A cyber underwriter receives files that all contain the same words, and the job consists in not ranking them by the number of boxes ticked. Two companies can show the same audit score, the same security management certification, the same list of measures, and present risks that are not comparable at all. The reason is structural: a framework measures an organization's conformity to a set of practices, which is useful and is not the same thing as resistance to an attack. Ranking controls by what they change in the risk rather than by their place in a framework is the heart of the trade.
Three measures dominate everything else in intrusion statistics, and they are recognized by the fact that they close a path rather than watch it. Multi-factor authentication on all remote access closes the most-traveled path, that of the stolen credential. Offline backup, physically disconnected or immutable, closes the path by which an attacker destroys the ability to rebuild, and it alone decides the difference between three days and six weeks of interruption. Network segmentation closes lateral movement, that is, what turns one compromised workstation into a stopped company. The rest counts and counts less.
One must then distinguish controls that reduce frequency from those that reduce severity, because they are not bought at the same price and do not serve at the same moment. Authentication and patch management reduce the probability of entry. Backup and segmentation change nothing about the probability of entry and divide the cost when it happens. An underwriter that does not make that separation prices an average; an insured that does not make it invests where it is being talked to rather than where it loses. In cyber, where frequency is hard to estimate and severity observable, severity measures are often the best use of a budget.
The patching delay deserves a question of its own, because it is the only indicator that says something about the organization and not merely about its tooling. A company applying a critical patch within seventy-two hours has a decision chain that works, an up-to-date inventory, and teams that know how to stop production to restart a server. A company taking four months may have the same tools and none of that. That delay is asked for as a figure, over the last twelve months, and it is worth more than an entire framework because it cannot easily be misdeclared.
Then comes a factor questionnaires capture badly and that weighs heavily: dependency. A company whose production rests on a single cloud provider, on a hosted management suite, or on a managed services provider holding the administration credentials, carries a risk its own measures do not reduce. It has delegated part of its attack surface to someone whose practices and updates it does not control. An underwriter identifying that dependency moreover learns something about its portfolio, since the same provider sits behind dozens of insureds.
Finally, one must know what an audit does not say, and say it without contempt for audits. An audit report describes a state at a date, on a declared perimeter, from interviews and samples. It does not test the real restoration of a backup, it does not verify that service accounts are covered, it does not say whether the company can function without its systems for a week. The three questions that usefully replace a report fit in one sentence each: when did you last restore for real, how many accounts escape the second factor, and who can stop production without asking permission.
The method for reading a file therefore comes to few things. Look for the three measures that close a path rather than those that watch it. Separate what reduces frequency from what reduces severity, and see where the company put its money. Ask for the patching delay as a figure rather than the patching policy as a principle. Name the external dependencies, for the insured and for the portfolio. And remember that an identical score on two files means nothing, because a framework measures conformity and one underwrites resistance.
Two companies in the same sector, 200 million euros of turnover each, show the same security audit score, 78 out of 100, and the same management certification. The first applies critical patches in 96 hours on average over the last twelve months, keeps a weekly offline backup tested twice a year, and hosts production on its own servers. The second patches in 11 days, backs up continuously to the same cloud provider that hosts its production, and has never tested a restore. The underwriter accepts the first and declines the second. Was it right?
The identical score says nothing, and that is the starting point: a framework measures an organization's conformity to a set of practices, one underwrites resistance to an attack, and two companies at 78 out of 100 can carry incomparable risks. Three gaps separate these files and none appears in the score. The patching delay, 96 hours against 11 days, is the only indicator that speaks about the organization rather than the tooling: the first has an up-to-date inventory, a working decision chain, and teams allowed to stop production; the second may have the same tools and none of that. Backup next, and it is the heaviest: continuous backup to the provider that already hosts production is not a backup in the sense that matters here, since it does not close the path by which an attacker destroys the ability to rebuild. It is a missing severity measure, the one that decides between three days and six weeks of interruption. And the absence of a restore test leaves the question unanswered: nobody knows whether it works. The third gap is dependency, which questionnaires capture badly: the second has delegated production and backup to the same third party, so its own measures do not reduce the share of risk it has handed over. The underwriter was therefore right on the merits, but its refusal deserves to be reasoned on those three named points rather than on a global judgment, failing which the broker will come back with the same file and a score of 82.
- 01A framework measures conformity, one underwrites resistance: two files with the same score can carry incomparable risks.
- 02Three measures dominate because they close a path instead of watching it: authentication, offline backup, segmentation.
- 03Separating what reduces frequency from what reduces severity says where the company put its money, and where it should have.
- 04The patching delay as a figure speaks about the organization, not the tooling, and it cannot easily be misdeclared.
- 05A backup held at the provider that already hosts production does not close the path it claims to close.