Essential Security Metrics for Cyber Insurance Compliance in 2026

The underwriting shift toward evidence-based controls

The landscape of cyber insurance underwriting has shifted dramatically in recent years. What was once a simple questionnaire with check-boxes attesting to basic security measures has evolved into a rigorous, evidence-based audit. Carriers now require verifiable proof — screenshots, scan results, configuration exports, signed attestations — that specific, critical controls are not only implemented but actively monitored and managed. Many underwriters now run their own external scans against an applicant's perimeter before binding coverage, so the days of self-reported checkboxes going unverified are largely over.

For organizations seeking cyber liability coverage in 2026, understanding these requirements — and knowing which metrics to track and document — is no longer optional. It is a prerequisite for coverage, and increasingly, for favorable pricing.

1. Identity and Access Management

Identity compromise is widely recognized as the primary gateway for successful cyberattacks. Consequently, identity-centric controls have become a cornerstone of insurability — and often the first section of any modern cyber application.

• Multi-Factor Authentication (MFA) Coverage MFA is now mandatory across virtually all cyber insurance policies. Insurers require evidence of universal MFA enforcement across email, VPNs, cloud platforms, and all administrative accounts. Increasingly, carriers distinguish between MFA types: push notifications and SMS codes are viewed as weaker controls, while phishing-resistant methods like FIDO2/WebAuthn passkeys are specifically called out — and sometimes required — for privileged and administrative access.
• Metric to track percentage of user and admin accounts with MFA enforced (carriers generally expect 100% for privileged accounts, 95%+ overall).
• Evidence MFA enrollment reports from your identity provider, broken out by account tier.
• Privileged Access Management (PAM) and Just-in-Time Access Underwriters scrutinize how organizations govern privileged access. Historically this meant demonstrating role-based access controls (RBAC) and session recording for admin accounts. That bar has risen: carriers increasingly flag standing privileged access — accounts with always-on admin rights — as a risk factor independent of whether PAM tooling exists. Just-in-time (JIT), time-bound access grants that expire automatically are becoming a named control on some applications, not just a best practice.
• Metrics to track number of standing privileged accounts (target: minimize toward zero), average duration of privileged access grants, percentage of admin access provisioned via time-bound/JIT workflows.
• Evidence access logs showing grant/revoke timestamps, PAM or JIT platform audit trails.
• Least Privilege Enforcement Organizations must demonstrate practical application of least-privilege principles across systems and accounts, typically evidenced through periodic access reviews and deprovisioning records.
• Metric to track time-to-deprovision after employee termination or role change (target: under 24 hours).

2. Endpoint Detection and Response (EDR)

Traditional antivirus is no longer sufficient to secure coverage. Carriers now expect robust, actively managed endpoint protection — and increasingly ask not just whether EDR is deployed, but who is watching it.

• Deployment Coverage Organizations must deploy EDR or extended detection and response (XDR) platforms across all endpoints, including remote and BYOD devices where applicable.
• Metric to track percentage of managed endpoints with EDR agents installed and reporting (target: 100% of company-owned devices).
• Monitoring Model: Self-Managed vs. MDR This is a distinction many applications now probe directly. Deploying an EDR agent is not the same as having 24/7 alert triage. Carriers want to know whether detection is monitored in-house during business hours only, by an internal SOC around the clock, or outsourced to a managed detection and response (MDR) provider. Applicants who can show continuous, staffed monitoring — rather than tooling that generates alerts nobody reviews — are viewed more favorably and often see better pricing.
• Metrics to track mean time to detect (MTTD), mean time to respond (MTTR), alert coverage window (business hours vs. 24/7).
• Evidence SOC/MDR contract or staffing documentation, sample incident response timelines.

3. Resilience and Recovery Architecture

The exponential rise in costly ransomware claims has made backup and recovery architecture a central underwriting focus — arguably second only to identity controls.

