Cyber Insurance
Cyber insurers now require PAM. 12Port helps you answer their questionnaire.
Marsh’s top 12 controls list is the underwriting playbook every carrier follows. 12Port directly answers six of those twelve, including PAM, MFA on privileged access, RDP hardening, full session logging, end-of-life system protection, and vendor / AI-agent access. One platform. Agentless. Built for the questionnaire.
The cyber insurance market changed. Underwriters changed with it.
After three years of ransomware losses, carriers tightened their underwriting playbooks. Every major broker and carrier now publishes a list of required controls. Privileged Access Management appears on every list. So does Multi-Factor Authentication on privileged accounts, session monitoring, and credential rotation.
40%
of cyber insurance claims were denied in 2024.[1]
82%
of denied claims involved organizations without enforced MFA.[1]
47%
of attacks that triggered a cyber claim were identity-related or caused by a privileged-account compromise.[2]
62%
of organizations filed a cyber claim in the last 12 months.[2]
“Without positive responses in the top 5 control categories, coverage offered and insurability may be in question.”[3]
Marsh McLennan
PAM is one of those top 5. Why PAM is the spine of compliance.
Marsh’s top 12 controls. 12Port directly answers six.
Marsh’s Top 12 Cybersecurity Controls Identified by Cyber Insurance Carriers[3] is the list every broker and underwriter knows. Of the twelve, 12Port directly answers six: half the list, with one platform, agentless.
| # | Marsh control | How 12Port answers |
|---|---|---|
| 1 | MFA for remote access and admin/privileged access | AccessWall enforces MFA at every privileged session entry. No session starts without it. TOTP, push, FIDO2, and SAML chaining supported. |
| 2 | Endpoint Detection and Response (EDR) | Out of scope for 12Port. Pair with your existing EDR. |
| 3 | Secured, encrypted, and tested backups | Out of scope for 12Port. Pair with your existing backup tooling. |
| 4 | Privileged Access Management (PAM) | The platform itself: PAM, Credential Vault, Credential Rotation, and Session Intelligence in one agentless deployment. |
| 5 | Email filtering and web security | Out of scope for 12Port. |
| 6 | Patch management and vulnerability management | Out of scope, but see #11 (12Port wraps systems that cannot be patched). |
| 7 | Cyber incident response planning and testing | 12Port speeds response by giving the IR team a single source for “who accessed what and when,” but the plan is yours. |
| 8 | Cybersecurity awareness training and phishing testing | Out of scope for 12Port. |
| 9 | Hardening techniques, including RDP mitigation | Eliminate exposed RDP. Targets accept connections only from 12Port PAM. AccessWall blocks the access ports on the network so RDP, SSH, and similar protocols are not reachable from anywhere else. See Remote Access. |
| 10 | Logging and monitoring / network protections | Complete audit trail of every privileged event, including video recording of every session. Indexable, searchable, replayable. Evidence ready for the carrier and for forensics. |
| 11 | End-of-life systems replaced or protected | For systems that cannot be patched (legacy Windows, OT, ICS, embedded controllers), 12Port provides a compensating control: MFA-required, time-bound, recorded access through 12Port PAM. The unpatched system never speaks to the user directly. |
| 12 | Vendor / digital supply chain risk management | Brokered third-party access with MFA, time bounds, full recording, and no credential disclosure to the vendor. Same model applied to AI agents via the MCP Server for AI Agents. |
Six controls, one platform. Pair 12Port with the EDR, backup, email security, and patch management tooling you already run, and you cover ten of Marsh’s twelve before adding anything else.
What Marsh says about PAM specifically
“Privileged accounts are the keys to a network. When attackers compromise these accounts, they gain unlimited access to the network, increasing the likelihood of causing significant harm. Organizations can control for this by limiting the number of privileged accounts, using Just-in-time (JIT) elevation or vaults, and MFA. Many organizations implement PAM solutions that automate privilege and session management.”[3]
Marsh McLennan
Marsh’s prescription is exactly what 12Port does.
