How IAM Maturity Shapes Cyber Insurance Underwriting

Cyber insurance underwriting used to mean a short questionnaire and a premium quote. It has quietly become an identity audit. A Delinea survey conducted with Censuswide across more than 750 security leaders found that 97% of respondents said identity-related controls influenced their premium or coverage terms at renewal, and that privileged access management was the single most commonly cited factor, shaping terms at 41% of organizations. (Delinea sells PAM products, so treat the exact percentages as directional rather than independently audited, but the direction matches what brokers and risk teams report across the market.)

This article covers what underwriters actually ask about identity, why the questions map so cleanly onto IAM maturity domains, and how to walk into a renewal with evidence instead of best guesses.

Why Insurers Care About Identity Specifically

Insurers price risk from their own claims data, and identity keeps showing up as the way attackers get in. Coalition's Cyber Threat Index 2025, drawn from its own book of claims and underwriting data, found that stolen credentials and exploited software were the leading initial access vectors across ransomware incidents, and that a majority of applicants had at least one internet-exposed login panel at the time they applied for coverage. An insurer that has paid claims originating from a stolen password has a direct financial reason to ask, before binding a policy, whether that password alone could still get someone in.

That is the shift underwriting has gone through. A checkbox questionnaire asking whether MFA is “deployed” could be satisfied by a partial rollout on a handful of systems. A control-level questionnaire asking where MFA does not yet reach, and whether privileged accounts are separated from day-to-day ones, cannot be satisfied by the same partial answer.

What the Questionnaire Actually Tests

Three categories of question recur across carriers, and each one maps onto a specific IAM domain rather than a generic security posture.

MFA coverage, specifically where it does not reach. Carriers now ask about MFA on every remote access path, not just the primary login: VPN, remote desktop, cloud application sign-in, and administrative consoles including the backup and recovery console, which brokers describe as the single most commonly missed scope and the exact account ransomware operators look for once they are inside. A growing number of carriers go further and specify phishing-resistant MFA, meaning hardware security keys or platform-bound passkeys, rather than accepting SMS codes or push notifications as sufficient, because both of the latter have well-documented bypass techniques in active use. This is workforce authentication maturity, assessed at the level of individual access paths and authentication methods rather than as a single yes-or-no deployment question.

Privileged access separation. Underwriters increasingly ask whether administrative accounts are distinct credentials from everyday accounts, whether privileged sessions are monitored, and whether standing administrative access exists at all. This is PAM maturity by another name, and it is the factor Delinea's survey found insurers weight most heavily.

Deprovisioning speed. A newer line of questioning asks how quickly access is revoked after someone leaves or changes roles, because an orphaned account that keeps working for weeks after departure is functionally a standing vulnerability the insurer is pricing blind. This sits squarely in identity governance, specifically the lifecycle management capability that handles joiners, movers, and leavers.

Investigability after the fact. A fourth, less publicized line of questioning has grown alongside the first three: whether the organization can actually produce access logs and authentication history when a claim requires a forensic investigation. A carrier that cannot determine how an attacker got in, or whether they are still in, cannot close a claim efficiently. This falls under identity security and posture, specifically whether identity telemetry is retained and queryable rather than generated and discarded. An organization with strong MFA and PAM but no usable audit trail still presents real claims friction.

Answering From Evidence, Not Intent

The gap between what an organization believes about its own controls and what an underwriting audit or, worse, a post-breach forensic review finds is the same gap a structured maturity assessment is built to close. “We have MFA” is not an answer an underwriter can act on; “MFA covers every remote access path except the backup console, which is scheduled for Q1” is. The difference is evidence: knowing specifically where coverage stops, not just that a project was completed somewhere.

This is also where a documented, dated assessment earns its value beyond the renewal conversation itself. A maturity score with a domain breakdown gives a risk team something concrete to bring to the underwriter: not a claim of general security diligence, but a dated record of exactly which controls are in place, which are partial, and what the remediation timeline looks like for the rest. Carriers that run their own attack-surface scans during underwriting, which brokers report is now common practice, will find what is actually internet-facing regardless of what the questionnaire says. Walking in with your own accurate picture first changes that conversation from a discovery to a confirmation.

The Rescission Risk of Overstating Controls

There is a sharper reason to answer the questionnaire from evidence rather than intent, beyond getting better terms. Cyber policies are typically underwritten on the representations in the application, and a material misstatement about controls that did not actually exist at the time of a loss is the kind of fact pattern insurers and their counsel look for when a claim is large and a rescission or coverage denial would materially reduce the payout. An organization that answered “yes, MFA is deployed” because a project was nominally complete, when a forensic review later shows the breach entered through an access path MFA never reached, has created exactly that exposure. None of this is legal advice, and the specifics depend on the policy language and jurisdiction, but the structural point holds regardless: the safest answer to an underwriting question is the accurate one, even when the accurate one is less flattering.

This is also why smaller organizations without a dedicated risk or compliance function tend to carry the most exposure here, not because their controls are necessarily worse, but because nobody on staff is positioned to verify what the questionnaire actually asks before someone signs it. A structured, repeatable assessment answers that verification need regardless of organization size, which matters more for a lean team than for one with a full GRC function already doing this work informally.

What This Does Not Mean

A strong maturity score is not a guarantee of better terms, and no legitimate assessment instrument should claim to predict a specific premium outcome. Underwriting also weighs industry, claims history, revenue, and factors well outside identity. What a maturity assessment changes is the quality of the conversation: whether the organization is negotiating from a documented position or from the same uncertainty the underwriter is trying to price around. For a sense of how identity risk translates into measurable financial exposure more broadly, AXIS publishes a breach cost calculator that estimates exposure from organization size and industry, separate from and simpler than what any specific insurer's underwriting model will produce.

The underlying assessment does not need to be insurance-specific to be useful here. The same 37-question structure that produces a defensible maturity score for a board also produces the evidence trail an underwriting conversation rewards, because both are asking the same underlying question: does this control actually work, or does it just exist on paper. The full domain structure is covered in The IAM Maturity Model, Explained.

Common Questions

Will a maturity assessment lower my premium? No instrument can promise that, and any that does should be treated skeptically. What it can do is give you an accurate, evidenced answer to the questions underwriters are already asking, which is the difference between negotiating and guessing.

Do insurers require a specific framework or certification? No major carrier mandates a particular maturity model. What they want is evidence that specific controls exist and operate, which is exactly what a control-level assessment, rather than a program-level rubric, is built to produce.

Does this only matter at renewal? No. Deprovisioning gaps, MFA coverage holes, and unmanaged privileged access are the same things that cause breaches between renewals, not just the things an underwriter happens to ask about once a year. Treating the underwriting questionnaire as the only reason to know these answers gets the incentive backward: the controls matter because they prevent incidents, and the fact that insurers now ask about them in detail is a consequence of that, not the reason to have them.