Not every security control is equal. Some are what insurers see missing in the claims they pay out. Some lower your odds of a breach but don't move your premium. Some are only there because an auditor asks for them.
Work through the list below, mark what you already have, and I'll flag the gaps and anything I'd swap out.
These are the controls whose absence shows up again and again in cyber insurance claims.
Insurers can see which missing controls lead to paid claims. These are the controls underwriters ask about, and they most directly reduce losses. Start here.
Cyber insurance covers the financial fallout of a cyber incident, including incident response costs, business interruption, ransom negotiation, legal fees and liability.
My pickCoalitionCoalition pairs cyber insurance with active risk monitoring and alerts for its policyholders.
Carriers differ in how much security help they include. Some bundle active scanning and alerts, while others are pure risk transfer. Compare the coverage limits, the sub-limits for ransomware and social engineering, and the incident response panel you would be required to use.
Without a policy, the rest of this section still reduces risk, but nothing offsets the loss when something gets through. Insurers also give you a clear view of which controls they price.
Multi-factor authentication requires a second factor, such as an authenticator app, a push approval or a hardware key, in addition to a password for email, remote access and admin accounts.
My pickCisco DuoCisco Duo is easy to roll out, covers a broad range of apps and VPNs, and is free for small teams.
SMS codes are better than nothing, but they can be intercepted. App-based push with number matching is stronger, and phishing-resistant FIDO2 security keys and passkeys are the strongest. Compare how well each option covers legacy apps and VPNs, not just SaaS.
Missing MFA on email and remote access is among the most cited causes of cyber claims, and many carriers will not write a policy without it.
EDR is the sensor, and MDR is the team of people who respond when it fires. XDR extends detection to identity, email and cloud. Compare detection quality in independent tests, whether the MDR team can isolate hosts on your behalf, and how quickly they respond at 3am.
Insurers consistently ask whether you run EDR and whether someone monitors it. Ransomware is far less likely to succeed when endpoints are watched and can be isolated quickly.
Platforms range from annual video courses to continuous, adaptive simulations. Compare how realistic the simulations are, whether reporting is rewarded, and whether reported emails feed back into your security team's workflow.
Underwriters routinely ask about training because people are the target of most initial access. Regular simulations measurably raise reporting rates and lower click rates.
Integrated cloud email security connects to Microsoft 365 or Google Workspace by API. It catches the phishing, business email compromise and malicious attachments that the native filters miss.
My pickAbnormal SecurityAbnormal uses behavioral AI to secure email, and it connects to Microsoft 365 and Google Workspace by API.
Secure email gateways reroute mail through your MX records, while ICES tools connect by API and analyze behavior and relationships after delivery. Compare how well each detects text-only business email compromise, how long it takes to deploy, and how much tuning it needs.
Email is the most common way attackers get in, and business email compromise is one of the costliest claim types. Behavioral detection catches the attacks that carry no link or attachment.
External attack surface management and external vulnerability scanning find what attackers can see from the internet. Third-party risk management applies the same view to your vendors.
My pickRoot EvidenceVulnerability management with external attack surface discovery (Root Evidence).
Vulnerability scanners test the assets you already know about, while EASM discovers the ones you don't. Security ratings products score you and your vendors from the outside. Compare discovery accuracy, false-positive rates, and whether the findings map to what insurers scan for.
Insurers scan applicants from the outside before they quote. Exposed remote access, unpatched edge devices and forgotten servers are a leading cause of claims, and the same scans show you which vendors put you at risk.
Deception technology plants decoy devices, credentials and files, such as honeypots and canary tokens, that nobody legitimate should ever touch. Any interaction with them is a high-confidence alert.
My pickThinkst CanaryThinkst Canary offers hardware, virtual and cloud honeypots that take minutes to deploy and rarely raise false alarms.
Enterprise deception platforms deploy large decoy networks, while lightweight options drop a few realistic decoys and tokens in minutes. Compare how believable the decoys are and how few false positives they produce.
Attackers usually spend time exploring a network before they strike. A decoy that alerts on first touch shortens that window dramatically, with almost no alert fatigue.
Backups are regular, tested copies of your critical systems and data. At least one copy should be offline or immutable so that ransomware can't reach it.
My pickVeeamVeeam provides backup and recovery for servers, VMs, cloud workloads and Microsoft 365, with support for immutable storage.
