Mathew Potter
Security Analyst
Cyber insurance used to feel like a checkbox. Answer a questionnaire, attach a policy PDF, move on. In 2026 it behaves more like a technical review, and that shift is catching firms that upgraded email but forgot the firewall admin panel.
Across the market, the same controls keep showing up: multi-factor authentication on email, VPN, remote access, and every privileged account. Endpoint detection and response on laptops and servers, not consumer antivirus. Backups that someone has actually restored, on a date you can document. A written incident response plan that has been rehearsed, not shelved.
Brokers report instant denials when MFA is "available" but not enforced, when EDR coverage sits below what the application claimed, or when the backup story falls apart the first time an adjuster asks for a restore log.
The painful cases are not always exotic hacks. A firm states MFA is on all accounts. The breach entry path is an RDP server without it. The carrier argues the application did not match reality. Coverage fights follow.
That is why we tell clients to treat renewal like an audit. Walk the questionnaire line by line with someone who can pull config exports, not just someone who remembers the last IT meeting.
The gap is rarely Microsoft 365 anymore. It is the old client portal, the vendor-hosted matter tool, the partner extranet that never got tied to your identity provider. If it is on the internet and it holds sensitive data, assume it is in scope.
Forensic Five runs fixed-scope assessments aimed at renewal and client questionnaires: external attack surface, mail authentication, access patterns, and a short list of fixes ranked by effort. You get a written report with evidence, not a slide deck of buzzwords. Your MSP keeps running the environment. We add the independent layer insurers and outside counsel questionnaires expect.
Start early. Ninety days before renewal is safer than ninety hours. Gather proof while things are calm. If the only documentation you have is a checkbox on a form, assume the underwriter will ask for more.