No MFA, No Policy: How Cyber Insurance Quietly Became an Identity Audit

Most conversations about MFA land in one of three places: it stops account takeover, it reduces breach risk, or an auditor requires it. There is a fourth reason that rarely makes the slide deck, and it now carries direct financial consequences. Your cyber insurance depends on it.

Not on having it. On proving it, enforcing it everywhere you said you did, and using the right kind.

Insurers stopped negotiating

A panel of UK cyber brokers speaking to Insurance Business TV in August 2026 described a conversation that has essentially disappeared from the market. A broker submits a risk without MFA, and the insurer offers terms anyway with a modest loading.

Selorm Kofi Domeh, broking manager at Talbot Jones, reviewed the last two years of submissions and found that insurers who would previously have engaged now respond differently. “Now it’s probably an outright no,” he said. [1]

Colin Fox, cyber insurance consultant at Integrity, part of Hayes Parsons, placed MFA at the top of the baseline list carriers expect, alongside least privilege, EDR, and privileged access management. A handful of insurers will still write a risk without MFA, but it has become a rarity rather than a viable strategy. [1]

The underwriting rationale comes down to attacker economics. Ethan Godlieb of Consilium Insurance Brokers framed it simply: compromising a person is cheaper and more reliable than defeating a purpose-built system, which is why social engineering drives so much of what carriers actually pay out. [1] Identity and access management, rather than network architecture, has moved to the front of the questionnaire as a result.

The market context makes this stranger than it looks

Underwriting discipline usually tightens when carriers are bleeding money. That is not what is happening.

AM Best recorded the eighth consecutive quarter of US cyber pricing cuts in Q1 2026, while the US market loss ratio climbed for a second straight year to 53, the first reading above 50 since the pandemic-era ransomware spike. [2] Read that correctly: a 53 loss ratio is a good year. Add a typical expense load, and cyber is still a comfortably profitable line. The number is worth watching for its direction, not its level.

In the UK, the softening on price is steeper. Marsh reported average UK rate reductions of 7% in Q1 2026, with midmarket accounts down 12% and the £1bn-£5bn revenue band down 19%. [3]

So carriers are competing hard on premium while profitable, and simultaneously refusing to bend on controls. That combination tells you they are not reacting to current results. They are pricing for the tail.

Severity data shows what that tail looks like. Chubb’s 2026 Cyber Claims Report found average severity for accounts above $1bn in revenue reached roughly $4.4 million in 2025, double the 2024 figure and 586% above 2021, driven by business interruption and privacy litigation costs. [4] Claims frequency for large US companies fell 34% over the same period. [5]

Those are Chubb’s figures. The interpretation is ours, and it is worth separating the two. One reading is that widespread controls now screen out routine losses, leaving a residue of events severe enough to defeat them. An equally plausible reading is that a single carrier’s frequency drop reflects shifts in appetite, portfolio mix, and retention rather than control effectiveness across the market. Chubb does not adjudicate between them, and neither will we.

What both readings share is a risk shape that rewards screening hard at the front door. If severity in the tail is rising regardless of cause, the rational underwriting response is to be selective about which risks enter the book, and selective on the controls most correlated with the losses that hurt.

What carriers actually require

A word on sourcing first, because this specific topic is polluted.

A statistic claiming that 96% of cyber insurers mandate MFA circulates across dozens of sites and is routinely attributed to Marsh McLennan. We could not locate it in any Marsh McLennan publication. The companion EDR figure is credited to Marsh by some sites and to Coalition by others, and at least one broker source puts the equivalent MFA number closer to 80%. We are not citing any of it.

What Marsh McLennan’s Cyber Risk Intelligence Center does publish is more useful anyway. The August 2025 report, Cybersecurity signals: Connecting controls and incident outcomes, correlates responses to the Marsh Cyber Self-Assessment against claims histories across thousands of organizations. [6] The CSA is Marsh’s cyber controls assessment and insurance application tool, so the population is organizations applying for cyber cover through the world’s largest broker. That matters for how the findings should be read.

The report scores controls by signal strength: the probability of a breach claim given a negative answer, divided by the probability given a positive answer. Above 1.0 means the control correlates with fewer breaches, and higher means a stronger correlation. Three of its findings bear directly on MFA, and the second is the one nobody quotes.

