{"id":43820,"date":"2026-02-21T02:59:22","date_gmt":"2026-02-20T18:59:22","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/21\/identity-cyber-scores-the-new-metric-shaping-cyber-insurance-in-2026\/"},"modified":"2026-02-21T02:59:22","modified_gmt":"2026-02-20T18:59:22","slug":"identity-cyber-scores-the-new-metric-shaping-cyber-insurance-in-2026","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/21\/identity-cyber-scores-the-new-metric-shaping-cyber-insurance-in-2026\/","title":{"rendered":"Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026"},"content":{"rendered":"<div style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij2H1-xKGMb4Q70WJNrlk_Mgup1cfHNGRRmnZxhOaJLcfWBq_audXpVc5TAUsyT9MRS5hST-fI7ZaH59FVMzAzYubjo7YdUoRcmtEs8v3ck9J8jhJdnEq9mtU4FqTYA-ikCBGQ4edCU47t9pN-ljEQO00-e1ZNMrxQYuyev9uLfv9VQU_KOhJQUFSa6YWF\/s1600\/OUT.jpg\" style=\"clear: left; display: block; float: left; padding: 1em 0px; text-align: center;\"><img decoding=\"async\" border=\"0\" data-original-height=\"470\" data-original-width=\"900\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij2H1-xKGMb4Q70WJNrlk_Mgup1cfHNGRRmnZxhOaJLcfWBq_audXpVc5TAUsyT9MRS5hST-fI7ZaH59FVMzAzYubjo7YdUoRcmtEs8v3ck9J8jhJdnEq9mtU4FqTYA-ikCBGQ4edCU47t9pN-ljEQO00-e1ZNMrxQYuyev9uLfv9VQU_KOhJQUFSa6YWF\/s1600\/OUT.jpg\" alt=\"Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026\" \/><\/a><\/div>\n<p>With <a href=\"https:\/\/www.ibm.com\/thought-leadership\/institute-business-value\/en-us\/report\/2025-threat-intelligence-index\" rel=\"noopener\" target=\"_blank\">one in three cyber-attacks<\/a> now involving compromised employee accounts, insurers and regulators are placing far greater emphasis on identity posture when assessing cyber risk.&nbsp;<\/p>\n<p>For many organizations, however, these assessments remain largely opaque. Elements such as password hygiene, privileged access management, and the extent of multi-factor authentication (MFA) coverage are increasingly influential in how cyber risk and <a href=\"https:\/\/specopssoft.com\/blog\/why-you-need-cyber-insurance\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">insurance costs<\/a> are evaluated.<\/p>\n<p>Understanding the identity-centric factors behind these assessments is critical for organizations seeking to demonstrate lower risk exposure and secure more favorable insurance terms.<\/p>\n<h2>Why identity posture now drives underwriting<\/h2>\n<p>With the <a href=\"https:\/\/www.ibm.com\/reports\/data-breach\" rel=\"noopener\" target=\"_blank\">global average cost<\/a> of a data breach reaching $4.4 million in 2025, more organizations are turning to cyber insurance to manage financial exposure. In the UK, coverage has increased from <a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2023\/cyber-security-breaches-survey-2023\" rel=\"noopener\" target=\"_blank\">37%<\/a> in 2023 to <a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2025\/cyber-security-breaches-survey-2025\" rel=\"noopener\" target=\"_blank\">45%<\/a> in 2025, but rising claims volumes are prompting insurers to tighten underwriting requirements.&nbsp;<\/p>\n<p>Credential compromise remains one of the most reliable ways for attackers to gain access, <a href=\"https:\/\/specopssoft.com\/blog\/active-directory-privilege-escalation\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">escalate privileges<\/a>, and persist within an environment. For insurers, strong <a href=\"https:\/\/specopssoft.com\/blog\/identity-verification-best-practices\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">identity controls<\/a> reduce the likelihood that a single compromised account can lead to widespread disruption or data loss, supporting more sustainable underwriting decisions.<\/p>\n<h2>What insurers want to see in identity security<\/h2>\n<\/p>\n<h3>Password hygiene and credential exposure<\/h3>\n<p> <a name=\"more\"><\/a> <\/p>\n<p>Despite the growing use of multi-factor authentication and <a href=\"https:\/\/specopssoft.com\/blog\/considerations-when-going-passwordless\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">passwordless initiatives<\/a>, passwords still play a key role in authentication. Organizations should pay particular attention to the behaviors and issues that increase the risk of credential theft and abuse, including:&nbsp;<\/p>\n<ul>\n<li><strong>Password reuse across identities<\/strong>, particularly among administrative or <a href=\"https:\/\/specopssoft.com\/blog\/service-account-security-best-practices\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">service accounts<\/a>, increases the likelihood that one stolen credential leads to broader access.<\/li>\n<li><strong>Legacy authentication protocols<\/strong> are still common in networks and frequently abused to harvest credentials. NTLM persists in many environments despite being functionally replaced by <a href=\"https:\/\/specopssoft.com\/blog\/kerberoasting-attacks-in-active-directory\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Kerberos<\/a> in Windows 2000.<\/li>\n<li><strong>Dormant accounts<\/strong> with valid credentials, which act as unmonitored entry points and often retain unnecessary access.