Cyber insurance has changed dramatically over the past several years. Cyber insurance remains an important protection after a cyberattack, but underwriting has evolved into a more sophisticated assessment of an organization’s overall security posture and potential cyber loss exposure. As claims continue to rise in frequency and cost, insurers are looking more closely at the controls that influence both the likelihood and severity of a breach.
Among the factors receiving increased attention is identity.
According to Verizon’s 2026 Data Breach Investigations Report, credential abuse remains the most common breach vector. Rather than relying solely on malware or software vulnerabilities, attackers increasingly gain access using legitimate usernames and passwords that have been stolen, reused, or exposed through previous breaches. Once authenticated, they often operate undetected, making these attacks both difficult to stop and expensive to recover from.
This persistent risk has implications beyond cybersecurity. The same identity weaknesses that increase the likelihood of a successful attack are also becoming indicators of cyber risk during insurance underwriting.
The insurance industry’s perspective on this trend was explored in the Digital Insurance article, How Credential Attacks Are Reshaping Cyber Insurance Claims.
Credential-based attacks remain one of the most effective techniques available to threat actors because they exploit a persistent human behavior: password reuse.
Numerous studies estimate that 80 to 85 percent of users reuse passwords across multiple personal and professional accounts. When credentials from one account are exposed through a third-party breach, the exposed credentials quickly become available on criminal marketplaces and underground forums. Attackers can then attempt those same credentials across other services through credential stuffing and password spraying attacks, often with surprising success.
Microsoft’s 2025 identity threat research illustrates just how heavily attackers rely on these techniques. The company reported that 97 percent of the identity attacks it observed involved password spraying, highlighting how frequently compromised or commonly used passwords serve as the starting point for larger attacks.
Infostealer malware is an important source of stolen credentials because it infects user endpoints, including corporate devices. Instead of stealing passwords from a single application, infostealers collect credentials stored in browsers, desktop applications, password managers, and authentication cookies. In many cases, they also gather personally identifiable information (PII) and other data that can help attackers impersonate legitimate users or bypass additional security controls.
At the same time, phishing campaigns continue to evolve. Generative AI allows threat actors to create convincing emails, messages, and fraudulent websites in seconds, enabling highly personalized phishing campaigns at unprecedented scale. These attacks continue to feed a steady stream of fresh credentials into underground criminal ecosystems.
The result is an environment where compromised credentials are constantly being replenished. For insurers, this creates a predictable and persistent source of cyber risk because organizations with exposed credentials are more likely to experience account takeover, ransomware, and other high-cost incidents.
Credential attacks exploit the trust that systems place in valid authentication rather than requiring attackers to exploit a software vulnerability.
When attackers successfully authenticate with legitimate credentials, security tools often see what appears to be a normal login. The username is valid. The password is correct. Authentication succeeds.
Instead of immediately deploying ransomware or exfiltrating data, attackers frequently spend time learning about the environment they’ve entered. Longer dwell times often translate into more extensive recovery efforts, larger financial losses, and ultimately higher-value insurance claims. They identify valuable systems, map privileged accounts, move laterally through the network, and gradually expand their access. By the time suspicious activity is detected, significant damage may already have occurred.
Organizations may face prolonged operational disruptions, incident response costs, regulatory reporting obligations, legal expenses, and reputational damage. These business impacts also influence claim severity, making credential-based attacks particularly costly for both insured organizations and cyber insurers.
For insurers, these characteristics create a challenging risk profile.
Credential-based incidents often require lengthy forensic investigations to determine how long attackers maintained access, what systems were affected, and what information was exposed. The stealthy nature of these attacks can increase both recovery costs and overall claim severity, making them more expensive than incidents that are identified and contained quickly.
As cyber insurers refine how they evaluate cyber insurance risk, identity-related controls are becoming an increasingly important part of underwriting conversations.
Historically, insurers focused heavily on perimeter defenses, endpoint protection, backup strategies, and vulnerability management. Those controls remain important, but they don’t fully address today’s most common methods of initial access. As a result, underwriting has gradually shifted from evaluating whether security controls exist to evaluating whether those controls meaningfully reduce the likelihood and impact of modern attacks.
For many organizations, multi-factor authentication has become a baseline expectation, particularly for privileged accounts and remote access. Privileged access management, least-privilege policies, and formal identity governance practices also demonstrate that organizations have taken meaningful steps to limit the impact of compromised accounts.
These controls help insurers estimate more than whether an attack might occur. They provide insight into how resilient an organization may be when responding to a credential-based compromise—an increasingly important consideration as carriers refine pricing, coverage, and underwriting decisions. They also help assess how effectively an organization can contain an incident if attackers successfully obtain valid credentials.
