Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026

Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026

One in three cyber-attacks now involves compromised employee accounts, prompting insurers to prioritize identity posture over traditional perimeter defenses. With the average cost of a data breach hitting $4.4 million in 2025, underwriting requirements have shifted from binary checklists to granular assessments of credential hygiene.

Why This Matters

While many organizations assume they are protected by standard MFA and password policies, technical debt like legacy NTLM protocols and unmonitored service accounts creates opaque risk profiles. In practice, insurance payouts are no longer guaranteed; for example, the City of Hamilton was denied an $18 million claim because MFA was not consistently enforced across all systems, highlighting the gap between policy intent and technical implementation.

Key Insights

• Credential compromise is a primary breach vector, contributing to a global average breach cost of $4.4 million in 2025.
• Legacy authentication protocols like NTLM persist in many environments despite being replaced by Kerberos since Windows 2000, providing harvestable credentials for attackers.
• MFA implementation gaps can lead to total claim denials, as seen in the $18 million ransomware loss case involving the City of Hamilton.
• Dormant and service accounts with never-expiring passwords create long-lived, low-visibility attack paths that bypass standard user monitoring.
• Tools like Specops Password Auditor are used to identify stale, inactive, or over-privileged administrative accounts before they are exploited.

Practical Applications

• Use Case: Active Directory environments transitioning from NTLM to Kerberos to eliminate legacy authentication vulnerabilities. Pitfall: Failing to identify all dependencies before disabling NTLM, leading to service outages.
• Use Case: Implementing just-in-time (JIT) access for Domain Admin roles to reduce the attack surface. Pitfall: Granting permanent administrative rights for convenience, which allows immediate privilege escalation upon account compromise.
• Use Case: Enforcing MFA on all remote access and cloud application paths to satisfy underwriting requirements. Pitfall: Exempting privileged service accounts from MFA, creating viable bypass paths for attackers.

References:

• http://thehackernews.com/2026/02/identity-cyber-scores-new-metric.html