• Immutable and Air-Gapped Backups Backups must be secured against tampering. Insurers require immutable or air-gapped backup solutions to ensure backups cannot be encrypted or destroyed alongside production systems during a ransomware attack.
• Metric to track percentage of critical systems backed up to immutable/air-gapped storage (target: 100%).
• Backup Security Off-site storage and strong encryption of backup data, both at rest and in transit, are standard requirements.
• Restoration Cadence Having backups is not enough. Insurers demand documented evidence of regular restore testing to confirm recovery actually works under pressure, not just that backups complete successfully.
• Metric to track restore test frequency (industry expectation: at least quarterly) and documented recovery time objective (RTO) achieved during the most recent test.

4. Vulnerability and Patch Management

Unpatched systems remain a leading cause of security incidents, and carriers closely evaluate patching discipline as a leading indicator of overall security hygiene.

• Patching SLAs Organizations must implement formal patch management policies with documented Service Level Agreements dictating timelines for updates by severity.
• Metric to track patch SLA adherence rate against defined windows — commonly 15 days for critical vulnerabilities, 30 days for high, 90 days for medium (exact windows vary by carrier and policy).
• Vulnerability Scanning Regular vulnerability assessments with clear prioritization of remediation based on severity are expected. Some carriers run their own external scans against an applicant's perimeter — often through platforms similar to those used in standardized cyber applications (e.g., NetDiligence-style assessments) — before binding coverage, so unresolved externally-visible vulnerabilities can affect both eligibility and pricing.
• Metric to track number of open critical/high vulnerabilities exceeding SLA, time since last external scan.

5. Incident Response Readiness

Insurers need assurance that an organization can respond effectively and limit damages when — not if — a breach occurs.

• Documented Incident Response (IR) Plan A formal, written IR plan is essential, defining critical systems, response roles, escalation procedures, and legal/regulatory notification protocols.
• Tabletop Exercises Insurers require proof that the IR plan is tested regularly through tabletop exercises, confirming the response team can execute the plan under realistic pressure rather than just on paper.
• Metric to track tabletop exercise frequency (industry expectation: at least annually) and date of most recent exercise.

6. Email Security and Employee Awareness

Human error and phishing remain leading breach vectors, so insurers scrutinize both technical email defenses and workforce training.

• Email Security Configuration Essential controls include SPF, DKIM, and DMARC enforcement (with DMARC set to a reject or quarantine policy, not just monitoring), along with specific anti-Business Email Compromise (BEC) controls.
• Security Awareness Training Measurable completion rates for training programs and results from regular phishing simulation campaigns are standard required proof points.
• Metrics to track training completion rate (target: 95%+ annually), phishing simulation click-through rate (industry benchmark: under 5-10%, trending downward over time).

7. Third-Party Vendor Risk

For organizations handling sensitive data — PHI, PII, financial records — underwriters evaluate how third-party risk is managed.

• Vendor Risk Management Insurers look for documented assessments of any third-party vendor with access to sensitive company data, along with evidence of ongoing (not just onboarding-time) risk review.
• Metric to track percentage of critical vendors with a completed risk assessment on file, review cadence (typically annual).

Summary: Controls, Metrics, and Evidence at a Glance

Related reading

• Translate insurer questions into concrete identity, endpoint, recovery, and monitoring controls with the cyber-insurance endpoint and identity controls explainer.
• Map identity and endpoint operations to control objectives with the SOC 2 evidence mapping guide.
• Find more underwriting and evidence resources in the compliance hub.

Preparing for Application or Renewal

Preparation for a cyber insurance application or renewal should begin well before the deadline.

Organizations must shift from simply asserting that security controls exist to actively maintaining the documentation, metrics, and continuous compliance evidence necessary to prove it. Carriers reward applicants who can produce this evidence quickly and specifically — vague assurances slow down underwriting and can result in higher premiums, sub-limits, or coverage exclusions for the very risks (like ransomware) that matter most.