For MSP partners, cyber insurance has become a critical subject in client conversations. The compliance and coverage pressure most MSPs and MSSPs have dealt with has historically centered on mechanisms like MFA and backup documentation. The partner either handles these things or the client has consciously decided to accept the risk and ignore them.
Now insurers are digging deeper into device visibility and management. They increasingly want to know not just whether businesses have security controls in place, but whether they can identify every device that has access to company systems and data. This includes personal devices, contractor equipment and forgotten unmanaged hardware.
Many businesses struggle to answer those questions.
How it happens
Once, a payroll company with roughly 80 employees was blindsided by its longtime insurance carrier. The insurer wanted a complete inventory of every device with access to company data (personal/BYOD phones and contractor equipment included), but nobody could produce one.
As the MSP tried to piece it together, the sprawl of data access and risk was more than anyone expected. It accounted for the client company’s laptops, but:
- A senior accountant had been using a personal MacBook for three years, but had not formally enrolled it in anything.
- A contractor from a software project the previous spring still had active remote access credentials.
- There was a server in the back office that predated the current MSP relationship.
- A conference room tablet was running an operating system version from 2022 that nobody had patched.
The MSP spent huge amount of time and effort only to find that the company’s security policies were deficient. The insurer came back with a rate increase and a remediation list. The partner was forced to have a difficult conversation with a client it had served well for years.
However, that company was probably fortunate. Most insurers take you at your word and only scrutinize the security posture after a claim. They then spend time to find security lapses like these that will give them grounds to deny the claim. Nothing in this case was because someone was negligent in any dramatic sense, but in a way, that’s the most instructive part.
SMBs accumulate devices with sensitive data and freewheeling access the way offices accumulate things in storage closets. BYOD was already known before March 2020, but employees working remotely en masse for a couple of years got even more comfortable on personal hardware with habits that didn’t go away when offices reopened.
Cam Roberson
MSPs that have done proper device audits for clients have a clear sense of how common this is. Omdia research suggested that around 30%-40% of endpoints in a typical SMB environment are unmanaged. That is probably conservative for a lot of smaller clients.
Why insurers are asking now
Unmanaged devices have always been a security problem, but insurers are now more actively looking for them at renewal time. Underwriters spent several years after the ransomware wave of the early 2020s tightening requirements around MFA and backup procedures. Most of that scrutiny is well understood now.
The questions are now about device visibility, and whether encryption and access controls extend to the device level rather than just the network perimeter.
Part of why that second piece matters more now is the shift in how ransomware attacks actually work. This is what insurers live in fear of. The old playbook was encrypting your data and demanding payment to restore access. In this scenario, good backups largely neutralize the threat.
The evolved “ransomware 2.0” world we live in today is different. Attackers exfiltrate data first and threaten to sell or publish it. Backups don’t help there. However, device-level encryption does. It keeps stolen data unreadable regardless of what the attacker does with it afterward. You get more complete protection with layered encryption.
BitLocker handles drive-level security but operates at the system level. Once a device is authenticated, an active session can still expose data to an attacker that gains access. Adding user-level and device-specific encryption controls on top of that creates tighter access boundaries, so a compromised session on an authenticated machine doesn’t automatically hand over readable files. An unmanaged device is a gap in exactly that protection. That’s why insurers have started caring a heck of a lot more about the inventory question specifically.
Make the stakes concrete
Getting clients to take device hygiene seriously has always been harder than it should be. The security argument alone doesn’t land the way you’d want it to. What works considerably better is making the insurance stakes very specific.
A client that understands how its cyber insurance requirements affected its premium is far more likely to engage in conversations about endpoint risk than one that has only heard a theoretical discussion. Clients respond best when their MSP connects security recommendations to real insurance costs.
The most successful MSPs over the next few years likely will be the ones that have built device audits into standard onboarding and annual reviews rather than something they reconstruct under pressure when a questionnaire arrives. That audit almost always turns up things that surprise people, such as credentials that were never revoked or equipment connecting from locations nobody recognizes. Getting that picture documented and addressed results in genuine recurring value.
A cybersecurity insurance expert also made a point worth keeping in mind when vetting carriers with clients. If an insurer isn’t asking tough security questions upfront, the insurer either is not equipped for this line of business or it is leaving room to deny claims later.
That cuts both ways for MSPs. On one hand, it means steering clients toward carriers that take the underwriting seriously. It also ensures that everything a client attests to on a questionnaire is documented and provably in place. When a claim is filed and a forensics team arrives to verify controls, the documentation that was built at renewal time could mean the difference between a paid claim and a denied one.
Cam Roberson is vice president at Beachhead Solutions. The cloud-based platform provides PC and device security and access controls (including layered encryption) mapped to the control number requirements of 10 compliance frameworks. Roberson previously held several senior product management roles with Apple Computer in the computing and imaging divisions.
Featured image: Muzaddid — stock.adobe.com
