Intel · 2026-05-04

Insurance Underwriting Meets Identity Assurance: How Cyber Insurers Are Pricing Authentication Risk

By J. W. Bouckaert

The underwriter is now an identity architect

For most of the last decade, cyber insurance underwriting treated authentication as a binary checkbox. Either the applicant had multi-factor authentication enabled across privileged accounts or they did not. Carriers asked one or two questions on the application, scored them on a coarse rubric, and moved on. Premiums were dominated by industry vertical, gross revenue, and prior loss history.

That model has collapsed. After three consecutive years where push-bombing, SIM swap, OAuth consent phishing, and adversary-in-the-middle (AiTM) toolkits drove a measurable share of ransomware and business email compromise losses, treaty reinsurers have pushed primary carriers to underwrite authentication at the stack level rather than the policy level. The question is no longer "do you have MFA." It is which factors, on which devices, against which threats, with what telemetry, and with what cryptographic posture.

In 2026, the authentication architecture you ship is an actuarial input. This article maps the controls that underwriters are now scoring, explains how those scores translate into premium and limit decisions, and gives CISOs the structure of a renewal-ready business case.

Authentication in the underwriting stack

Three forces converged.

First, claims data. Coalition's 2024 Cyber Claims Report found that compromised credentials were a contributing factor in a majority of incidents leading to a paid claim. The follow-on 2025 mid-year update made the point more sharply: incidents involving SMS-based MFA or push-only MFA had materially higher severity than those where the attacker had to defeat phishing-resistant authenticators.

Second, regulatory alignment. The U.S. CISA Cross-Sector Cybersecurity Performance Goals explicitly call out phishing-resistant MFA as a baseline control, and CISA's joint guidance on implementing phishing-resistant MFA draws a line between TOTP/SMS and FIDO2/WebAuthn. The EU's NIS2 transposition has produced similar language. Underwriters now have regulatory cover to ask for evidence rather than attestation.

Second-and-a-half, AiTM commoditization. Toolkits such as Evilginx and Tycoon have made session-hijacking phishing kits available to attackers without TLS expertise. A defender whose MFA stack still relies on shared-secret OTPs is, from an actuarial perspective, exposed to a fundamentally different loss distribution than one running attested passkeys.

Third, capacity. Reinsurance capacity for cyber tightened sharply in 2023 and never fully loosened. When capacity is scarce, carriers ration it via more granular underwriting. Identity is the single richest signal available because it correlates with both ransomware frequency and BEC severity simultaneously.

The five dimensions underwriters score

The 2026 underwriting questionnaire—across the carriers we have seen submissions from—converges on five identity-stack dimensions. Each is scored independently and then composed into an authentication risk factor that adjusts the base premium.

The percentages are directional, drawn from our reading of submissions and broker-shared rate tables across mid-market and upper mid-market accounts in North America and EMEA. Treaty conditions vary; specific numbers should be confirmed with your broker. The point is the structure: each dimension is now a separate dial, and the dials compound.

Phishing-resistant MFA coverage

The first question is no longer "do you have MFA." It is "what percentage of your identities authenticate with a phishing-resistant factor, and what percentage of your privileged identities do." Underwriters increasingly want both numbers, separated by population, with evidence drawn from the IdP itself rather than a self-reported survey.

A workforce that runs platform passkeys (Touch ID, Windows Hello with TPM attestation) for 95% of staff and FIDO2 security keys for break-glass admins prices very differently from one that runs Authenticator app push for everyone and SMS fallback for the long tail. The gap between those two postures, on a $5M limit at a mid-market technology company, is in the range of a low-to-mid five-figure annual premium swing before any other dimension is considered.

Carrier signal adoption

For any workflow that still involves a phone number—consumer onboarding, account recovery, high-value step-up—underwriters now ask whether the applicant ingests carrier identity signals (SIM swap, number recycle, port-out, device change) before trusting the channel. The GSMA Open Gateway and CAMARA APIs have given carriers a standard surface, and several primary insurers now treat the absence of these signals on consumer-facing flows as a material control gap.

The shift is most visible in fintech, crypto, and payroll, where account takeover losses have driven loss ratios that no longer support coverage at the old terms. We have seen renewal questionnaires that ask explicitly about Number Verify and SIM Swap API integration with the IdP and the fraud platform.

Session binding & token hygiene

Bearer tokens are stealable artifacts. A stolen access token, lifted from a malicious browser extension or an exfiltrated session cookie, is indistinguishable from the legitimate user without sender-constraint. The 2023 publication of RFC 9449 (DPoP) gave the industry a standard way to bind tokens to a client-held key. Underwriters are starting to ask about it by name—particularly for SaaS providers where a customer's stolen token can be used to exfiltrate customer data.

We covered the mechanics, the rollout strategy, and the shadow-telemetry approach that lets a team de-risk the change in DPoP Token Binding: Beyond Bearer Tokens in 2026.

Continuous and shared signals

A revoked session at one IdP needs to propagate to every relying party. The OpenID Foundation's Shared Signals Framework and the Continuous Access Evaluation Profile (CAEP) standardize that propagation. Underwriters score CAEP consumption because it directly reduces the dwell time of a stolen session—and dwell time is the single largest determinant of a BEC loss size.

