Insurers now write the security baseline

No regulator tells a mid-sized manufacturer which authentication method to use on its remote access. Its insurer does, in a questionnaire, with renewal as the consequence of the wrong answer.

Cyber insurance has become the most prescriptive security standard most companies encounter, for a structural reason rather than an ideological one. The carrier pays the claim. That gives it both the motive to specify controls and the loss data to know which ones correlate with not paying.

Multi-factor authentication is the clearest case. Guidance published by security firms summarizing what carriers now ask for describes MFA treated as a precondition rather than a control to be discussed, applied across remote access, administrative accounts, email and cloud platforms.

The requirement has also become more specific over time. Where a carrier once accepted that MFA existed, brokers now describe questions about which factor, on which accounts, with a preference for methods that cannot be relayed by an attacker sitting between the user and the login page.

Coverage has narrowed in the same direction. Endpoint detection deployed everywhere rather than mostly, backups that are immutable and have actually been restored from, a written incident response plan, and evidence of security training now appear as conditions rather than as favorable factors.

The larger shift is evidentiary. Practitioners advising on renewals describe underwriting moving from asserted controls toward proof they were operating, which changes what a security team must be able to produce and when.

That distinction decides claims. A company that had MFA policy-wide but exempted a service account, and was compromised through that account, has a coverage argument rather than a payout. The control existed. The evidence of enforcement, on the day, did not.

Security leaders have noticed the leverage this creates internally. A capital request that stalls for three budget cycles moves in a week when the alternative is a premium increase or a declined renewal, and the finance function understands the second framing immediately.

Whether this is good policy is contested. Insurance is a poor instrument for setting public standards: it is priced for the insurer's book rather than for social harm, it covers only organizations that buy it, and its requirements can change on renewal with no consultation.

It is also, at the moment, the only mechanism reaching mid-market companies with anything specific. Frameworks are voluntary, regulation is sectoral, and neither arrives with a date and a price attached.

The practical advice from brokers is unromantic and has nothing to do with security architecture. Assemble the evidence before the renewal rather than during it, because the organizations that struggle are rarely the ones with weak controls. They are the ones that cannot prove on demand which controls were running.