MFA has saturated. Affirmative CSA responses on MFA now run near 90% to 100% across almost all organizations. The report states plainly that the mere presence of MFA is no longer a strong risk differentiator, precisely because so few organizations lack it, and that the differentiators have moved to the type of MFA enforcement.

Be precise about what that figure is. These are self-reported answers on an insurance application, not verified deployments. The number cuts twice. Even taken at face value, MFA presence no longer separates one applicant from another. And being self-reported, these are exactly the kind of claims carriers have stopped accepting without evidence.

Which is why MFA ranks low as a category. Among the twelve control groups the report scores, MFA for remote and privileged access sits well down the list, below network hardening, EDR, logging and monitoring, awareness training, and incident response planning. Read carelessly, that looks like an argument against prioritizing MFA. It is the opposite. A control that nearly every applicant reports having cannot differentiate between applicants, so the category signal collapses toward 1.0. The variance has not disappeared. It has moved inside the control.

Inside the control, the type is what separates. Comparing phishing-resistant MFA deployments against those that are not, the phishing-resistant group shows a materially stronger signal, which Marsh characterizes as a 9% lower breach likelihood. [7] That percentage is derived from comparing the two signal strengths rather than measured directly.

One further detail. The report defines its MFA control category specifically around remote access and admin or privileged access. Marsh is not scoring whether you have MFA on corporate email. It is scoring the paths this article keeps returning to.

Earlier CRIC research found that MFA delivers its benefit only when applied across all critical and sensitive data, all remote login access, and administrator accounts, with organizations achieving that breadth 1.4 times less likely to suffer a successful attack. [8]

That is the underwriting logic in one line. Everyone has MFA, so having it earns nothing. What earns terms is which kind, and how completely.

The practical expressions of this are consistent across carriers. Phishing-resistant MFA built on FIDO2 or WebAuthn is expected on privileged accounts at higher coverage tiers, and SMS, while still tolerated as a floor for general users, is explicitly disfavored for high-value targets. [12] Carriers writing limits above $1 million increasingly ask whether admin accounts use hardware-backed keys rather than software TOTP. [13]

Attestation is also being verified. Applications now use external scanning to check what you claim, and misrepresenting controls, even unintentionally, is a leading cause of claim denial. [14]

The attack that changed the underwriting question

There is a specific reason carriers stopped counting factors and started grading them.

Adversary-in-the-middle phishing places a reverse proxy between the user and the real identity provider. The victim sees the genuine login page because it is the genuine login page, relayed. They enter the password, complete the MFA challenge, and the proxy captures the session cookie that the identity provider issues afterward. The attacker replays that cookie and is authenticated without ever triggering a prompt. Rotating the password afterward accomplishes nothing because the stolen artifact is the session, not the credential. [11]

This is not theoretical or boutique. Microsoft Threat Intelligence, tracking the Tycoon2FA phishing-as-a-service platform under the actor name Storm-1747, reported campaigns sending tens of millions of phishing messages to more than 500,000 organizations each month, across nearly every sector. [9] Open-source frameworks such as Evilginx put the same capability in reach of anyone who can follow a README.

The critical detail for insurance purposes is that AiTM defeats specific MFA types rather than MFA as a concept. SMS codes, TOTP apps, and push approvals are all relayable because each is a shared secret or an approval the proxy can pass through. FIDO2 and WebAuthn are not, because the cryptographic response is bound to the origin domain, and a proxy on a different domain cannot produce a valid one. Sophos, responding to continued Evilginx activity, advised organizations to move off token-based and push MFA toward phishing-resistant options. [10]

An underwriter who understands this cannot treat “we have MFA” as an answer. Neither should a security team.

Two cases that set the tone

Travelers v. International Control Services. Worth getting the facts right, because a great deal of secondary coverage misdates this case and describes a contested ruling that never happened.

Travelers filed for rescission and declaratory relief on 6 July 2022 in the US District Court for the Central District of Illinois (No. 22-cv-2145). The insured had stated on its application that it used MFA for administrative and privileged access. In practice, MFA protected only the firewall. A ransomware attack then exploited an administrative account with no MFA, and on 26 August 2022, both parties stipulated that the policy was null and void from inception. [15]

There was no judicial finding on the merits. What the case demonstrates is not that a court has endorsed rescission on these facts, but that an insured facing the argument declined to test it, and did so within weeks of the complaint. [16] That is its own signal about how defensible an inaccurate MFA attestation looks once litigation begins.

