Cyber insurance used to be fairly straightforward. If something went wrong—a breach, ransomware, or data loss—you had a policy in place to help absorb the financial impact. It functioned as a safety net, and for a while, that was enough.
But that model doesn’t hold up the way it used to. The threat landscape has shifted, and with it, the way insurers evaluate risk. In fact, business email compromise and funds transfer fraud accounted for 58% of cyber insurance claims in 2025. That’s not just a spike in activity; it’s a reflection of how attackers are targeting identity and access in ways that are harder to detect, easier to exploit, and increasingly costly to recover from.
What was once a reactive safeguard is now much more closely tied to how well an organization can prevent incidents in the first place.
The Risk Isn’t Just Higher. It’s Different.
For a long time, security strategies were built around keeping attackers out. Firewalls, antivirus, and perimeter defenses were designed for a world where networks had clear boundaries and users stayed inside them. Those controls still matter, but they were built for a very different way of working.
Today, work happens across cloud platforms, remote devices, and third-party environments. Access isn’t tied to a single network anymore, and identities exist well beyond traditional infrastructure. Attackers have adjusted accordingly. Instead of forcing their way in, they’re logging in – using stolen credentials, phishing attacks, or session hijacking to blend in with legitimate activity.
That shift changes how risk needs to be understood. It’s no longer just about keeping threats out. It’s about managing access, visibility, and behavior across a much broader environment.
Cyber Insurance Is No Longer Just a Backstop
As claims have increased in both frequency and cost, insurers have had to respond. Coverage is more conditional, premiums are higher, and organizations are being asked to demonstrate that they are actively reducing risk, not just transferring it.
That shows up in ways like:
- More detailed and technical security questionnaires
- Coverage tied directly to specific controls
- Greater scrutiny during underwriting and renewal
- Potential claim denials if required controls aren’t in place
Cyber insurance is no longer just about what happens after an incident. It’s becoming a reflection of what’s in place before one ever occurs.
Why Identity Is Getting So Much Attention
As attackers continue to rely on compromised credentials, identity has become one of the most important control points in modern security. It’s also one of the areas insurers are focusing on most heavily.
There’s a clear reason for that. If access is the new perimeter, then identity is what defines it. That’s why requirements are increasingly centered around multi-factor authentication (and how it’s implemented), privileged access management, monitoring for unusual or risky login behavior, and conditional access and access policies.
Having these tools in place is only part of the equation. What matters is how well they are configured, enforced, and maintained over time.
Where General Informatics Fits In
When they apply for new or renewal cyber insurance many organizations start to run into friction. They’ve invested in tools. They’ve taken steps to improve security. But there’s often a disconnect between what’s in place and what insurers are actually evaluating – General Informatics removes this disconnect by bridging the gap with Advisory Services.
The focus isn’t on adding more for the sake of it. It’s about making sure the right controls are working the way they should – and communicating how they align with how risk is being measured today. That includes:
- Strengthening identity security and access controls
- Improving visibility across users, devices, and systems
- Aligning security controls with cyber insurance requirements
- Building and validating incident response processes
- Providing ongoing monitoring and guidance as environments evolve
It’s less about checking boxes, and more about closing the gap between perceived security and actual risk.
This Isn’t About Meeting Requirements
It’s easy to treat cyber insurance requirements as a checklist. Implement MFA, deploy endpoint protection, document a response plan, and move on.
But that approach misses the bigger picture. These requirements are not arbitrary; they reflect the same areas attackers are actively targeting. Organizations that treat them as part of a broader strategy, rather than a one-time exercise, are in a much stronger position.
Because at the end of the day, the goal isn’t just to qualify for coverage. It’s to reduce the likelihood of ever needing it.