The Cyber Insurance Renewal Questionnaire Has Changed

You open the renewal packet expecting the usual questions: revenue, headcount, and a few checkboxes about your security program. Instead, now you get pages of control-level questions and a request for proof.

Underwriters don’t take your word for it anymore. They want evidence that controls are turned on, maintained, and monitored:

• Multi-factor authentication (MFA)
• Identity and access management controls
• Email security protections
• Endpoint detection and response (EDR)
• Backup and recovery processes
• Data protection and encryption
• Incident response readiness
• Security governance and oversight

The market has moved away from self-attestation toward evidence-based reviews. So “yes, we have MFA” doesn’t answer the question anymore. You have to show where it’s on, who it covers, and since when.

Here’s why. The insurance claims “actual cost” metrics keep getting worse.

Verizon’s 2025 Data Breach Investigations Report analyzed 22,052 security incidents and 12,195 confirmed breaches. Ransomware showed up in 44% of breaches. A third-party was involved in 30% of breaches.

Why Microsoft 365 Comes Up

Insurers ask about Microsoft 365 because that’s where the loss happens, not because of your choice of tech stack but because that’s where your users touch the keyboard. And many environments trust and leverage Microsoft 365. Your tenant usually holds your:

• User identities
• Email environment
• Sensitive business data
• Collaboration platforms
• AI and Copilot deployments

Compromise identity, email, or endpoints, and an attacker can reach all five.

Coalition’s 2025 Cyber Claims Report found 60% of cyber insurance claims came from Business Email Compromise (BEC) and Funds Transfer Fraud. It also found that 29% of BEC events resulted in financial fraud. The most common way organizations lose money to cybercrime runs through the mailbox your underwriter is asking about.

For scale: every day Microsoft processes more than 100 trillion security signals, blocks about 4.5 million net-new malware files, analyzes 38 million identity risk detections, and screens roughly 5 billion emails for threats.

At that volume, “we think we’re fine” isn’t going to satisfy an insurer, a board, or an auditor. They want a measurement and the evidence to back it.

What Secure Score Is, and What It Isn’t

Quick version: Microsoft Secure Score measures your security posture across Microsoft 365 and Microsoft Defender. It scores the controls you actually turned on, not the ones you meant to get to. You earn points as you implement recommendations across identity, devices, applications, and data. We broke down how it works in detail, in our blog, What is a Good Microsoft Secure Score.

One thing to be clear about, before we go further. Secure Score is not:

• A compliance certification
• A guarantee against breaches
• A direct indicator of insurance eligibility

Microsoft says outright that you shouldn’t treat Secure Score as an absolute measure of breach likelihood. And at Quisitive, we don’t treat it as absolute either. What you get is a practical metric showing where controls exist, where gaps are, and a directional indication of whether things are improving or drifting the other way. This is actually very useful information.

It’s the scoreboard, not the game.

Why Your Microsoft Secure Score Matters at Cyber Insurance Renewal

Insurers don’t ask about Secure Score because the number is magic. They ask because the controls that raise it are the same controls that reduce their losses.

Even when an insurer never says the words “Secure Score,” they’re asking about such measures and the controls behind it.

Identity and MFA

Identity is the front door. Common Secure Score recommendations here:

• Enabling MFA
• Requiring MFA for administrators
• Strengthening administrator access controls
• Blocking legacy authentication

The type of MFA matters, not just whether you have it. Marsh McLennan’s Cyber Risk Intelligence Center found phishing-resistant MFA was associated with a 9% lower likelihood of a material cyber event compared to methods that aren’t phishing-resistant. “We have MFA” and “we have phishing-resistant MFA” are two different answers on a questionnaire.

Endpoints and EDR

Most questionnaires now ask how widely EDR is deployed, not just whether you bought it. Coverage is what matters. Marsh found every 25% increase in EDR deployment across workstations and laptops correlated with an additional 10% decrease in breach likelihood.

