Cyber insurance & attestation
Your renewal hinges on controls you are not sure you have.
The carrier questionnaire asks whether you enforce phishing-resistant MFA, least-privilege admin, EDR, and tested backups. Answer wrong and the premium jumps or coverage is denied. Answer "we think so" and you are exposed the day you actually need to claim.
What this looks like in real life
A 60-person engineering firm got its cyber-insurance renewal questionnaire three weeks before the policy lapsed. The form asked, in plain yes-or-no boxes, whether every admin used phishing-resistant MFA, whether privileged access was time-bound, and whether backups had been test-restored. The IT lead had rolled out MFA "for most people" two years earlier and genuinely did not know the rest. Tick the wrong box and a future claim could be denied; answer honestly and the premium could jump or coverage vanish.
What was at risk
- A renewal answer the firm could not actually stand behind at claim time.
- Global admin accounts with standing access and no documented MFA enforcement.
- A broker waiting on answers with the policy days from lapsing.
What the engagement produced
An Identity Secure Score, every carrier control mapped to met or gap with the evidence attached, and a short remediation list that closed the three real gaps before the renewal date, so the questionnaire could be answered with proof instead of a guess.
What this actually is
This is an identity and access posture question, scored against the controls carriers actually check.
The fixed-price answer
One diagnostic resolves it
A fixed-scope diagnostic with one canonical price, so you see the number and the deliverable before the first call. Compact scopes available for smaller single-tenant environments.
The diagnostic
Identity & Insurance Evidence Pack
An Identity Secure Score, a heat-mapped risk matrix, and a board-ready remediation roadmap, mapped to the MFA mandate and insurance gates.
What you walk away with
What the evidence looks like
A representative deliverable. Yours is built on your own tenant.
Senior-delivered
The engineer who scopes it runs it, end to end.
Read-only access
We inspect posture and configuration. We do not read your content or move your data.
Fixed scope
A defined deliverable and a definition of done, agreed before we start.
Not sure this is the one?
Request a scoping session. We confirm whether this assessment fits, or point you to the one that does. The engineer who scopes it is the one on the call.
Request a scoping sessionWhat happens next
- 1Tell us the situationA few short fields: company size, environment, and what is on fire.
- 2A senior engineer repliesWithin one business day, with a first read and a call time if useful.
- 3A fixed-fee proposalNamed scope, price and definition of done. No obligation.