<\/li>\n<li><strong>Service accounts<\/strong> with <a href=\"https:\/\/specopssoft.com\/blog\/microsoft-password-expiration-recommendation\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">never-expiring passwords<\/a>, creating long-lived, low-visibility attack paths.<\/li>\n<li><strong>Shared administrative credentials<\/strong>, reduce accountability and amplify the impact of compromise.<\/li>\n<\/ul>\n<p>From an underwriting perspective, evidence that an organization understands and actively manages these risks is often more important than the presence of individual technical controls. <a href=\"https:\/\/specopssoft.com\/product\/specops-password-auditor\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Regular audits of password hygiene<\/a> and credential exposure help demonstrate maturity and intent to reduce identity-driven risk.<\/p>\n<h3>Privileged access management<\/h3>\n<p><a href=\"https:\/\/specopssoft.com\/blog\/secure-privileged-accounts-keep-business-secrets-belong\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Privileged access management<\/a> is a critical measure of an organization&#8217;s ability to prevent and mitigate breaches. Privileged accounts can have high-level access to systems and data, but are frequently over-permissioned. As a result, insurers pay close attention to how these accounts are governed.<\/p>\n<p>Service accounts, cloud administrators, and delegated privileges outside central monitoring significantly elevate risk. This is especially true when they operate without <a href=\"https:\/\/specopssoft.com\/blog\/mfa-phishing-fatigue-resistant\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">MFA or logging<\/a>.<\/p>\n<p>Excessive membership in Domain Admin or Global Administrator roles and overlapping administrative scopes all suggest that privilege escalation would be both rapid and difficult to contain.&nbsp;<\/p>\n<p>Poorly governed or unknown privileged access is typically viewed as higher risk than a small number of tightly controlled administrators. Security teams can use tools such as <a href=\"https:\/\/specopssoft.com\/product\/specops-password-auditor\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Specops Password Auditor<\/a> to identify stale, inactive, or over-privileged administrative accounts and prioritize remediation before those credentials are abused.<\/p>\n<table cellpadding=\"0\" cellspacing=\"0\" style=\"float: left;\">\n<tbody>\n<tr>\n<td style=\"text-align: center;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiCtdHPD-mSGixOi_UhGSrjZtpZmC15RE8k5bBXZxJevGrJKVNoon5IadFQzslhvMeYA188BVMfxd7vRfkwfjVINaNDtenxbGJimDKWhNgz9K7R4pFDoYv2mLcEUNTD9Yt55ArxJsHCXRU0H12NMYQ4xHXI-XeMHDfTPPBrKdREAHRPgxm-cT6R6eR-2O9g\/s1600\/1.png\" style=\"clear: left; display: block; margin-left: auto; margin-right: auto; padding: 1em 0px; text-align: center;\"><img decoding=\"async\" border=\"0\" data-original-height=\"2603\" data-original-width=\"4684\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiCtdHPD-mSGixOi_UhGSrjZtpZmC15RE8k5bBXZxJevGrJKVNoon5IadFQzslhvMeYA188BVMfxd7vRfkwfjVINaNDtenxbGJimDKWhNgz9K7R4pFDoYv2mLcEUNTD9Yt55ArxJsHCXRU0H12NMYQ4xHXI-XeMHDfTPPBrKdREAHRPgxm-cT6R6eR-2O9g\/s1600\/1.png\" alt=\"Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026\" \/><\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: center;\">Specops Password Auditor &#8211; Dashboard<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>When determining the likelihood of a damaging breach, the question is straightforward: if an attacker <a href=\"https:\/\/specopssoft.com\/blog\/business-email-compromise\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">compromises a single account<\/a>, how quickly can they become an administrator? Where the answer is &#8220;immediately&#8221; or &#8220;with minimal effort,&#8221; premiums tend to reflect that exposure.<\/p>\n<h3>MFA coverage&nbsp;<\/h3>\n<p>Most organizations can credibly state that <a href=\"https:\/\/specopssoft.com\/product\/specops-secure-access\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">MFA has been deployed.<\/a> However, MFA only meaningfully reduces risk when it is consistently enforced across all critical systems and accounts. In one documented case, the <a href=\"https:\/\/specopssoft.com\/blog\/mfa-failure-costs-hamilton-cyber-insurance\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">City of Hamilton<\/a> was denied an $18 million cyber insurance payout after a ransomware attack because MFA had not been fully implemented across affected systems.<\/p>\n<p>While <a href=\"https:\/\/specopssoft.com\/blog\/mfa-alone-not-enough-protect-passwords-and-logon\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">MFA isn&#8217;t infallible<\/a>, fatigue attacks first require valid account credentials and then depend on a user approving an unfamiliar authentication request, an outcome that is far from guaranteed.<\/p>\n<p>Meanwhile, accounts that authenticate via older protocols, non-interactive service accounts, or privileged roles exempted for convenience all offer viable bypass paths once initial access is achieved.