Email Security

BEC is one of the most common cyber insurance claims. Secure Score recommendations that address it include:

• Microsoft Defender for Office 365 protections
• Anti-phishing controls
• Safe Links
• Safe Attachments
• Mail flow security improvements

These are the controls sitting between a convincing invoice email and a wire transfer you can’t get back.

Data Protection and Governance

Insurers ask more and more about:

• Data classification
• Encryption
• Data Loss Prevention (DLP)
• Audit logging
• Sensitive data protection

Audit logging is worth calling out. Without it you can’t reconstruct an incident, which means you can’t prove scope to your insurer, your regulator, or your customers.

Your Score Moves Whether You Touch It or Not

Most organizations aren’t stuck because they lack tools. They’re stuck because posture isn’t a project. It’s a moving target.

Secure Score shifts as:

• Users join and leave
• Devices get added or retired
• Policies change
• Licenses change
• Microsoft publishes new recommendations
• Business exceptions get introduced

What looked secure six months ago may not describe your environment today. That’s a problem when an underwriter asks you to attest to it.

Copilot Raises the Stakes on Governance

Microsoft 365 Copilot works within your existing permissions and access controls. That’s fine until it isn’t. If content is overshared, mislabeled, or open to too many people, Copilot can surface things a user would never have found clicking around SharePoint on their own.

Usual causes of oversharing:

• Broad site permissions
• Open sharing settings
• Broken permission inheritance
• Missing sensitivity labels
• Weak data governance

IBM’s 2025 Cost of a Data Breach Report found 63% of breached organizations had no AI governance policy or were still developing one, and 97% of organizations reporting an AI-related breach lacked proper AI access controls. Average U.S. breach cost hit $10.22 million.

What to Do Before Your Next Renewal

Treat this as an ongoing process, not a scramble six weeks out. Five steps:

1. Get your baseline. Find your current Secure Score and figure out which recommendations carry real security impact, not just the easiest points.
2. Prioritize what insurers actually review. MFA, Conditional Access, privileged access management, endpoint protection, email security, DLP, audit logging. These show up on nearly every questionnaire.
3. Validate your configurations. Confirm controls work as intended. Don’t assume a project from two years ago still holds. Policies drift and exceptions pile up.
4. Review Copilot and AI governance. Look at oversharing risk, sensitive data exposure, labeling policies, data access models, and your Microsoft Purview controls.
5. Build an evidence package. Document that controls are implemented, monitored, and maintained, and that posture is improving over time.

Underwriters, auditors, and boards all want the same thing: proof, not promises.

Where Spyglass® Guardrail Fits

Most organizations already know what needs fixing. What they don’t have is time or capacity to fix it and keep it fixed while running everything else. (Fair, honestly. Nobody has a spare quarter lying around.)

Spyglass® Guardrail from Quisitive was built for that gap. It helps strengthen Microsoft 365 security posture and then maintain it. Guardrail:

• Establishes a baseline in approximately five business days
• Targets Secure Scores of 80+
• Focuses on Microsoft-native controls
• Produces audit-ready evidence
• Maps controls to frameworks including NIST, HIPAA, HITRUST, PCI-DSS, and SOC 2
• Helps close in-scope Microsoft 365 control gaps
• Supports ongoing posture maintenance, not one-time remediation

The point isn’t a better dashboard number. It’s the controls underneath it, plus documentation showing they work.

Bottom Line

Cyber insurance renewals are security control reviews now, with paperwork attached. If you can show strong identity security, endpoint protection, email security, data governance, and evidence that you maintain all of it, the underwriting conversation goes very differently.

Microsoft Secure Score isn’t a compliance framework, and it won’t guarantee coverage. It does give you a practical way to measure, prioritize, and explain where your Microsoft 365 security stands in alignment with that Security Framework you’ve chosen whether NIST, CIS, PCI or some combination of several.

The organizations that do well at renewal aren’t the ones scrambling to answer questionnaires. They’re the ones who kept improving posture and collecting evidence all year.