Coralie LemassonObtaining or renewing cyber insurance has become increasingly challenging for businesses worldwide. Although 87% of organizations report feeling under-protected, 17% either chose not to purchase cyber insurance or never considered it, citing rising premiums, lack of awareness, or apprehension about the risk-assessment process.
In Europe, insurability now hinges on demonstrating a mature security posture aligned with NIS2 and related regulations, as underwriters react to a “cyber protection gap” of ~US$0.9 trillion in annual losses. This baseline is reshaping what insurers consider manageable risk.
In this article, we decode these expectations and explain how a robust privileged access management (PAM) strategy can help organizations qualify for insurability in Europe’s risk landscape. For readers operating primarily in Canada or the United States, we also offer a companion piece that examines the same themes through a North American lens.
Looking for a PAM solution that checks your insurer’s boxes? Explore Devolutions PAM.
The changing risk calculus of cyber insurers
To understand the new demands from insurers, it is essential to grasp the pressures they face.
Rising breach severity and a shift in attacker behavior have forced insurers to rethink cyber risk. Verizon’s 2025 DBIR shows credential abuse as the leading initial access vector and ransomware in 44% of breaches, up 37% year-on-year. In EMEA, system intrusion and social engineering dominate, with most attacks financially motivated.
In parallel, insurers have constrained capacity and tightened prerequisites, with evidence that weak data-security controls can drive premiums up by 100–300%. Western Europe, one of the most mature cyber-insurance markets, has seen strong growth since 2017 alongside stricter underwriting.
Overlay NIS2, an expanded, mandatory, and auditable cybersecurity baseline for essential and important entities that now serves as an EU-wide de-risking framework and underwriting checklist mapping directly to PAM fundamentals, and the result is clear: access control and PAM are no longer peripheral to cyber insurance; they are central to eligibility.
Defining the insurer's PAM expectations
Underwriters are not inventing new requirements; they are checking whether organizations meet PAM-related controls already mandated by NIS2, GDPR, DORA, and similar frameworks, and may decline coverage outright when critical safeguards, such as MFA, are missing.
In practice, organizations are expected to:
- Govern privileged accounts. Maintain clear policies for managing privileged and system-administration accounts.
- Enforce strong authentication. Apply strong identification and authentication (for example, MFA) to high-privileged accounts.
- Apply least privilege and segregate duties. Individualize administration rights, and use dedicated admin accounts that are kept separate from ordinary user operations.
- Restrict high-risk access in time and scope. Limit privileged and third-party access in duration and scope, and log activity for traceability.
- Produce auditable evidence. Provide access logs, role/permission matrices, and MFA configuration proof when requested by authorities or insurers.
These regulations give insurers a ready-made, regulator-defined control framework to underwrite against. PAM, in turn, helps organizations prove accountability by generating unalterable audit trails of privileged activity and documenting administrative access to systems processing personal data.
Devolutions' PAM solution: Accessible, affordable essentials
By consolidating essential PAM and PAM-adjacent capabilities in one architecture, Devolutions’ privileged access management solution helps organizations demonstrate NIS2- and insurer-aligned access controls:
- Password vaulting (self-hosted or cloud-based): enforce strong authentication (including MFA) and role-based access, maintain a register of privileged accounts and permissions, and generate audit-ready access logs.
- Connection brokering: broker privileged remote sessions and apply granular, role-based restrictions.
- Remote access control: provide controlled, logged remote access with session recording for high-risk connections.
- Just-in-time (JIT) elevation: replace standing admin rights with policy-driven JIT elevation and automate post-use password rotation.
Organizations already using solutions like CyberArk, Delinea Secret Server, or BeyondTrust Password Safe can integrate them into the Devolutions platform, preserving investments while extending PAM coverage.
Because our platform is affordably priced and designed for rapid deployment, it brings advanced PAM within reach of SMBs and larger enterprises that still perceive themselves as insufficiently protected.
For teams of five or fewer, our Starter Pack delivers the same PAM capabilities (including JIT elevation and password rotation) at pricing optimized for smaller IT operations.
Conclusion
As underwriting criteria continue to evolve, organizations in Europe and across the EMEA region must align their controls accordingly. By implementing regulatory-aligned PAM controls, organizations improve their chances of obtaining coverage and build a more resilient security posture.
If you’re looking for a PAM solution in order to be eligible for cyber insurance coverage, explore our privileged access management package, or our Starter Pack for small teams.
Matt Miller