New research from Delinea indicates that identity security controls have become central to how cyber insurers decide whether to extend coverage, at what limits, and at what price. The study, based on a survey of more than 750 security leaders in the United States and the United Kingdom, found that 97 percent of respondents saw identity-related controls influence their cyber insurance premiums or coverage terms in some way. Insurers are no longer treating identity as one control area among many; it is becoming a primary lens for assessing risk and insurability.
Among specific identity controls, privileged access management was cited as the top differentiator for underwriters, named by 41 percent of respondents as the control that most affected how insurers viewed their insurability. Identity governance and administration followed at 38 percent, and third-party and vendor access controls at 32 percent. The report also notes that nearly half of organizations that filed a claim said the incident that triggered it was either identity-related or caused by a compromise of a privileged account, reinforcing why underwriters are focusing so heavily on this layer.
The study paints a picture of a market where claims and premiums continue to climb. Seventy-two percent of organizations reported filing at least one cyber insurance claim in the past year, a ten-point increase over 2024, while 70 percent said their cyber insurance costs also rose. Nearly all respondents underwent some kind of security assessment as part of their insurance process, and just over half reported that insurers required them to adopt a preferred security solution or appliance as a condition of coverage. Help Net Security’s summary of the research stresses that insurers now expect evidence of mature practices in least-privilege enforcement, privileged session monitoring, and consistent use of multifactor authentication across sensitive systems and remote access.
The report also explores how AI affects both risk and pricing. Eighty-six percent of respondents said their insurers offered premium reductions or credits when they adopted AI-assisted security, such as AI-powered threat detection, behavioral analytics, or adaptive authentication. AI-driven detection was the most commonly cited premium influencer at 63 percent, with behavioral analytics and auditing close behind at 59 percent. At the same time, 42 percent said their cyber insurance policies now include exclusions related to AI misuse or liability, particularly in cases where model errors, issues in vendor-supplied AI services, or adversarial inputs contribute to an incident.
One of the more concerning findings is the gap between what CISOs assume their policy covers and what it actually covers. Only about a third of respondents said their policies cover lost revenue, and many reported limited support for incident response services, legal costs, or ransomware-related expenses. That mismatch means identity programs cannot be treated as simply a way to secure coverage at any cost; they also need to be aligned with a clear understanding of what is being insured and where uninsured exposure remains.
For security and risk leaders, the takeaway is that cyber insurance renewals now function as de facto audits of identity posture. Documented identity governance, strong privileged access management, consistent MFA, and well-controlled third-party access are becoming baseline requirements. Organizations that can demonstrate mature, identity-first security are more likely to secure coverage on acceptable terms, while those with fragmented access practices may face higher premiums, restrictive conditions, or even refusal of coverage.
Sources: Delinea, Help Net Security
—
By Cass Kennedy
