Many cyber carriers scan your external surface and score you before they quote. Insurance Posture sees what they cannot: our read-only scanner reads the real control state inside Microsoft 365, Entra ID, and Azure, cross-checks every mapped application answer, and flags what to fix before you submit.
Start your assessment. Connect Microsoft 365, Entra ID, or Azure with read-only access, or upload your carrier application.
Insurance posture is the measurable state of your security controls as cyber insurance carriers evaluate them: the share of application answers you can prove with evidence, not the share you answer from memory.
Every application, renewal application, and claim starts the same way: carrier questions about MFA, backups, endpoint protection, privileged access, and incident response. Most organizations answer from memory. Underwriting prices from what it can verify.
A strong insurance posture means every answer on that application maps to a control that is verifiably in place in your environment, so what you tell the carrier matches what an incident responder would find.
You answer the application. Insurance Posture cross-checks your answers against your actual cloud environment and flags what does not hold up.
Upload the carrier's application, renewal application, or ransomware supplemental in any format, or start from our canonical question library built from major carrier forms.
Read-only connections to Microsoft 365, Entra ID, and Azure scan the configuration controls carriers ask about: MFA, privileged access, email authentication, and more.
Answer each question from your documents and attestations. Each answer is checked against live scan data where a scanner control maps to it, and flagged when your environment contradicts what you attested, so you close gaps before you submit.
Whether you run IT, own risk, or work with a broker on the placement, everyone works from the same evidence-checked picture.
Canonical questions mapped across major carrier applications, so one assessment pre-fills most of what each carrier asks, with per-carrier wording preserved.
Read-only scans of Microsoft 365, Entra ID, and Azure cross-check your attested answers, so drift between what you said and what is deployed surfaces before you submit, not during a claim investigation.
Every gap is ranked by how prominently the control appears across carrier applications and supplementals, so you fix the questions carriers ask most insistently. Ranking reflects question prominence in application forms, not any carrier's underwriting rules.
A broker-ready drift brief and your evidence files in one place, ready to hand to your broker or board without translation.
Scheduled scans catch drift between renewals, so you find it at renewal instead of during a claim investigation.
Role-based access for your team and multiple organizations under one login.
Nearly every US carrier application and ransomware supplemental concentrates on the same six areas. This is what your insurance posture is scored on.
| Control area | What the carrier asks | Evidence source |
|---|---|---|
| Multifactor authentication | Is MFA enforced for email, remote access, and all privileged accounts? | Entra ID conditional access policies, admin role assignments |
| Backup and recovery | Are backups immutable, offline or segregated, and restore-tested in the last 12 months? | Azure Backup, immutability locks, restore test records |
| Endpoint detection and response | What percentage of endpoints and servers run EDR with 24/7 monitoring? | Defender for Endpoint onboarding coverage |
| Privileged access | How many global admins exist, and are privileged access reviews performed? | Entra ID role assignments, PIM, access review history |
| Email security | Are SPF, DKIM, and DMARC enforced, and is phishing simulation training run? | DNS records, Exchange Online protection policies |
| Incident response | Is there a written, tested incident response plan and logging retention? | Log retention settings, plan attestation, tabletop records |
Insurance posture is the measurable state of an organization's security controls as cyber insurance carriers evaluate them. It is expressed as the share of carrier application answers that are backed by verifiable evidence from the live environment rather than answered from memory.
Security posture measures risk against a security framework such as CIS or NIST. Insurance posture measures the same environment against what a carrier asks on its application, where each answer is a representation the carrier relies on. An organization can have a strong security posture and a weak insurance posture if it cannot prove the specific controls carriers underwrite: MFA everywhere, immutable tested backups, EDR coverage, privileged access review, and email authentication.
Most carrier questionnaires concentrate on six control areas: multifactor authentication for email, remote access, and privileged accounts; backup immutability and restore testing; endpoint detection and response coverage; privileged access management and access reviews; email security including SPF, DKIM, and DMARC; and incident response planning with tested playbooks.
It can. Application answers are representations the carrier relies on, and some policies attach them as conditions precedent. If a material control stated as in place was not in place, the carrier may seek to rescind the policy or deny the claim, as in Columbia Casualty v. Cottage Health (2015) and Travelers v. International Control Services (2022). Whether that succeeds depends on materiality and state law.
Start 90 days before renewal. Obtain last year's application, verify each answer against the live environment instead of memory, close the highest-impact gaps first (usually MFA coverage gaps, backup immutability, and privileged access review), and assemble evidence for every answer you keep. Bring the evidence package to the broker with the application.
Insurance Posture Analyzer is a SaaS product from SecValley that turns cyber insurance carrier applications into attested, evidence-checked answers. You answer from extracted documents and attestations, and live, read-only scans of Microsoft 365, Entra ID, and Azure cross-check each mapped answer and flag drift when the environment contradicts what was attested.
No. Connections are read-only. Scans collect configuration state from Microsoft 365, Entra ID, and Azure and make no changes to the environment.
No. SecValley is a security technology vendor. Insurance Posture measures and evidences security controls; it does not underwrite, place, or sell insurance, and it does not give insurance advice.
Connect a read-only account, run your first scan, and get evidence-checked answers for the controls carriers ask about most, plus a clear list of what still needs attestation or evidence on file.