Michael Darlan
What “proof” actually means, domain by domain, and the one recovery step that can quietly undo all of it.
It’s one thing to have MFA, EDR, and patching in place. It’s another to produce evidence of it on demand, during a renewal, an audit, or a claim.
Most of the teams I talk with have the first part handled. The controls are real. What they don’t have, until we build it together, is a way to hand a carrier proof of any of it without a week of screenshotting dashboards under deadline pressure.
Here’s what that proof actually looks like, domain by domain, and the one recovery step that can undo it all if you get it wrong.
Access and identity: showing MFA was on, not just saying it was
Anyone can say MFA is enforced. Proving it takes a specific set of evidence, pulled before a carrier asks for it, not scrambled together after.
This is a bigger gap than most companies assume.
The 2026 DBIR found that among third-party cloud accounts with missing or improperly enforced MFA, only 23% of those gaps were fully fixed, and half took more than a month to resolve. If your own environment would take that long to confirm, that’s the actual problem this section solves.
What to pull together:
- The compliance and configuration page inside your identity provider showing MFA is enforced, and for which account types.
- The actual group policies that require it, not just a written statement that it’s required.
- Centralized logs (one SIEM, not five scattered tools) proving MFA was active, in use, and not bypassed during whatever specific incident a carrier is asking about.
That last bullet is the one most companies can’t produce fast. If your logs are scattered, get them into one place before you need them, not while you’re on a deadline.
Endpoints: knowing what’s covered, not assuming it
EDR coverage runs into the same problem as MFA: the gap is usually between what you think is covered and what actually is.
Verizon’s 2025 DBIR found that 46% of compromised devices carrying corporate logins were unmanaged or BYOD systems, not devices that were missed by a weak EDR agent, devices nobody knew to protect in the first place.
Coverage percentage on paper means little if it’s measured against the wrong inventory.
Three steps to close that gap:
- Pull your real asset inventory. Not the one from onboarding, whatever’s current today, including anything provisioned in the last month.
- Cross-reference it against your EDR console’s coverage report. Every asset should show up on both lists.
- Fix what doesn’t match before someone else finds it. A new laptop that never got the agent is exactly the kind of gap that surfaces during a claim review and nowhere else.
Backups and recovery: the trap that undoes everything else
This is the domain where good documentation on paper can still get you hurt.
If ransomware infiltrated an environment and sat dormant before anyone caught it, that dormant payload can end up embedded in a backup taken after the infection.
Restore from that backup, and you haven’t recovered. You’ve re-infected yourself on your own initiative, and no carrier is paying out for a breach you caused by restoring from your own backup.
How to avoid it:
- Don’t just confirm a backup exists on schedule. A completed backup job tells you nothing about what’s inside it.
- Test restores on a real cadence, not only after an incident when it’s too late to catch a problem calmly.
- Scan the backup itself for dormant threats before restoring it live, especially after any known or suspected compromise.
- Document the test date and result. That record is itself part of your evidence trail, not just an IT best practice.
Patch management: a risk register does the proving, not a policy statement
Being able to say you’re patching and being able to show you’re patching are two different things.
The 2026 DBIR is blunt about how bad this gap has gotten industry-wide: only 26% of known-exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, and the median time to fully resolve one stretched to 43 days, up from 32.
Even at the one-week mark, 60% to 70% of known-exploited vulnerabilities are still sitting open, regardless of an organization’s size, budget, or tooling. A risk register that actually tracks this, not just a policy saying patching happens, is what separates a company that can answer a carrier’s question from one that’s guessing.
What a carrier actually wants to see:
- A live risk register, not a policy document that says patching happens.
- What’s currently outstanding, by severity, not just a total count.
- When each item was found and when it was remediated, so time-to-remediate is provable, not asserted.
Email security and incident response: readiness you can point to
Both of these domains are where the human element and the technical evidence trail meet, and that intersection is exactly where most breaches still start. The 2026 DBIR found the human element present in 62% of breaches this year, with social engineering as the third most common pattern overall.
Neither a gateway nor a training program alone closes that gap; the evidence has to show both are working together.
Email security checklist:
- Gateway configuration and logs, showing what’s actually being filtered.
- Phishing simulation results, not just that a program exists.
- Training completion records showing employees can identify what’s landing in their inbox, not just that training was assigned.
Incident response checklist:
- Centralized, correlated telemetry pulling from every domain above into one place, not five separate tools.
- A documented response timeline for any past incident: when it was detected, when it was contained, when it was resolved.
OneAxiom tracks a seventh domain, vendor risk, alongside these six. It’s outside the scope of what’s covered here, but worth knowing it’s part of the same evidence trail if a carrier asks.
Why this evidence trail is worth building even if you never file a claim
None of this is insurance-specific busywork. The same evidence trail that satisfies a carrier also satisfies a SOC 2 auditor, a vendor security questionnaire, and a board asking what your actual risk posture looks like this quarter.
Build it once and it pays out in more than one place.
What that looks like inside one SOC, concretely:
- 96% of what fires in our environment gets investigated and absorbed before it ever reaches a customer’s own team.
- 2,856 detection rules were live as of early June 2026, a snapshot, not a permanent figure, since the count changes as rules get written and retired.
- Our P1 response SLA is a contractual 30 minutes, company-wide, for both SIEM and EDR. Vulnerability scanning runs daily, fixed in the platform for every customer, not a configurable option.
- Across the full customer base we manage 10,000+ endpoints, a fleet-wide total, not a per-customer figure.
If you want to see where your own environment’s documentation and reality have drifted apart before a carrier finds that gap for you, the Security Observability Scorecard walks through the same domains covered here.
Quick answers
What evidence do cyber insurers actually require? Proof across six to seven domains: access and identity (MFA enforcement, shown via identity provider config and group policies), endpoints (EDR coverage matched to real asset inventory), backups (tested restores, not just scheduled backups), patch management (a risk register, not a policy statement), email security (gateway plus training records), and incident response (centralized, correlated telemetry).
How do you prove MFA is actually enforced? Show the compliance and configuration page inside your identity provider along with the group policies enforcing it, plus centralized logging that can confirm MFA wasn’t bypassed during a specific incident. Saying MFA is on and proving it are different disciplines.
Can restoring from backup cause a cyber insurance claim to be denied? Indirectly, yes. If ransomware was dormant in an environment and gets restored from a backup taken after the infection, that re-introduces the compromise. Carriers won’t pay out for a breach caused by an improperly verified restore.
Does documenting security controls actually lower a cyber insurance premium? It can. One OneAxiom customer’s renewal quote dropped 15% in negotiation once their controls were packaged and documented for the carrier, though results vary by carrier and program.
Written by Michael Darlan, Cybersecurity Specialist at OneAxiom
Edited by Julia Araujo, Marketing Manager at OneAxiom