City of Hamilton, Ontario. A February 2024 ransomware attack paralyzed municipal services for weeks. Many city departments did not have MFA in place, which a staff report identified as “a root cause” of the breach. [17] Under the policy, no coverage was available for losses where the absence of MFA was the root cause, and roughly $5 million CAD in claims went unpaid. [17] Total recovery costs reached $18.3 million CAD, carried by taxpayers. [18]

Hamilton had a policy. Hamilton had MFA in some places. Neither was enough.

Four different ways MFA can cost you coverage

“MFA affects your insurance” collapses four distinct mechanisms that behave very differently. Knowing which one applies to your policy tells you what you are actually exposed to.

Mechanism	Where it lives	What happens when it bites	Example
Application representation	The proposal form you signed	Insurer seeks rescission. The policy is void from inception, every claim disappears, and premium is typically returned	Travelers v. ICS
Condition precedent / policy requirement	Policy conditions	The specific loss is not covered. The policy survives for other losses	City of Hamilton
Control-specific exclusion or carve-back	Exclusions section	Losses of a defined type are excluded, often ransomware or funds transfer, where the control was absent	Ransomware carve-backs conditioned on MFA
Sub-limit, coinsurance, or raised retention	Limits and retentions	Coverage responds, but at a reduced amount or with a larger share retained by the insured	Reduced ransomware sub-limit for partial MFA

Two practical implications.

First, rescission is the severe one. It is not a denial of one claim; it unwinds the contract. That is why the accuracy of your application answers is a bigger exposure than the state of any single system, and why re-reading last year’s proposal form is a worthwhile hour.

Second, the third and fourth mechanisms are the quiet ones. A policy that responds at a reduced sub-limit does not generate a news story, so the market discussion focuses on outright denials while most of the actual erosion happens in limits and retentions that nobody reads until a loss. Ask your broker to identify which mechanisms sit in your wording, and which of them reference authentication controls specifically.

The gap that catches organizations

The pattern across denials is consistent: coverage was strong where it was easy and thin where it was hard.

SaaS and email are straightforward. Conditional access policies in Microsoft 365 or Google Workspace enforce cleanly and export as evidence in a few clicks. The exposure sits elsewhere:

• VPN and remote desktop, especially where a handful of users were exempted for practical reasons, and nobody revisited it
• On-prem admin consoles, jump boxes, and hypervisors
• Legacy applications that predate modern identity protocols and never got federated
• Service and machine accounts that no human logs into, and no MFA policy covers
• Backup infrastructure, which attackers target specifically

Marsh’s implementation data directly support this. Between 2023 and 2025, almost every control it tracks moved up, some dramatically: target windows for patching high-severity vulnerabilities went from 24% to 89%. One control went backward. Management of desktop and local administrator privileges through endpoint privilege management fell from 35% to 27%. [6] The single control most closely tied to privileged access is the only one losing ground, which is a reasonable proxy for how hard this work is compared with switching on conditional access in a SaaS tenant.

This is exactly the mismatch we see in the field, and it shows up in our own research. In SDO’s 2026 State of Identity Security in Financial Organizations survey of 200 IAM leaders across US and Canadian financial institutions, only 28% of workforce MFA was phishing-resistant, while 82% of respondents were confident they could stop an account takeover. [20]

That confidence gap is also an insurance gap. An underwriter reading a control questionnaire is measuring the 28%, not the 82%.

What to do before your next renewal

Treat the questionnaire as a technical audit that happens to have a price attached.

1. Inventory every authentication path, starting with the ones nobody owns. Legacy apps, service accounts, and vendor remote access are where the exemptions hide.
2. Separate implemented from enforced. A policy that exists in report-only mode is not enforcement, and forensics will find the difference.
3. Collect evidence now, not at renewal. Carriers want exported conditional access policies and sign-in logs, not screenshots of available settings.
4. Upgrade privileged accounts to phishing-resistant factors first. That is where the coverage-tier questions concentrate, and where AiTM resistance actually matters.
5. Re-read your own last application. Any answer that has drifted since you signed it is a live exposure on a policy you are currently paying for.
6. Close gaps before you attest, not after. [19]

Insurers have concluded that identity is where losses originate, and they have priced access to the market accordingly. Phishing-resistant authentication started as a security recommendation. It is becoming a condition of insurability, and the organizations treating it as a compliance checkbox are the ones discovering the difference at claim time.