<\/p>\n<p>That&#8217;s why insurers increasingly require MFA for all privileged accounts, as well as for email and remote access. Organizations that neglect it may face higher premiums.<\/p>\n<h2>Four steps to improve your identity cyber score&nbsp;<\/h2>\n<p>There are many ways organizations can improve identity security, but insurers look for evidence of progress in a few key areas:<\/p>\n<ol>\n<li><strong>Eliminate weak and shared passwords:<\/strong> Enforce minimum password standards and <a href=\"https:\/\/specopssoft.com\/blog\/password-reuse-hidden-danger\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">reduce password reuse<\/a>, particularly for administrative and service accounts. Strong password hygiene limits the impact of credential theft and reduces the risk of lateral movement following initial access.<\/li>\n<li><strong>Apply MFA across all critical access paths:<\/strong> <a href=\"https:\/\/specopssoft.com\/blog\/keep-mfa-running-during-identity-service-disruptions\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Ensure MFA is enforced<\/a> on remote access, cloud applications, VPNs, and all privileged accounts. Insurers increasingly expect MFA coverage to be comprehensive rather than selectively applied.<\/li>\n<li><strong>Reduce permanent privileged access:<\/strong> <a href=\"https:\/\/specopssoft.com\/blog\/six-ways-to-apply-the-principle-of-least-privilege-to-your-active-directory\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Limit permanent administrative rights<\/a> wherever practical and adopt just-in-time or time-bound access for elevated tasks. Fewer always-on privileged accounts directly reduce the impact of credential compromise.<\/li>\n<li><strong>Regularly review and certify access: <\/strong>Conduct routine reviews of user and privileged permissions to ensure they align with current roles. <a href=\"https:\/\/specopssoft.com\/blog\/stale-user-accounts-report-in-active-directory\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Stale access<\/a> and orphaned accounts are common red flags in insurance assessments.<\/li>\n<\/ol>\n<div style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiPoDaw7Z6Ha_RsUGENuvMiqsO9o58t3YfnTi-sZf8PRLfkH5_NY2PKSFhfdzDH_ai16nDvqSiblDnOys-h3VFO61Ak3Wvu18cQzrEEWuvqkSDRxUB6fkIOcINgznwcspn18htBvnoO6LF7dlIVkGC9XYsbW-GthL8q6lCQnUVmYnFk7128pyD51EBZpy-9\/s1600\/2.png\" style=\"clear: left; display: block; float: left; padding: 1em 0px; text-align: center;\"><img decoding=\"async\" border=\"0\" data-original-height=\"380\" data-original-width=\"728\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiPoDaw7Z6Ha_RsUGENuvMiqsO9o58t3YfnTi-sZf8PRLfkH5_NY2PKSFhfdzDH_ai16nDvqSiblDnOys-h3VFO61Ak3Wvu18cQzrEEWuvqkSDRxUB6fkIOcINgznwcspn18htBvnoO6LF7dlIVkGC9XYsbW-GthL8q6lCQnUVmYnFk7128pyD51EBZpy-9\/s1600\/2.png\" alt=\"Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026\" \/><\/a><\/div>\n<p>Insurers increasingly expect organizations to demonstrate not only that identity controls exist, but that they are actively monitored and improved over time.<\/p>\n<p><a href=\"https:\/\/specopssoft.com\/product\/specops-password-auditor\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">Specops Password Auditor<\/a> supports this by providing clear visibility into password exposure within Active Directory and enforcing controls that reduce credential-based risk.<\/p>\n<p>To understand how these controls can be applied in your environment and aligned with insurer expectations, <a href=\"https:\/\/specopssoft.com\/contact-us\/?utm_source=thehackernews&amp;utm_medium=referral&amp;utm_campaign=thehackernews_referral_na&amp;utm_content=article\" rel=\"noopener\" target=\"_blank\">speak with a Specops expert<\/a> or request a live demo.<\/p>\n<div><\/div>\n<div>Found this article interesting? <span>This article is a contributed piece from one of our valued partners.<\/span> Follow us on <a href='https:\/\/news.google.com\/publications\/CAAqLQgKIidDQklTRndnTWFoTUtFWFJvWldoaFkydGxjbTVsZDNNdVkyOXRLQUFQAQ' rel='noopener' target='_blank'>Google News<\/a>, <a href='https:\/\/twitter.com\/thehackersnews' rel='noopener' target='_blank'>Twitter<\/a> and <a href='https:\/\/www.linkedin.com\/company\/thehackernews\/' rel='noopener' target='_blank'>LinkedIn<\/a> to read more exclusive content we post.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>With one in three cyber-attacks now involving compromised employee accounts, insurers and regulators are placing far greater emphasis on identity posture when assessing cyber risk.&nbsp;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-43820","post","type-post","status-publish","format-standard","hentry","category-thehackernews"],"_links":{"self":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/43820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/comments?post=43820"}],"version-history":[{"count":0,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/43820\/revisions"}],"wp:attachment":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/media?parent=43820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/categories?post=43820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/tags?post=43820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}