Regulators are zeroing in on identity compromise and help-desk controls On February 6, 2026, NYDFS issued a cybersecurity advisory warning of targeted “vishing” campaigns aimed at help desks to reset credentials and bypass MFA. What insurance leaders should care about:If a help desk can be socially engineered, privileged access can follow. Regulators and underwriters increasingly expect proof that identity verification processes are formalized, enforced, and tested. |
|
|
|
|
Supply chain breaches are driving downstream insurance exposureRecent reports linked a single threat actor to dozens of enterprise breaches via stolen credentials harvested from infostealer malware, affecting private companies across sectors. These incidents demonstrate how attackers increasingly bypass perimeter defenses and enter a company’s systems through compromised third-party credentials or shared technology platforms.
What insurance leaders should care about: Even when core policy and claims systems are secure, technology vendors, collaboration platforms, and integrated service providers can become rapid lateral pathways to data exfiltration and operational disruption. Third-party access governance and credential hygiene are now board-level resilience issues. |
|
|
Cyber insurance pricing is stabilizing — underwriting scrutiny is not Recent market reporting indicates cyber insurance pricing is expected to remain relatively steady through mid-2026 as capacity returns. At the same time, ransomware activity and systemic supply chain risk remain elevated.
What insurance leaders should care about: A softer pricing market does not reduce claim severity expectations. Underwriters are evaluating more than just technical controls, and differentiating insureds based on business interruption readiness, vendor dependency mapping, and executive response governance. |
|
|
|
|
Reinsurance softening may mask underlying loss drivers Recent cyber reinsurance renewals show significant softening in some structures, including notable rate reductions. However, ransomware reporting continues to show sustained attack volume and underreporting trends.
What insurance leaders should care about:Improving market terms can create complacency. Leadership should use favorable conditions to optimize coverage while strengthening operational resilience in the areas still driving severe losses. |
|
|
|
|
Identity compromise and third-party access governance are becoming the fastest path to material cyber events in insurance. Regulatory advisories and breach reporting consistently point to credential theft, help-desk manipulation, and vendor access misuse as primary entry points. What insurance leaders should care about: Two areas most likely to trigger regulatory scrutiny, business interruption, and coverage disputes in 2026 are 1) the ability to prevent identity takeover and 2) operate through third-party disruption |
|
|
Executive Actions to Prioritize This MonthPriority 1 — Lock down help-desk and privileged account resets
Require out-of-band verification, manager approval for elevated accounts, and logging tied directly to incident response review. Priority 2 — Review third-party access and credential exposure Identify vendors and SaaS integrations with persistent access to claims, underwriting, or finance systems. Confirm MFA enforcement and credential monitoring. Priority 3 — Re-test business interruption readiness Validate the ability to sustain claims and billing operations for several days under degraded conditions, including manual workarounds and decision authority clarity. |
For insurers, cyber resilience is no longer defined by controls on paper but by proven identity assurance and sustained operations through third-party disruption. Supervisory scrutiny centers on how leadership responds and documents decisions when disruption occurs. |
|
|
Need confidence that your cyber and privacy program would withstand regulatory scrutiny tomorrow?
→ FiveM helps insurers build, document, and continuously test regulator-ready governance programs.
|
|
|