Close the gaps underwriters ask about

The MFA questions on a cyber insurance application are rarely hard to answer for SaaS and email. They get difficult at the VPN, the admin console, the legacy application that never got federated, and the accounts someone exempted three years ago.

ZeroPassword™ from Secret Double Octopus extends phishing-resistant, passwordless authentication across those environments, including the on-premises and legacy systems that most identity platforms leave behind. That means enforcement you can evidence, on the systems underwriters actually ask about.

See how ZeroPassword works → | Talk to our team about your environment →

Frequently asked questions

Does cyber insurance require MFA?

Yes. MFA functions as a condition of coverage with mainstream carriers in 2026, and UK brokers report that submissions without MFA now receive an outright decline rather than terms with a premium loading. In Marsh McLennan’s 2025 controls study, affirmative MFA responses from cyber insurance applicants range from 90% to 100%, which is why underwriting attention has shifted from whether MFA exists to which type is deployed and how completely. [1][6]

What kind of MFA do cyber insurers accept?

Carriers grade authentication factors rather than treating MFA as a single control. Phishing-resistant methods built on FIDO2 or WebAuthn are expected for privileged and administrative accounts at higher coverage tiers. Authenticator apps remain acceptable for general users at most carriers. SMS one-time codes are tolerated as a floor but are explicitly disfavored for high-value targets. Marsh McLennan reports that phishing-resistant MFA correlates with a 9% lower breach likelihood than non-phishing-resistant MFA. [6][7][12]

Why do insurers care about phishing-resistant MFA specifically?

Adversary-in-the-middle phishing kits relay the real login page through a proxy, capture the session cookie issued after a successful MFA challenge, and replay it. SMS, TOTP, and push approvals are all relayable this way. FIDO2 and WebAuthn are not, because the cryptographic response is bound to the origin domain. Microsoft tracked one such platform sending tens of millions of messages to over 500,000 organizations monthly. [9][11]

Can a cyber insurance claim be denied because of partial MFA?

Yes. The City of Hamilton, Ontario, had a cyber policy and had MFA in some departments. Its claim of roughly $5 million CAD was denied because the policy provided no coverage for losses where the absence of MFA was the root cause, leaving $18.3 million CAD in total recovery costs uncovered. Partial deployment is treated as non-compliance, not partial credit. [17][18]

Can an insurer cancel a policy over an inaccurate MFA answer?

Yes. Insurers can seek rescission, which voids the policy from inception rather than denying a single claim. In Travelers v. International Control Services, the insured attested to MFA on administrative access when MFA protected only the firewall, and the policy was declared null and void from inception by stipulation in August 2022. In many jurisdictions, a material misrepresentation is sufficient without proof of intent to deceive, though standards vary by state. [15][16]

What is the difference between rescission and a denied cyber insurance claim?

Rescission voids the policy from inception based on a material misrepresentation on the application, so every claim under it disappears. A denial based on a condition precedent or exclusion removes coverage for one specific loss while the policy survives. Travelers v. International Control Services involved rescission. The City of Hamilton involved a policy condition. Sub-limits and raised retentions are a third, quieter mechanism. [15][17]

Does MFA lower cyber insurance premiums?

Enforced and phishing-resistant MFA is more often a condition of insurability than a discount lever, particularly in a market where US pricing has fallen for eight consecutive quarters. Some carriers do apply credits for verified controls, but the financial value shows up mainly in access to coverage, higher available limits, fewer sub-limits and exclusions, and avoided claim denials. [2]

Which systems do insurers check for MFA?

Underwriters focus on the paths attackers actually use: email, VPN and remote desktop, cloud administrative consoles, privileged and service accounts, and backup infrastructure. Gaps most often appear outside SaaS, in legacy on-premises applications, jump boxes, hypervisors, and accounts exempted for operational reasons and never revisited.

What evidence do underwriters want for MFA?