Products differ in what they protect, such as servers, SaaS apps like Microsoft 365, and endpoints. They also differ in how fast they restore and whether their copies are immutable. Compare the restore times you have actually tested, not the advertised features.
Good backups are the difference between a ransomware incident being an inconvenience and it being a business-ending event. Insurers ask whether backups are offline, encrypted and tested.
This means having a written incident response plan, a pre-arranged incident response retainer, and a disaster recovery plan that gets critical systems back online.
My pickPalo Alto Networks Unit 42Palo Alto Networks Unit 42 offers incident response retainers that include proactive services.
IR retainers differ in their guaranteed response times and in whether unused hours can go toward tabletop exercises. DR tools differ in their recovery point and recovery time objectives. Check whether your insurer requires you to use a specific IR panel.
The cost of an incident grows with every hour of confusion. Companies with a tested plan and a firm on call contain incidents faster and recover sooner.
The full-disk encryption built into Windows and macOS covers endpoints for free, and enterprise platforms add central key management for databases, file servers and cloud storage. Compare key management, recovery key escrow and audit reporting.
Lost or stolen unencrypted devices trigger breach notification costs. Encrypted data often falls under safe-harbor provisions in breach notification laws.
Some tools only produce reports, while managed services walk you from monitoring to enforcement and keep third-party senders authorized. Compare how much help you get reaching p=reject.
Enforced DMARC prevents direct spoofing of your domain to customers and staff, and major mailbox providers now require it for bulk senders.
Single sign-on puts every application behind one central identity provider, so access is granted and revoked in one place and MFA is enforced everywhere.
My pickOkta Workforce IdentityOkta Workforce Identity is an identity provider with a large integration catalog and lifecycle automation.
Identity providers differ in the size of their app catalogs, how well they automate joiners, movers and leavers, and their price per user. Compare how well each integrates with your HR system and your most important apps.
Former employees and orphaned accounts are a common way in. SSO makes offboarding instant and lets you enforce strong authentication consistently.
Identity threat detection and response monitors Active Directory, Entra ID and other identity systems for attacks such as credential theft, privilege escalation and suspicious sign-ins.
My pickCrowdStrike Falcon Identity ProtectionCrowdStrike Falcon Identity Protection adds identity threat detection to the Falcon endpoint platform.
Some ITDR tools are add-ons to an EDR platform, while others specialize in hardening and recovering Active Directory. Compare how well each covers on-premises AD versus cloud identity, and whether it can block attacks rather than just alert on them.
Once attackers have valid credentials, they look like employees. ITDR spots the misuse of identities that endpoint tools miss.
Bot management products focus on automated traffic, while fraud platforms score transactions and accounts. Compare how each handles human fraud farms, how much friction it adds for real users, and how it is priced.
Fraud losses and chargebacks hit revenue directly, and cyber insurance rarely covers them.
Traditional SOAR platforms are powerful but heavy, and newer automation tools are easier to build with. Compare the number of integrations, how easy workflows are to build and maintain, and the pricing per action.
Automation cuts the time between an alert and the response, and it lets a small team handle the volume of a large one.
A cloud access security broker gives you visibility into and control over the SaaS applications employees use, including unsanctioned shadow IT and data sharing inside approved apps.
My pickNetskopeNetskope is an SSE platform with a strong heritage in CASB and data protection.
CASB now usually comes as part of a broader security service edge platform that also includes SWG and ZTNA. Compare the app catalog, the quality of data loss prevention, and whether it works inline, by API, or both.
Sensitive data increasingly lives in SaaS apps. A CASB shows where that data goes and stops risky sharing.
UEBA usually comes as part of a SIEM or a data security platform. Compare the quality of the baselines, the alert volume, and how easily analysts can investigate a flagged user.
Insider threats and compromised accounts often look normal to rule-based tools. Behavioral baselines surface what is unusual.
Account takeover protection detects stolen employee and customer credentials and session cookies, often from breach dumps and infostealer malware, so that they can be reset before they are used.
My pickSpyCloudSpyCloud uses recaptured breach and infostealer data to prevent account takeover automatically.
Products differ in their data sources, such as dark web markets, infostealer logs and breach corpora, and in whether they remediate automatically. Compare how fresh the data is and how well it integrates with your identity provider.
Stolen credentials and session tokens let attackers skip MFA and walk straight in. Finding them early closes that door.
Cloud-based gateways protect remote users without routing their traffic back through the office. Compare TLS inspection, performance, and whether DNS filtering alone would meet your needs.
