The most expensive mistake may be a checkbox
Most advice on cyber insurance tells you which controls to buy so you can qualify. That's only half of it. Your application answers become part of the deal, so a confident "yes" that's only mostly true could hurt you at the worst possible moment.
In 2022, Travelers asked a federal court to rescind a cyber policy, alleging the insured had said it used MFA for administrative or privileged access when it only used MFA on its firewall. The parties then agreed the policy was void from its inception. These were Travelers' allegations, and the court never ruled on the facts.
What the questions really ask
Two real questions from published applications, and where the answer usually falls short.
| The question | Where it usually falls short |
|---|---|
| Is MFA enforced to secure all remote access to your network, for all employees and third parties, on all applications? | An IT provider's remote tool, an old VPN account or a vendor login. One exception makes "all" untrue. |
| Do you use MFA to protect all local and remote access to privileged user accounts? | Admin access from inside the office, and service accounts, are easy to forget. |
Three tests to run before you sign
- ///Try to sign in without MFA
Sign in as a test user on webmail and VPN from a personal device. If a password alone gets you in, your answer is no.
- ///Pull the MFA report, don't just ask
Export the authentication report from your admin console and look for anyone not enrolled, and any exemptions.
- ///Ask who can delete the backups
If a stolen admin password can reach your backup console, your offline copy may not be as separate as your application says.
We don't attack the 95% you protected. We go looking for the one exception: the old VPN account, the server with no MFA, the vendor's remote tool. One exception is all we need.
What's in the full PDF
- ///A question-by-question table built from real insurer applications
- ///Nine hands-on tests and a fillable evidence log for your renewal file
- ///What to do when the honest answer is "no" or "mostly"
- ///Questions for your broker about exclusions, stolen funds and notice deadlines