Intel · 2026-05-04

Insurance Underwriting Meets Identity Assurance: Authentication Controls Applications Ask About

By J. W. Bouckaert

Authentication questions on cyber insurance applications

Cyber insurance applications ask about authentication controls. Marsh's April 2022 guide, Cyber resilience: Twelve key controls to strengthen your security, lists multifactor authentication for remote access and for privileged or administrator access as the first of twelve controls. The guide says insurers were tightening underwriting terms, asking more questions about applicants' controls, and treating some controls as a minimum requirement for coverage.

Insurers' rating models are not public, and this article does not estimate premium effects. It covers the authentication controls a security team can document for an application or renewal, and the standards behind each.

Phishing-resistant MFA

Not all MFA resists phishing. CISA's fact sheet Implementing Phishing-Resistant MFA calls phishing-resistant MFA "the gold standard" and urges organizations to make migrating to it a high priority. It names FIDO/WebAuthn authenticators and PKI-based methods as phishing-resistant, and describes how codes sent by text message or voice can be intercepted.

Adversary-in-the-middle phishing kits such as Evilginx relay a sign-in through an attacker's proxy and capture the session after the user completes MFA. One-time codes and push approvals do not stop this. WebAuthn credentials are bound to the site's origin, so a proxy on another domain cannot use them.

Useful evidence for an application:

The share of users whose primary sign-in method is a passkey or security key, reported separately for privileged accounts, and exported from the identity provider.
Which systems still allow SMS, voice or one-time codes, and for which users.
How account recovery works, since recovery is often the weakest path.

Carrier signals where phone numbers remain

Many consumer and recovery flows still rely on a phone number. Carrier APIs, including those offered through GSMA Open Gateway and the CAMARA project, let a service check for a recent SIM swap or confirm the number belongs to the device in use before trusting an SMS code. A team can document which flows use a phone number and which carrier signals are checked in each.

Sender-constrained tokens

A stolen bearer token works for whoever holds it. RFC 9449 (DPoP), published in 2023, binds an access token to a key the client holds, so a copied token cannot be used without that key. Relevant evidence includes access token lifetimes, refresh token rotation, and whether tokens are sender-constrained. The DPoP article covers rollout with shadow telemetry.

Revocation across identity providers

When a session is revoked at one identity provider, other relying parties need to learn about it. The OpenID Shared Signals Framework and CAEP, both Final Specifications since September 2025, standardize how those events are sent. Evidence includes which event types a service receives and what it does with each. See SSF and CAEP for cross-IdP revocation.

Post-quantum readiness

NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024. Long-lived signed records, such as audit logs and identity attestations, are the first candidates for migration. A short statement of which records are signed with a post-quantum or hybrid scheme, and the plan for the rest, documents the position.

Assembling the evidence

A renewal packet built from these controls would include:

An identity provider report of primary sign-in methods, with privileged accounts shown separately.
A list of flows that use a phone number and the carrier checks applied to each.
Token policy: access token lifetime, refresh rotation and any sender constraint.
Shared signals configuration: event types received and the action taken for each.
A post-quantum statement naming the schemes in use.

Much of this overlaps with SOC 2 evidence. See SOC 2 Type II for identity APIs.

PasskeyBridge in this picture

PasskeyBridge supplies verified identity signals to other identity systems. It is not an identity and access management product. Its carrier signal checks support the phone-number flows above. It checks DPoP proofs and can run in shadow mode to measure adoption, receives and transmits SSF/CAEP events, and signs its audit chain checkpoints with HMAC-SHA-256 and ML-DSA-65.