelerating insider cyber crime, a rise in ransomware attacks and other threats, some insurers are increasing their premiums. Others are simply exiting the market altogether. As a result, cyber insurance is becoming more expensive and harder to obtain.

Organisations can no longer contact an insurer, arrange coverage and relax, safe in the knowledge that a big pay out will allow them to mop up the financial damage of a cyber attack, should one occur. In order to simply qualify for protection, businesses must be able to demonstrate their cyber resilience and prove they have deployed appropriate protection.

We argue that the best place to start is by securing a well-known defensive weak point: privileged access which has administrator-level powers. 

Check Your Privileged Access

If an attacker manages to crack into a privileged user account, they gain the literal keys to the kingdom, and it could be game over for defenders. This is one reason why businesses should ensure key corporate assets are only accessible to authorised users.

Privileged Access Management (PAM) is one of the best solutions to protect and manage access. Yet as well as improving an organisation’s security posture, a PAM solution also demonstrates that a business has reduced the risks and is better prepared to face the latest threats. We are not alone in making this claim, because underwriters are also now questioning clients as to whether they have deployed secure access systems before signing off insurance policies. PAM should therefore be a foundational part of any organisations’ cybersecurity posture.

Insurers evaluate cyber risk using a variety of models and metrics. AIG, for instance, makes its evaluation metrics available to the public. Others, including Zurich use frameworks from the National Institute of Standards and Technology (NIST) to carry out a cyber risk assessment report. The methods of assessing risk will vary among providers, but they are all looking for the same fundamentals: strong, proactive cybersecurity defences that respond to the latest threats. Secure access is an important part of risk reduction insurers are looking for when making decisions. 

The authoritative Verizon Data Breach Investigations Report 2021 found that 61% of breaches involved credentials, with stolen credentials used in 25% of breaches. It is so easy to buy or steal passwords that organisations must be realistic about the limited protection they offer. PAM is a more robust way of securing access, protecting privileged accounts from unauthorised access, and limiting the potential damage of an incident. 

Managing Privileged Access

A PAM solution can monitor all administrator accounts usage to discover unusual behaviour. This could be as simple as detecting a logon at 3am on a Saturday morning, which could reveal that a business either has some seriously hard-working employees or that a threat actor is trying to access its network. 

Red flags can also be raised if a privileged account starts accessing large amounts of sensitive information or when a high number of privileged user accounts are accessed at the same time. If a manager’s account suddenly starts exfiltrating data and uploading it to a mysterious, unknown website, they have either been compromised or conducting actions that put the organisations at increased risks.. Spotting this behaviour and shutting it down quickly limits the damage.

PAM tools reduce risk and liability, protecting against external threats as well as internal, insider risks. Multi-factor authentication (MFA) is another vital part of the puzzle, protecting privileged accounts from unauthorised access. Insurers will look favourably on businesses which have deployed this technology and can therefore prove they protect privileged accounts as well as monitor their usage for anomalies. 

When looking for a PAM solution, decision makers should be sure to check it offers automation which manages authentication, authorisation and monitoring. It should also focus on orchestration, serving as a kind of conductor that enables the security team to launch and fine-tune a multifaceted defence that enables seamless, secure access when needed on demand – or prevents it where necessary. 

Installing PAM is not just a useful first step to securing insurance. It will allow organisations to meet their insurers’ changing requirements. In an age where cyber insurance is becoming harder to obtain and more expensive, it pays to have an answer to underwriters’ questions before they ask them.

Businesses that have deployed PAM will have a powerful argument in their favour and give them a serious advantage when securing or renewing a cyber insurance policy. 

Joseph Carson is Chief Security Scientist at Delinea

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

 

« Finland Hit By Cyber Attacks
Cyber Criminals Volunteer For War In Ukraine »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DLA Piper

DLA Piper

DLA Piper is a global law firm with offices throughout the Americas, Asia Pacific, Europe and the Middle East. Practice areas include Cybersecurity.

NICE Systems

NICE Systems

NICE Systems provide software solutions to ensure compliance, fight financial crime, and safeguard people and assets.

TraceSecurity

TraceSecurity

TraceSecurity, a leading pioneer in cloud-based security solutions, provides IT governance, risk and compliance (GRC) management solutions.

Canadian Security Intelligence Service (CSIS)

Canadian Security Intelligence Service (CSIS)

CSIS collects and analyzes threat-related information concerning the security of Canada in areas including terrorism, espionage, WMD, cybersecurity and critical infrastructure protection.

TechVets

TechVets

TechVets is a non-for-profit helping UK veterans and service leavers retrain into Cyber Security and Technology jobs.

Shieldfy

Shieldfy

Shieldfy is a cloud-based security shield for your website to protect it from cyber attacks and malwares.

SaltStack

SaltStack

SaltStack develops award-winning intelligent IT automation software. We help businesses more efficiently secure and manage all aspects of their digital infrastructure.

SyncDog

SyncDog

SyncDog is a leader in enterprise security and the preeminent vendor for containerized mobile application security across cloud & on-premise computing environments.

DeVry University - Cyber Security Degree

DeVry University - Cyber Security Degree

Explore the dynamic world of data protection with a hybrid or online cyber security degree specialization with DeVry's IT & Networking Bachelor's Degree.

Datrix

Datrix

Datrix is a leading Smart Infrastructure and Cyber Security solutions provider. We deliver critical networking, communications and cyber security solutions to public and private sector organisations.

Dope Security

Dope Security

Dope Security is a fly-direct Secure Web Gateway that eliminates the data center stopover architecture required by legacy providers, instead performing security directly on the endpoint.

American Technology Services (ATS)

American Technology Services (ATS)

American Technology Services provides unparalleled services in information technology to support small and mid-sized business. From top-level strategy, to managed services and infrastructure support.

AFRY

AFRY

AFRY is a world leading engineering company, trusted as a supplier of services and solutions within the industry, energy, and infrastructure sectors as well as for authorities.

Autobahn Security

Autobahn Security

Autobahn Security is a growing team of 80+ experts from 25+ nationalities, established in 5 countries. We’re working hard to make Autobahn Security the No. 1 solution for improved hacking-resilience.

CorePLUS Technologies

CorePLUS Technologies

CorePlus solutions are designed to empower organizations with the tools they need to ensure the utmost protection for their assets, people, and information.

Sectricity

Sectricity

As independent ethical hackers, Sectricity go beyond traditional security, uncovering every vulnerability - testing both systems and employees to eliminate weak spots.