4 Ways to Assess Cybersecurity Practices When Recommending Cyber Liability Coverage

When we assess a company's cybersecurity practices and policies, we typically compare against an industry framework such as CIS Controls. Then, we outline any flagged gaps between their current protections and the industry best practices. Our security assessment report lists all found vulnerabilities with a score for risk to business as well as effort required to remediate. If several high-risk items need to be addressed, that is a clear sign that more comprehensive protection and policies are needed.

When assessing a company's cybersecurity practices, we start by evaluating three core areas: governance, technical controls, and incident response readiness. We evaluate whether the business has a defined security policy, active monitoring, and regular testing of its defences. Understanding how they manage access, data, and third-party connections gives a clear picture of their true risk exposure.

A major red flag is when an organisation relies on outdated or inconsistent security measures; for example, having endpoint protection but no centralised visibility or response capability. This often indicates that while some controls are in place, they're not integrated into a cohesive security strategy. In these cases, even minor incidents can escalate quickly, underscoring the need for broader coverage.

Our advice is to treat cyber insurance as a complement to strong operational security, not a replacement for it. The more mature and transparent your cybersecurity practices are, the easier it is to secure appropriate, cost-effective protection that genuinely reflects your risk profile.

When assessing a company's cybersecurity practices to recommend appropriate cyber liability coverage, we focus on three critical areas:

First, we examine identity management practices. This includes verifying proper authentication with MFA implementation, preferably using passkeys, and ensuring robust privileged access controls are in place.

Second, we evaluate endpoint security. We look for comprehensive endpoint detection tools deployed across all devices, established SLAs for patching, USB controls, and proper mobile device management solutions.

Third, we assess monitoring capabilities. This means confirming advanced email security that goes beyond Microsoft or Google defaults, checking for 24/7 SOC availability, and reviewing log retention policies.

Beyond these primary focus areas, we also consider vendor risk management procedures, regular assessments, and the existence of clear internal governance and compliance playbooks.

As for red flags that signal a need for more comprehensive protection, two critical concerns stand out: lack of visibility over devices and applications, and excessive reliance on default Microsoft 365 or Google security settings without additional protective measures. These fundamental gaps typically indicate a business requires significantly enhanced cybersecurity coverage.

When assessing a company's cybersecurity practices for liability coverage recommendations, I follow a structured evaluation process. I conduct a cybersecurity maturity assessment focusing on five critical areas: access controls and authentication, data protection and encryption, incident response capabilities, employee training programs, and vendor risk management. This includes reviewing existing security policies, IT infrastructure documentation, and previous security audits or penetration test results.

I also analyse claims history and near-miss incidents, which often reveal vulnerabilities that formal policies don't address. Conversations with IT leadership about their security roadmap provide insight into whether their approach is reactive or proactive.

The most significant red flag I look for is the absence of Multi-Factor Authentication (MFA) on critical systems. When a business hasn't implemented MFA. Particularly for email, financial systems, or remote access, it signals they need more comprehensive protection. This vulnerability contributes to a substantial portion of successful cyberattacks, including business email compromise and ransomware incidents. It indicates not just a technical gap but often reflects a broader lack of security awareness throughout the organisation.

Upon identifying this issue, I typically recommend more comprehensive coverage with lower sub-limits on social engineering, while advising the client on risk mitigation steps that can improve their insurability and potentially reduce premiums over time.