Estimated reading time: 6 minutes
“Can you show that users do not have unnecessary administrative privileges?”
That is one of the insurance questionnaire questions that gives small IT teams the most trouble, says Andrew Bensinger, CTO of CyberFOX. The hardest questions are the ones that ask for proof, he said.
New survey data from CyberFOX shows why. The company sells access and credential security software to small and mid-sized IT teams. It released its 2027 Security Maturity Index on Nov. 3. Research agency TrendCandy surveyed 361 IT and security leaders for it in September. They work across 16 industry segments, at organizations with fewer than 5,000 employees.
Sixty percent said their organization closely follows least privilege. The principle limits each user to the access their job needs. Yet 54% said employees still keep standing administrator rights on their devices.
CINI asked how many respondents said both. Of 215 leaders who follow least privilege “very” or “somewhat” closely, 78 also said employees keep standing local admin rights. That is 36% of the group, CyberFOX told CINI. It is 22% of everyone surveyed.
“We think the gap between principle and practice is an important finding,” Bensinger said. Adding, “Least privilege is widely understood.” Running it consistently is harder. IT teams have to balance application needs, productivity and support demands.
Only 8% have fully replaced standing admin accounts with temporary elevation, the report says. CyberFOX sells a product built to do that, called AutoElevate.
What The Questionnaire Asks
Bensinger listed the questions that create the most friction for small teams. “They are the questions that require the organization to prove a control is operating consistently,” he said. He gave four examples:
- “Can you show that users do not have unnecessary administrative privileges?”
- “How is privileged access granted and revoked?”
- “Are privileged accounts protected and accounted for?”
- “Can you produce evidence showing who received elevated access, when, why and for how long?”
Revoking access is its own problem. CINI looked at it in a piece on former employees who keep access after they leave.
Smaller teams often understand what good practice looks like, Bensinger said. The challenge is running it without slowing users down. “That is where an insurance questionnaire can expose the difference between having a policy and truly implementing best practice and being able to prove the control is working,” he said.
Black Kite’s Bob Maley made a similar point to CINI this week. “Questionnaire answers are aspirational more often than they are false; people describe the program they think they have,” he said in a piece on quantum readiness.
Why The Answers Matter
An application answer can decide whether a policy responds. In 2022, Travelers asked a federal court to rescind a cyber policy it had issued to International Control Services. Travelers said the company had misrepresented its use of multifactor authentication on the application. The two sides then asked the court to declare the policy void from its inception, Insurance Journal reported.
Broker Lockton drew a lesson from the case. Applicants should assume “incorrect answers in applications will have significant and unfortunate consequences,” it wrote.
What The Survey Didn’t Ask
The survey didn’t ask whether respondents carry cyber insurance. So it can’t compare insured firms with uninsured ones.
Insurance also appears only alongside other pressures. Forty-three percent said a rejected or deferred security investment was later approved after an outside event. The options were a security incident, an audit finding, a cyber insurance requirement, a customer requirement, or a compliance mandate. Respondents weren’t asked which one drove the approval.
Evidence gathering works the same way. Sixty-three percent, or 227 respondents, said pulling evidence from multiple systems takes “a great deal” or “a lot” of manual work. The question covered compliance reviews, insurance requirements, and security audits together.
CyberFOX shared one more figure with CINI. Forty-six percent said audits, insurance requirements, or compliance mandates sped up their adoption of privileged access controls “to a great or very great extent.”
Smaller Teams Report Wider Gaps
Leaders on IT teams of fewer than 15 people reported wider gaps than those on teams of 15 to 50:
- 81% of the smaller teams said limited staffing has left important risks unaddressed, against 37% of larger ones.
- 34% said their most significant known security gap has been open 12 months or longer, against 10%.
- 79% use a managed service provider for at least one IT or security function, against 41%.
Across the sample, 46% said their biggest known gap has been open at least six months. Twenty-four percent said a year or more. The report’s text says 26%. CyberFOX confirmed the correct figure is 24% after CINI flagged the difference.
Insurers have started putting clocks on open flaws. Chubb’s endorsement for neglected software gives policyholders 45 days to patch a published vulnerability, CINI reported. Most small firms still don’t buy cyber cover at all, CINI reported from a Zywave conference roundtable.
Bensinger summed up the squeeze in CyberFOX’s release. A 10-person IT team gets “the same insurance questionnaire as a team five times its size,” he said. The questions don’t get easier for the smaller team.
FAQ – Least Privilege
What is least privilege?
It is the principle that each user gets only the access their job needs. Administrator rights are granted for a task and then removed.
What are standing admin rights?
They are administrator privileges that stay switched on all the time. CyberFOX found 54% of IT leaders say employees still keep them.
How many firms claim least privilege but keep standing admin rights?
Of 215 leaders who say they follow least privilege closely, 78 also let employees keep standing admin rights. That is 36% of the group.
Which insurance questionnaire questions are hardest for small IT teams?
CyberFOX CTO Andrew Bensinger says it is the ones that ask for proof. Examples include showing users lack unnecessary admin rights and who received elevated access, when and why.
Can a wrong application answer affect cyber coverage?
Yes. In 2022, Travelers asked a court to rescind a policy over an insured’s MFA answers. Both sides then asked the court to declare the policy void.
Did the CyberFOX survey ask about cyber insurance?
It didn’t ask whether respondents carry cyber insurance. Insurance appeared only alongside audits and compliance in some questions.
Related Cyber Insurance Posts
- One In Five Companies Look Quantum-Ready From Outside. Their Cloud Provider May Deserve The Credit.
- What Your Cyber Insurance Policy Misses – And What Attackers Find First – NEW PODCAST(Opens in a new browser tab)
- AI Risk Grows As Firms Sacrifice Identity Security For Speed(Opens in a new browser tab)
- Diligent’s New Board Dashboard Raises a Question Insurers Should Love(Opens in a new browser tab)
- Terra Sends AI Agents Into The Internal Network. The Liability Question Stays Outside(Opens in a new browser tab)
1 thought on “Firms Say They Limit Admin Rights. More Than A Third Still Hand Them Out, CyberFOX Data Shows.”