However, strong identity controls alone do not eliminate credential risk.
Even a strong password can become compromised through a third-party breach or malware infection months later. Multi-factor authentication adds another step to the login flow, but does not resolve the risk of credential exposure.
As a result, organizations are beginning to recognize that identity security cannot rely solely on controls implemented when passwords are created or accounts are provisioned. Reducing credential risk increasingly requires ongoing visibility into whether credentials have become exposed over time.
For years, organizations have treated password security as a point-in-time event. A user creates a password, the system verifies that it meets complexity requirements, and the account is considered secure until the password is changed again.
That approach made sense when password policies focused primarily on length, complexity, and expiration. Today, however, it leaves an important gap.
A password can be strong, unique, and fully compliant with organizational policy when it’s created, yet become compromised months later after it passes that point-in-time check. A third-party service where the password was reused may suffer a breach. An employee’s personal device may become infected with infostealer malware. A phishing attack may capture credentials that are later sold through criminal marketplaces.
These events may occur after a password has passed a creation-time check. They show why point-in-time password requirements alone cannot address every form of later credential exposure.
A strong password isn’t necessarily a safe password if attackers already know what it is.
Password policies remain an essential foundation, but they cannot identify credentials that become compromised after they’ve been created.
That’s why many organizations are shifting toward continuous approaches that identify exposed credentials throughout their lifecycle rather than relying solely on password creation policies or periodic password resets.
Rather than treating password security as a one-time event, continuous monitoring helps organizations identify when credentials become exposed so they can respond before attackers exploit them. From a cyber insurance perspective, reducing the time between credential exposure and remediation can also help reduce the likelihood that a compromised credential develops into a costly claim.
Beyond reducing security risk, this ongoing visibility helps demonstrate that credential exposure is actively managed rather than treated as a one-time compliance exercise.
Cyber insurance has always reflected the realities of the threat landscape.
As ransomware became more prevalent, insurers adjusted underwriting requirements. As organizations adopted cloud services, carriers expanded their evaluation of cloud security controls. Today, the widespread use of compromised credentials is influencing how cyber insurance risk is assessed.
This shift also reflects a broader change in cyber insurance. Rather than relying exclusively on questionnaires or policy checklists, insurers increasingly want confidence that organizations understand where their greatest risks exist and have processes in place to continuously reduce them. Identity security has become one of the clearest indicators of that maturity.
That doesn’t mean organizations should view identity security simply as another requirement to satisfy during an insurance renewal.
Instead, it should reinforce a broader reality: the controls that reduce credential-related risk also strengthen an organization’s overall cybersecurity posture.
Reducing password reuse decreases the likelihood that one breached account can compromise another. Broadly deploying multi-factor authentication limits opportunities for attackers to abuse stolen credentials. Reviewing privileged access reduces the potential impact if an account is compromised. Continuously identifying exposed credentials helps organizations respond before attackers have an opportunity to use them.
None of these practices exist simply to satisfy insurers. They represent sound security practices that reduce credential risk while aligning with how cyber insurers increasingly evaluate organizational resilience.
Organizations looking to strengthen their cyber insurance posture may find that the most effective strategy is also one of the most practical: reducing the likelihood that attackers can authenticate with valid credentials in the first place.
Organizations looking to strengthen their cyber insurance posture should also consider the security practices insurers commonly evaluate during underwriting, including those discussed in Secure Better Rates for Cyber Liability Insurance.
Credential attacks have become one of the most predictable methods of initial access because they take advantage of something every organization relies on: trusted identities.
Rather than forcing their way into networks, attackers increasingly sign in using credentials that have already been compromised through password reuse, phishing campaigns, infostealer malware, or third-party breaches. Once inside, they often appear to be legitimate users, making detection more difficult and increasing the potential business impact.
Cyber insurers have taken notice because identity-related incidents increasingly drive both breach frequency and claim severity. Organizations that reduce credential exposure are strengthening more than their security posture—they’re demonstrating the kind of operational resilience insurers increasingly value.
As underwriting continues to evolve, identity-related controls are becoming an increasingly important indicator of organizational cyber insurance risk. While no single control can eliminate credential-based attacks, organizations that combine strong authentication practices with ongoing visibility into credential exposure are better positioned to reduce both the likelihood and impact of these incidents.
Ultimately, the conversation isn’t just about cyber insurance.
It’s about recognizing that identity has become one of the most important factors influencing today’s threat landscape. The organizations that continuously reduce credential exposure won’t simply be better prepared for underwriting conversations—they’ll be better positioned to prevent the kinds of attacks that lead to those conversations in the first place.