Written attestation is no longer sufficient. Carriers increasingly ask for exported conditional access policies, sign-in logs showing enforcement, and configuration evidence, and some run external scanning to verify claims independently. A screenshot showing that a setting is available does not demonstrate that it is enforced. [14][19]

References

1. Sellers, M. “MFA used to be a nice-to-have. Now insurers just say no without it.” Insurance Business UK, 12 August 2026. https://www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave–now-insurers-just-say-no-without-it-585827.aspx
2. “US Cyber Insurance Market Sees Flat Premium, More Third-Party Claims Hit Loss Ratio.” Insurance Journal, 30 June 2026 (AM Best data). https://www.insurancejournal.com/news/national/2026/06/30/875802.htm
3. Dyson, B. “Cyber insurance pricing remains adequate despite steep falls in Q1 2026.” S&P Global Market Intelligence, 7 July 2026. https://www.spglobal.com/market-intelligence/en/news-insights/articles/2026/7/cyber-insurance-pricing-remains-adequate-despite-steep-falls-in-q1-2026-103396708
4. “Chubb: Cyber Claim Severity Nearly Doubled for Large Businesses.” Insurance Journal, 18 May 2026 (Chubb 2026 Cyber Claims Report). https://www.insurancejournal.com/magazines/mag-features/2026/05/18/869952.htm
5. “Chubb: Cyber claims frequency for large US companies fell 34% but severity doubled in 2025.” The Insurer, 30 March 2026. https://www.theinsurer.com/cyber-risk/news/chubb-cyber-claims-frequency-for-large-us-companies-fell-34-but-severity-doubled-2026-03-30/
6. Marsh McLennan Cyber Risk Intelligence Center, Cybersecurity signals: Connecting controls and incident outcomes, 27 August 2025 (report available on request; MFA findings pp. 9, 11, control implementation rates p. 5, signal strength methodology p. 6). https://www.marsh.com/en/services/cyber-risk/insights/cybersecurity-signals.html
7. “Incident response planning emerges as a key cybersecurity control in reducing cyber risk.” Marsh McLennan press release, 27 August 2025. https://www.corporate.marsh.com/news-events/2025/august/marsh-mclennan-cyber-risk-intelligence-center-report.html
8. “Groundbreaking Research From Marsh McLennan Reveals Direct Link Between Key Cybersecurity Controls and Reduced Cyber Risk.” Marsh McLennan, April 2023. https://www.corporate.marsh.com/news-events/2023/april/groundbreaking-research-from-marsh-mclennan-reveals-direct-link-.html
9. “Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale.” Microsoft Security Blog, 4 March 2026. https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
10. “‘Evilginx’ Tool (Still) Bypasses MFA.” Dark Reading, 24 September 2025. https://www.darkreading.com/endpoint-security/evilginx-bypasses-mfa
11. “State-of-the-art phishing: MFA bypass.” Cisco Talos Intelligence, 13 May 2025. https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/
12. “Cyber Insurance MFA Proof: What Carriers Require in 2026.” TDS, 20 May 2026. https://tds-is.com/blog/2026-05-20-mfa-cyber-insurance-2026
13. “MFA Requirements for Cyber Insurance: What Carriers Actually Want in 2026.” LeadingIT, 9 June 2026. https://goleadingit.com/blog/mfa-requirements-for-cyber-insurance-what-carriers-actually-want-in-2026/
14. “Cyber Insurance Requirements: What Carriers Want.” Breach Craft, 21 February 2026. https://breachcraft.io/resources/blog/cyber-insurance-requirements/
15. “Cyber Insurance Claim Denied: Why It Happens and How to Protect Your Payout.” LeadingIT (Travelers v. ICS, No. 22-cv-2145, C.D. Ill.). https://goleadingit.com/blog/cyber-insurance-claim-denied-reasons/
16. “10 Cyber Insurance Coverage Issues Every Producer Should Know.” Agency Checklists, 3 August 2026. https://agencychecklists.com/2026/08/03/cyber-insurance-coverage-issues-producers-83037/
17. Beattie, S. “Insurance won’t cover $5M in City of Hamilton claims for cyberattack, citing lack of log-in security.” CBC News, 31 July 2025. https://www.cbc.ca/news/canada/hamilton/cybersecurity-breach-1.7597713
18. “MFA failure costs Hamilton $18m in cyber insurance payout.” Specops Software, 12 November 2025. https://specopssoft.com/blog/mfa-failure-costs-hamilton-cyber-insurance/
19. “How to Answer the MFA Section of a 2026 Cyber Insurance Questionnaire.” InsurableIT, 26 April 2026. https://insurableit.com/posts/mfa-cyber-insurance-requirement.html
20. Secret Double Octopus, 2026 State of Identity Security in Financial Organizations (survey of 200 IAM leaders, US and Canada).