Multi-factor authentication Often mandatory
MFA on email, remote access, and administrative accounts. The first control most carriers require before they will quote at all.
Governance & Compliance
Cyber Insurance Readiness. Pass underwriting, earn better terms.
Carriers decline cover, or price it high, when basic controls are missing or cannot be proven. We close the gaps underwriters look for and hand you an attestation your broker can take straight to market.
Why this matters
Cyber insurance has become a security audit with a premium attached. Underwriters now ask for proof of MFA, endpoint detection, tested backups, and a real incident response plan before they quote.
When the questionnaire comes back with gaps, applications stall, premiums climb, or cover is declined. A readiness engagement gets the controls in place and the evidence organized, so the answers you give your insurer are accurate, current, and provable. The goal is a clean submission and terms that reflect the real state of your security.
The control set
What carriers actually check
Underwriting questionnaires vary by carrier, but they converge on the same core controls. We assess each one, close the gaps, and capture the evidence that backs up your answers.
Endpoint detection and response Often mandatory
EDR or managed detection across endpoints and servers, with monitoring that can show coverage and response capability.
Tested, segregated backups
Immutable or offline backups with documented restore tests. Carriers weigh this heavily because it caps ransomware loss.
Documented incident response plan
A written, tested plan with named roles and escalation paths. Underwriters ask whether it exists and when it was last exercised.
Privileged access management
Control over admin and service accounts: vaulting, least privilege, and review. A direct factor in ransomware blast radius.
Email security and phishing defense
Filtering, anti-spoofing, and user reporting. Email remains the most common entry point, so carriers probe it closely.
Security awareness training
Regular training and phishing simulations with completion records, showing an active program backed by evidence the underwriter can see.
Patch and vulnerability management
A defined cadence for patching and a process for critical exposures. Carriers look for evidence that known holes get closed.
Illustrative control set drawn from common carrier questionnaires, not a specific policy requirement. Your insurer's exact criteria are confirmed during the engagement.
How it works
A readiness sprint with a clear start and finish
A fixed-scope engagement that takes you from questionnaire to attestation, with your team alongside ours the whole way.
01
Assess
We map your current posture against the carrier questionnaire and the core control set, then mark each item ready or open with the evidence behind it.
02
Close gaps
We prioritize the controls that block a quote and the ones that cut real risk, then implement or remediate them with your team.
03
Attest
We package the evidence and produce an attestation report and a broker-ready summary that maps cleanly to the questions insurers ask.
04
Renew
We support the broker conversation and stay ready for the next renewal, so the work keeps its value through future cycles.
Most engagements run 60 to 90 days depending on the size of the gaps. Timeline is a typical estimate, confirmed at scoping.
What you get
Evidence your insurer will accept
Every deliverable is built to answer an underwriting question, so the submission is clean and the conversation is short.
Underwriting gap assessment
A clear scorecard of every control the carrier checks, marked ready or open, with the work needed to close each gap.
Control implementation support
Hands-on help standing up MFA, EDR, backups, and the rest, so the controls are real and working, verified in your own environment.
Evidence pack
Screenshots, configurations, policies, and test records organized to the questionnaire, ready to attach to your application.
Attestation report
A signed summary of your control posture you can take to your broker and insurer with confidence in every line.
Broker-ready summary
A short, plain-language overview your broker can market, so the strength of your program is easy for an underwriter to see.
Renewal and re-attestation
We keep the evidence current and refresh the attestation ahead of each renewal, so terms reflect a posture that holds over time.
Part of the loop
Where this sits in VIGILE
ValidateCyber Insurance ReadinessEnhance
Validate baselines your control posture against what carriers check. Enhance keeps the evidence current renewal after renewal, so the attestation always reflects your real environment.
See how VIGILE works ›FAQ
Top 10 questions, frequently asked
No. Pricing and eligibility are the carrier's decision. What we do is get your controls in place and your evidence in order, so your submission is accurate and complete. A clean submission with strong controls gives you the best chance at cover and competitive terms, but the quote belongs to the insurer.
Multi-factor authentication, endpoint detection and response, tested backups, a documented incident response plan, and privileged access management come up on nearly every questionnaire. Email security, awareness training, and patch management follow close behind. We confirm your specific carrier's criteria at the start.
Most run 60 to 90 days, driven by how many gaps the assessment finds and how fast the controls can be put in place. If you have a renewal date, we work back from it and prioritize the items that block a quote first. The timeline is confirmed at scoping.
Yes. We produce a broker-ready summary and an attestation report mapped to the questionnaire, and we join the conversation where it helps. The aim is to make the underwriter's job easy, because clarity on controls is what moves terms.
We prioritize the controls that matter most for underwriting and for real risk reduction, then close them with your team. If the gaps point to a deeper need, the work connects directly to Managed Detection and Response, Incident Response, and the rest of the Saint Fox catalog.
No. We implement and verify controls, then document what is actually running. The evidence reflects the real state of your environment, which is the point. An attestation that does not match reality helps no one when a claim is filed.
A control-by-control readiness pack mapped to underwriter questionnaires: MFA coverage, privileged access, backups, detection and response, and incident readiness, each with proof rather than assertion.
Yes. A focused gap sprint against the renewal questionnaire is the fastest version of the engagement, prioritizing the controls underwriters weight most.
Principal Engineers close the technical gaps and a vCISO-level lead handles the narrative with your broker, so the application reads as one coherent posture rather than a checklist.
Validate establishes the gap picture, Guard and Implement close it, and Enhance keeps the evidence current so next year's renewal starts from proof.
Related services
Service
ISO & AI Security Audits
Certification readiness for when a recognized standard matters as much as an insurer attestation.
Learn more ›ServiceCyber Resilience & Continuity Validation
Stress test the recovery plan insurers and regulators expect you to have tested.
Learn more ›ServiceVirtual CISO
Ongoing leadership to keep controls, evidence, and Board reporting current between renewals.
Learn more ›Get ready before the questionnaire lands
Book a session with a Principal Engineer. We review your current controls against what carriers check and map the fastest path to a clean submission.