By Bob Thompson, Senior Technology & Cybersecurity Advisor
AI Reveals the Patterns. Experience Uncovers the Meaning. Decisions Drive Results.
Cybersecurity insurance coverage has typically required completion of a survey to identify the tools and processes in place to protect your company from cyber threats. The underwriter reviewed the responses and issued a policy or provided to you a gap analysis of changes that were required before coverage would be provided. Whether or not you are provided insurance coverage has become increasingly evidence-driven. Underwriters are scrutinizing MFA, EDR, resilient backups, privileged access, incident response and proof that those controls actually operate, rather than accepting a simple checkbox application.
Your security environment does not stand still!
The next challenge is even more fundamental.
Even if everything is correct on the day the insurance application is completed, it may not remain correct.
A business changes continuously:
- employees join and leave
- administrators receive new privileges
- endpoints are purchased
- cloud applications are introduced
- vendors gain access
- systems move to the cloud
- acquisitions create new identities and devices
- firewall rules change
- vulnerabilities are discovered
- security agents fail
- backups miss jobs
- certificates expire
- Conditional Access exemptions accumulate
- SaaS applications appear outside normal procurement
- new internet-facing assets become exposed
A security assessment is therefore a snapshot.
Risk is a moving picture.
That is why annual validation alone is inadequate.
The insurance industry is moving to continuous monitoring of client IT architecture.
Continuous monitoring asks:
“Is something bad happening?”
Continuous validation also asks:
“Are the controls we rely upon, and that we represented to our insurer, still operating as expected?”
The insurance industry itself is moving in this direction
The evolution is not merely theoretical.
Coalition, for example, describes its insurance approach as Active Insurance, combining cyber coverage with security capabilities intended to prevent attacks, reduce exposure and assist in responding to threats.
Its Coalition Control platform explicitly describes continuous monitoring and alerting of internal and external threats, attack-surface monitoring, a dynamic Cyber Health Rating, third-party risk monitoring and zero-day vulnerability alerts.
This is particularly instructive because it illustrates the transformation:
Traditional insurance
Assess risk → bind policy → wait for claim → respond
versus an emerging active model:
Assess → insure → monitor → identify → remediate → validate → reassess
Cyber risk changes too quickly for an annual questionnaire to tell the whole story.
Cyber insurance has effectively become a continuous security validation exercise.
Continuous validation after binding includes the following required processes for your business:
Performed Monthly
- Review MFA registration and enforcement gaps.
- Review Conditional Access exclusions.
- Review privileged-role changes.
- Reconcile active endpoint and EDR populations.
- Review Defender sensor health.
- Review encryption exceptions.
- Review critical vulnerabilities.
- Review patch compliance.
- Review backup failures.
- Review high-severity security incidents.
- Review new externally accessible assets.
Performed Quarterly
- Review privileged access.
- Review guest and third-party access.
- Test representative restores.
- Review unsupported software.
- Review banking access and dual-control settings.
- Review critical provider access.
- Review security-control exceptions.
- Update the cyber-insurance readiness scorecard.
- Report material changes to executive management.
Performed Annually
- Conduct a ransomware tabletop.
- Conduct a business-email-compromise tabletop.
- Reassess critical systems and data.
- Test the full incident-response call tree.
- Review the insurance limit against current probable loss.
- Reassess business-interruption exposure.
- Review policy exclusions and endorsements.
- Review the broker and carrier’s performance.
- Begin the next renewal process at least 120 days in advance.
Don’t Forget – Event-driven review
Perform an immediate insurance-impact review after:
- Acquisition or divestiture
- Material increase in revenue
- Entry into a regulated industry
- Material cloud migration
- Change of MSP or MSSP
- Significant cyber incident
- Discovery of a previously unknown breach
- Major ransomware exposure
- Material control failure
- Loss of MFA, EDR or backup coverage
- Introduction of biometric data
- Significant change in payment processes
- Creation of a new internet-facing service
- Material increase in sensitive-record volume
While cybersecurity insurance coverage was at one time considered a “nice to have”, it has grown to be a foundational element of your company’s total security architecture. To make sure your policy is providing you services without surprises, remember to:
- Know Thyself: Know the organization, environment, exposures and dependencies.
- Prove Thyself: Support every material representation with current evidence.
- Continuously: Detect drift, remediate exceptions and preserve the evidence throughout the policy period.