The control mapping
Question, capability, evidence. What an underwriter asks for, what 12Port does about it, and the framework reference auditors will recognize.
| Underwriter asks for | 12Port capability | Framework reference |
|---|---|---|
| MFA on privileged sessions | AccessWall enforces MFA at session entry. Supports TOTP, push, FIDO2, and SAML chaining. | NIST CSF PR.AC-7, CIS 6.5 |
| A PAM platform in place | Four core modules: Privileged Access Management, Credential Vault, Credential Rotation, Session Intelligence. | NIST CSF PR.AC-4, CIS 5.4, SOC 2 CC6.1 |
| Limited number of privileged accounts | Zero Standing Privilege. Access is granted at session time, removed at session end. | CIS 6.6 |
| Just-in-Time elevation | JIT request and approval workflow. No persistent admin rights. Marsh names JIT explicitly as a PAM enabler. | CIS 6.6, NIST CSF PR.AC-4 |
| Privileged session monitoring and recording | Session Intelligence records, indexes, searches, and replays every privileged session. | NIST CSF DE.CM, CIS 8.5 |
| Automatic password rotation on admin accounts | Credential Rotation: scheduled rotation or rotation on checkout. Targets human, service, and AI agent accounts. | CIS 5.2 |
| Audit trail and reporting | Full audit trail across every module. One-click reports aligned to SOC 2, HIPAA, PCI, NIST CSF for evidence packages. | SOC 2 CC4.1, PCI Req 10 |
| Third-party and vendor access controls | AccessWall brokers third-party sessions. Time-bound, MFA-enforced, recorded, no credential disclosure to the vendor. | NIST CSF ID.SC, CIS 15 |
| Removal of standing admin rights | Zero Standing Privilege as the platform default. Privileged rights only exist during an approved session. | CIS 5.4, CIS 6.6 |
| AI agent and non-human identity controls | MCP Server for AI Agents. Same JIT, vault, and audit model applied to AI workloads. | CIS 5 (extended) |
| Agentless deployment | No endpoint agents to install. Faster to roll out, faster to demonstrate at audit. Reduces the endpoint coverage objection underwriters raise. | Implementation note |
| Single source of evidence | All controls live in one platform. No swivel-chair between vault, session manager, IGA, and EDR. | Operational |
Be ready before the underwriter asks
Three things insurers want to see at renewal and after an incident.
Continuous evidence
Underwriters increasingly ask for evidence across the policy period, not a snapshot from the day you applied. 12Port logs every privileged session, every credential checkout, every elevation, every approval. The audit log is the evidence.
Single source
Most organizations spread privileged access across a vault, a separate session manager, an IGA tool, and EDR. When the questionnaire asks who accessed what and when, the answer comes from four systems that have to be reconciled. 12Port keeps the answer in one place.
Faster response
Time-to-restore matters in claims. With 12Port, you can answer “who had access to this asset on this date” in minutes, not days. That speeds incident response, which is what carriers reward.
Why agentless matters at audit time
The two questions underwriters ask after “do you have PAM” are “across what percentage of your environment” and “how long did it take to deploy.” 12Port is agentless. No endpoint agent to install, no kernel-level deployment, no exclusion list to negotiate.
- Coverage on day one. No gradual-rollout gap on the questionnaire.
- Linux, Windows, network devices, cloud consoles, SaaS admin accounts, and AI agents are all in scope from the start.
- Faster proof-of-coverage at audit. The asset list and the privileged-access list are the same list.
Frameworks your insurer cares about
Cyber insurers reference specific compliance frameworks during underwriting. 12Port produces evidence for all of them from a single platform.
Get to insurable. Then stay there.
A 30-minute demo against your environment. We map your current privileged access posture to your carrier’s questionnaire and show you exactly which boxes you can check after deployment.
References
- ^ Coalition. The State of Active Insurance: 2024 Cyber Claims Report. Coalition, Inc., 2024. https://www.coalitioninc.com/blog/2024-cyber-claims-report
- ^ Delinea. 2024 State of Cyber Insurance Report. Delinea, 2024. https://delinea.com/resources/cyber-insurance-report-2024
- ^ Marsh McLennan. Top 12 Cybersecurity Controls Identified by Cyber Insurance Carriers. US & Canada Cyber Practice. marsh.com/en/services/cyber-risk/insights/cyber-resilience-twelve-key-controls-to-strengthen-your-security.html