Estimated reading time: 8 minutes
Nearly every cyber insurance applicant now says yes to MFA. A new paper says underwriters should ask whether it is phishing-resistant MFA, and on which accounts.
A manufacturer required multi-factor authentication (MFA) on every account. It still lost £150,000.
The firm allowed text-message codes as the second factor. An attacker used an adversary-in-the-middle attack to capture credentials and take over the chief financial officer’s account. Fraudulent wire transfers followed, Travelers reported last year. Travelers named two control failures: the weak MFA setup and no out-of-band check on payments.
That firm could have ticked yes on the standard MFA question. So can almost everyone else. Yes answers on MFA in Marsh’s Cyber Self-Assessment, its insurance application tool, “have neared 90% to 100% across almost all organizations.” Marsh drew the conclusion in August 2025: “While still critical, the mere presence of MFA is no longer a strong risk differentiator in recent data, largely because there are few organizations without it.”
A new paper from the Center for Cybersecurity Policy and Law (CCPL) wants insurers to change the question. CCPL and the law firm Venable, working with Yubico, released it Oct. 20. Yubico sells YubiKey hardware security keys, one form of the phishing-resistant MFA the paper recommends. Davis Hake and Luke O’Grady wrote “Cyber Insurance in the Age of AI Phishing.” Experts from Liberty Mutual, Resilience, Marsh, Munich Re, Chubb, Cowbell and CyberAcuView contributed.
“A simple ‘yes’ on an application today tells an underwriter almost nothing about an organization’s actual security posture,” Jeremy Grant said in a Yubico blog Q&A. Grant is a managing director at Venable and a senior advisor to CCPL.
Why Phishing-Resistant MFA Is Different
Legacy MFA includes text-message codes, email codes, and push prompts. Attackers can talk a person into handing them over. An attacker’s proxy can relay them to the real site in real time.
Phishing-resistant MFA ties the login to the genuine website. Passkeys and security keys built on the FIDO2 standard work this way. “The authenticator simply won’t complete a login on a fake domain,” Hake said in the Yubico Q&A.
I asked David Treece, Yubico’s vice president of business development, what went wrong last time. “The first MFA push worked, but it treated all MFA as equal,” he told me, “and attackers adapted to the weaker forms.”
Attackers keep finding ways through phishable MFA. A China-aligned group used one against AI policy experts this year.
Adoption still trails. About 70% of organizations use some form of MFA, but only 14% use phishing-resistant MFA, Okta found.
What The MFA Underwriting Data Shows
Marsh compared applicants’ self-assessment answers with their claims histories. Applicants with phishing-resistant MFA showed roughly twice the drop in breach likelihood of those with other MFA. The finding is a correlation, and it rests on what applicants said about themselves.
Yubico has its own numbers. A Forrester study found a 265% return on investment for a composite company that replaced older MFA with YubiKeys. Yubico commissioned the study, Treece confirmed. “Underwriters should weigh our numbers accordingly and lean on the claims data,” he told me.
Social Engineering Drives The Losses Behind MFA Underwriting
The claims data shows where the money goes. Business email compromise and funds-transfer fraud made up 58% of Coalition’s claims in 2025, according to Coalition’s 2026 claims report. Financial fraud and business email compromise make up about half of Travelers’ cyber claims, Insurance Journal reported. Christine Mapes of Travelers gave the figure at an industry conference this week.
Resilience reports the sharpest shift in its midyear report. Phishing, social engineering and transfer fraud made up 85.3% of its incurred losses in the first half of 2026. Two years earlier, the share was 17.7%. “Attackers have used AI to sharpen social engineering across the board, from emails to voice deepfakes, and defensive tactics have to keep pace,” Resilience said.
Resilience also found no incurred losses from AI-specific attack vectors, such as prompt injection, in the period. Treece sees AI working through old attacks. “I’d frame AI as an amplifier of phishing that already worked, not a new attack category,” he told me.
Phishing-resistant MFA does not stop every scheme. “A BEC or funds-transfer fraud (FTF) attack can succeed with no login compromise at all, such as a spoofed invoice or a deepfaked call,” Treece said. Payments still need out-of-band checks. Four in 10 CISOs have met a deepfake on a work call, Gartner found.
Better Questions For The Cyber Insurance Application
The paper offers three tiers of application questions, sized for small, mid-sized, and large insureds. The first tier asks which accounts need MFA and which methods the firm allows. It asks whether high-risk users must use phishing-resistant MFA. It also asks whether payment changes get an out-of-band check and dual approval.
