A cyber underwriter has two sources of technical truth: an outside-in security rating and a form the applicant filled in. The rating measures the perimeter. The form measures the applicant's memory. Neither reads the tenant, and the tenant is where the five controls that decide a ransomware claim actually live.
An external scanner sees DNS and mail records, TLS configuration, exposed services, leaked credentials, and breach mentions. That is real signal about hygiene. It is not a statement about how identity is enforced inside Microsoft 365, who holds standing privilege, or whether the backups survive an attacker who already has domain credentials. Ransomware losses run through identity and end at the backups. Both are invisible from outside.
The Five
1. Conditional Access exclusions. The form asks whether MFA is enforced. The tenant answers a narrower question: enforced for whom. Every real policy carries exclusions, a vendor group from a migration, a service account added so a nightly job would stop failing. Each was reasonable, and each is a hole in the sentence. See Conditional Access misconfigurations.
2. Non-interactive sign-ins. MFA is a property of an interactive sign-in. An attacker holding a stolen session token never signs in again, so the MFA the form described was never in the path. That is the mechanism behind token theft, and it lives in the log nobody reads.
3. Standing privilege. How many accounts hold Global Administrator permanently rather than through activation, how many of those are non-human, whether the break-glass accounts are the two that were designed or the six that accumulated, and when the last review actually ran. Each is a count with a date, and none can be inferred from outside.
4. Backup immutability, and who can break it. Immutability enabled is a setting. The control question is whether the credentials an attacker is most likely to steal can reach the backups: backup admin who is also domain admin, lock window shorter than dwell time, retention shortenable online. A product screenshot cannot show that. Role assignments can.
5. Non-human identities. Service principals, app registrations, managed identities, and now AI agents hold application permissions, carry client secrets, authenticate without MFA by design, and outlive the projects that created them. No widely used application question asks about them. See service principal sprawl and AI agent identities.
The Failure Is Symmetric
For the insured, an unverified answer is rescission risk. In Travelers v. International Control Services the court rescinded a cyber policy from inception in August 2022 after the insurer alleged the applicant had described MFA as protecting administrative access when it protected the firewall. The mechanism is in why cyber insurance claims get denied.
For the carrier, the same answer is a priced risk that was never the risk on the paper, with litigation after the loss as the only recovery route. Rescission is not a business model. It is underwriting discovering what it was pricing, too late.
What Changes When the Tenant Is Readable
| The question on the form | The readable fact |
|---|---|
| Is MFA enforced for administrative access | Policy scope and the accounts that fall outside it |
| Is remote and email access covered | Legacy authentication state and non-interactive sign-in volume |
| Is privileged access limited and reviewed | Standing role assignments and the date of the last review |
| Are backups immutable and segregated | Lock state, retention window, and who holds write access |
| Are all accounts inventoried | Service principals, their permissions, and secret expiry |
Two properties matter more than the coverage. A check that could not be read is reported as unanswered, never as passed, because a silent failure rendered green is the defect that produces a false answer. And every finding carries the date it was read.
The boundary is worth stating plainly. A configuration read proves state on a date, not that a control operated all period. Training completion, vendor terms, and incident response testing stay attestations. The useful claim is narrower: read what can be read, and label the rest as what it is.
SecValley scans Microsoft 365, Entra ID, and Azure read-only and reports dated findings. Insurance Posture runs on the same scans and maps them to the carrier question set, marking each question verified, attested, or unreadable. The public question library is at insuranceposture.com/questions.
SecValley is a security scanning and compliance platform, not an insurance broker, agent, or carrier. Nothing here is insurance, legal, or coverage advice. Policy wording and underwriting practice vary by carrier, policy, and state. Talk to your broker and your counsel.
Frequently Asked Questions
Do security ratings replace a cyber insurance questionnaire?
No. A rating describes externally observable hygiene without the applicant's cooperation. A questionnaire asks about internal control configuration no external observer can reach. Identity, privilege, and backup controls are represented only in the questionnaire, which is why the accuracy of those answers carries the coverage.
Why can an external scanner not see Conditional Access policies?
Policy state lives in the Entra ID tenant and is exposed only through authenticated Microsoft Graph calls. Without tenant credentials a scanner can see that a login page exists, not which policies apply or which groups are excluded.
Does a read-only scan prove a control operated for the whole policy period?
No. It proves the configuration state on the date it ran. Continuous coverage requires repeated scans, which is what turns a point-in-time reading into a record of drift between binding and renewal.