Blocking known-bad destinations stops many phishing and malware infections at the network layer.
ZTNA options range from full SSE platforms to lightweight mesh networks. Compare how well each supports your legacy apps, whether it checks device posture, and how painful the client is for users.
VPNs and exposed remote access appliances are a favorite entry point for attackers. ZTNA removes that exposed surface and limits what a stolen login can reach.
Dynamic application security testing automatically tests your running web applications and APIs for vulnerabilities such as injection, broken authentication and misconfiguration.
My pickBurp Suite (PortSwigger)Burp Suite is the standard toolkit for web security testing, and Burp Suite DAST adds automated scanning.
DAST tools differ in how well they handle modern single-page apps, APIs and authenticated areas. Compare scan accuracy, CI/CD integration, and how actionable the findings are for developers.
Your web applications are directly exposed to attackers. Finding exploitable flaws before attackers do prevents data breaches.
Cloud security posture management continuously checks your AWS, Azure and Google Cloud accounts for misconfigurations, exposed storage, excessive permissions and vulnerable workloads.
My pickWizWiz provides agentless cloud security with attack-path prioritization.
Most CSPM now comes as part of a broader CNAPP platform. Compare agentless coverage, how well risks are prioritized by real attack paths, and how noisy the results are.
Cloud misconfigurations, such as public buckets and overly broad keys, are a leading cause of data exposure.
Immutable storage uses write-once object locking so that backups and critical data cannot be encrypted, altered or deleted, even by an attacker with admin credentials.
My pickWasabiWasabi offers low-cost, S3-compatible storage with object lock and no egress fees.
Options range from object lock on cloud storage to dedicated, hardened backup appliances. Compare the lock modes available, such as governance versus compliance mode, the cost per terabyte, and the egress fees for restores.
Attackers target backups first. Immutable copies guarantee that you have something to restore.
Customers, auditors and frameworks require these controls, and their security value varies.
You'll need these to pass audits and security questionnaires. Some add real security, but many add mostly paperwork. Do them efficiently, and don't mistake them for protection.
Governance, risk and compliance platforms track your controls, collect audit evidence automatically, and manage frameworks such as SOC 2, ISO 27001, HIPAA and PCI DSS.
My pickVantaVanta automates compliance for SOC 2, ISO 27001, HIPAA and more.
Compliance automation platforms connect to your cloud and HR systems to gather evidence, while traditional GRC suites focus on enterprise risk registers. Compare the supported frameworks, the depth of the integrations, and the auditor networks.
Compliance is often the price of entry for enterprise deals. Automation saves hundreds of hours of screenshots and spreadsheets.
Written security policies cover topics such as acceptable use, access control, incident response and data retention. The procedures and acknowledgements that go with them prove that staff follow them.
My pickVantaVanta includes editable policy templates and tracks employee acceptance.
You can start from free templates, use the policy library included in a compliance platform, or use a dedicated policy management tool with versioning and attestations. Compare how easily policies stay current and how acknowledgements are tracked.
Auditors and customers require them. They help most when they describe what you actually do.
SAST tools differ in language support, false-positive rates, and how well they fit developer workflows. Many platforms bundle SAST with dependency scanning and secrets scanning.
Frameworks and customers expect it. It catches some classes of bugs early, but developers often ignore tools that are too noisy.
Patch tools differ in their third-party app coverage, whether they are managed from the cloud or on premises, and their reporting. Compare how well they handle remote devices and how quickly you can push critical patches.
Auditors require a patch policy and evidence that you follow it. Patching internet-facing systems matters most, and that part is covered under external vulnerability management.
Options range from traditional consulting firms to penetration-testing-as-a-service platforms and bug bounties. Compare the quality of the testers, whether fixes are retested, and how fast you get a report.
Customers and frameworks such as SOC 2 and PCI DSS expect an annual test. A good tester finds real issues, while a checkbox test mostly produces a PDF.
Internal vulnerability management runs authenticated scans of internal systems for missing patches and misconfigurations, and it tracks them until they are fixed.
My pickTenable NessusTenable Nessus is a widely used vulnerability scanner, and it has a free Essentials tier.
Most internal scanners come from the same vendors as the external ones. Compare agent-based versus network scanning, asset coverage, and how well findings are prioritized.
Frameworks require regular internal scans. They matter less than fixing what is exposed to the internet, which is covered under EASM and external VM.