Treece offered a one-line version. “‘Is MFA enabled?’ should become ‘Is phishing-resistant MFA enforced for email, admin, finance and remote access, with SMS and email OTP disabled?'” he told me. “Coverage matters as much as the method: a strong control on 60% of users isn’t a strong control.”
Many underwriters still rely on applicants’ self-attestation, the paper says. “The important change for underwriters is to move from attestation to evidence,” Treece told me. Underwriters can ask for an identity provider policy export or screenshot. It should show which sign-in methods are on and whether SMS, email codes, and voice are off. For help-desk resets, they can ask for the written recovery procedure.
Recovery is a common back door. “Recovery after a lost security key or a phone that controls a passkey shouldn’t be a weaker door,” Treece said. He advises registering two passkeys per user up front.
Passkeys Or Hardware Keys
Smaller firms have a cheaper path. Microsoft made passkeys the default sign-in method for Entra ID users from Sept. 1, Microsoft said.
For a small business, a synced passkey is “a big step up from SMS or an authenticator code,” Treece said. NIST has said synced passkeys can meet its Authenticator Assurance Level 2, he noted. But a synced passkey depends on the cloud account behind it and that account’s recovery process.
Hardware keys earn their place with administrators, finance staff who approve payments, executives and developers with production access, Treece said. Rollout is often the hard part. IT teams already name MFA as the control they find hardest to run, Kaseya found.
Will insurers reward the upgrade? The paper recommends premium credits or better terms for verified deployments. I asked Treece whether any carrier offers one today. He named none. “It is best to reach out to the individual carrier to see if they have an incentive model,” he told me.
MFA Underwriting When The Actor Is An AI Agent
The paper also looks ahead to AI agents. Agents sign in with API keys, service accounts, and tokens. Treece said phishing-resistant MFA belongs with the person who authorizes the agent and approves its riskiest actions.
“If an agent can move money, someone should have to prove, with a phishing-resistant credential, that they approved it,” Treece told me. “Without that, a compromised or manipulated agent is just a faster version of the BEC problem.” Most AI agents don’t say who they are, Arkose Labs found.
The paper asks claims teams to record which identity control failed in each loss. Today most claims teams code losses by outcome, such as ransomware or funds-transfer fraud. “If an incident was caused by push fatigue or an AiTM bypassing SMS, that context is lost,” Hake said.
The manufacturer in the Travelers case had MFA on every account. The question that mattered was which kind.
Get Our Podcast
Criminals case a target before they strike, and the dark web can show them doing it. Jonathan Palmer, CEO of CDL Cyber Intelligence, explains how, and what it means for underwriting. Listen to the episode. Presented in association with CDL Cyber Intelligence.
FAQ – Phishing-Resistant MFA
What is phishing-resistant MFA?
It is a sign-in method bound to the genuine website, so it will not work on a fake one. Passkeys and FIDO2 security keys are common forms.
Why is “Do you have MFA?” a weak underwriting question?
Almost everyone says yes. Marsh found yes answers near 90% to 100%, so the question no longer separates strong risks from weak ones.
How many organizations use phishing-resistant MFA?
About 14%, according to Okta. About 70% use some form of MFA.
Does phishing-resistant MFA stop business email compromise?
Not all of it. A spoofed invoice or a deepfaked call needs no login. Payments still need out-of-band checks and dual approval.
Is a synced passkey good enough for a small business?
For many, it is a big step up from SMS codes, Yubico’s David Treece says. Hardware keys suit admins, finance staff and executives.
Do insurers give premium credits for phishing-resistant MFA?
The CCPL paper recommends them. Treece named no carrier offering one and advises insureds to ask their carrier directly.
Related Cyber Insurance Posts
- Cyber Insurance Losses Rise As Prices Keep Falling, NAIC Report Shows
- Does the Cyber Insurance Industry Overrate MFA? (Opens in a new browser tab)
- Are Cyber Insurers and their Clients Putting Too Much Trust in MFA (Multifactor Authentication) to Stop Ransomware? (Opens in a new browser tab)
- Goodbye Password, Hello Passkey: Game-Changing Evolutions in Getting Logged On with HYPR CEO Bojan Simic – NEW Cyber Insurance News Podcast(Opens in a new browser tab)
- Identity Risk Shifts As AI Drives New Wave Of Impersonation Attacks(Opens in a new browser tab)