For the implementation pattern, see SSE and CAEP: Closing the Cross-IdP Revocation Latency Gap.

Cryptographic posture

This is the newest dial and the one moving fastest. With NIST's finalization of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in 2024, "harvest now, decrypt later" stopped being a theoretical underwriting concern. Carriers writing long-tail liability—particularly on multi-year credentialing, identity attestation, and audit-log signing—increasingly want to see hybrid signatures and a documented PQC migration plan.

The dial is small today (low single-digit premium impact) and large in three years (we expect double-digit). Carriers have signaled this trajectory directly to brokers; pretending it isn't coming is a poor strategy at renewal.

A worked example

Consider a mid-market SaaS company, $80M ARR, applying for $10M of cyber liability with a $50,000 retention. The base technical premium quoted by the lead carrier is $185,000.

A roughly 30% swing on a single line of coverage. Compounded across cyber, technology E&O, and crime, the multi-line saving frequently exceeds the annual cost of the identity program itself. That is the math a CISO needs to put in front of the CFO.

The reverse case is symmetric. A peer at the same revenue band running Authenticator push with SMS fallback, no carrier signals, bearer tokens with 24-hour lifetimes, no SSE/CAEP, and no PQC plan is increasingly being declined by tier-one markets and pushed into the surplus market at materially higher rates and tighter sublimits—particularly on social engineering, funds transfer fraud, and ransomware.

Evidence in the submission packet

Underwriters do not take the applicant's word for any of this. The 2026 submission packet that converts well typically contains, at minimum:

1. An IdP coverage report showing % of identities by primary authenticator, broken out for privileged populations, exported from the IdP itself.
2. A list of consumer-facing flows that touch a phone number, with the carrier-signal vendor and signal types ingested per flow.
3. Token policy documentation: access-token TTL, refresh-token rotation policy, sender-constraint mechanism, revocation propagation latency target with measured p95.
4. SSE/CAEP consumer configuration evidence: subscribed event types, downstream actions wired to each, observed propagation latency.
5. A short PQC posture statement: which assertions are hybrid-signed today, which are scheduled, and the named NIST scheme in use.

If you can produce this packet in under a week, your renewal will go very differently than if you cannot. Many of our customers reuse the same artifacts to satisfy SOC 2 Type II observation evidence—the controls overlap almost completely. See SOC 2 Type II for Identity APIs for the specific control mapping.

The CISO business case

The traditional business case for an identity modernization program leaned on breach-cost avoidance—a number that the CFO has heard before and discounts heavily because it is probabilistic and unverifiable from the inside. Insurance economics give the CISO a second, harder number: the premium delta at the next renewal, quoted by the broker, denominated in actual dollars on an actual invoice.

A defensible 2026 business case has three sections.

The first is a measured baseline of the five dimensions above, with evidence rather than claims. The IdP report, the token policy doc, the carrier signal inventory, the CAEP configuration, the PQC statement. This is the artifact the underwriter wants and the artifact that anchors every subsequent argument.

The second is the projected posture after the program ships, with the same evidence shape, and a broker-validated estimate of the premium and limit consequence. Brokers will give this estimate in writing if you ask. They want to place the business; underwriters want to write it; the conversation is well-rehearsed.

The third is the auxiliary saves: SOC 2 evidence reuse, regulatory alignment (NIS2, DORA, the U.S. SEC cyber disclosure rule, FedRAMP for federal-adjacent business), and the operational reduction in account-takeover and helpdesk-reset volume. These are real numbers and most CISOs already have them.

Direction of the identity stack

The directional bet, looking past the 2026 renewal cycle, is straightforward. Insurers will continue to disaggregate the authentication question. They will add dials for agent identity (delegated AI agents acting on a user's behalf), for spatial attestation on high-value transactions, and for cryptographic agility in response to NIST advisories. Each new dial will start small and grow.

Treaty reinsurers will continue to push these dials down into primary carrier programs. Brokers will continue to translate them into dollars. CISOs who can produce the evidence packet on demand will continue to win the cheapest cover.

The teams that will struggle are the ones who treated identity as an IT cost center rather than a risk-priced control surface. The 2026 underwriting questionnaire is the moment that distinction stops being academic.

Further reading

• Coalition 2024 Cyber Claims Report—Empirical loss data tying credential compromise to claim severity.
• CISA Implementing Phishing-Resistant MFA Fact Sheet—The reference document underwriters cite when scoring MFA quality.
• GSMA Open Gateway—The carrier API standard underpinning Number Verify and SIM Swap.
• NIST FIPS 204 (ML-DSA)—Module-Lattice Digital Signature Algorithm, the canonical PQC signature scheme for identity assertions.
• DPoP Token Binding: Beyond Bearer Tokens in 2026—Implementation pattern for sender-constrained tokens.
• SSE and CAEP: Closing the Cross-IdP Revocation Latency Gap—How to consume continuous access evaluation events.
• SOC 2 Type II for Identity APIs—Evidence-pack overlap with SOC 2 controls.
• Hybrid Signatures in Practice—Dual-signing identity assertions with classical and PQC schemes.

Start free · Test the API