Coralie LemassonIn recent years, the cyber insurance landscape in North America has undergone a marked transformation. Once considered a discretionary safety net, cyber insurance has become a cornerstone of business risk management. As insurers recalibrate underwriting models in response to surging breach incidents and escalating claims, they have increased scrutiny on identity and privilege security — privileged access included. Within this context, privileged access management (PAM) has evolved from a best practice into a non-negotiable prerequisite for insurability.
The changing risk calculus of cyber insurers
The emphasis on PAM is driven by an unmistakable threat vector: ransomware. According to the National Association of Insurance Commissioners (NAIC), ransomware attacks grew by nearly 93% in 2021. Notably, the highest ransom paid to date — just under $40 million — was paid by an insurer. In response, underwriters are requiring more structured, demonstrable cybersecurity practices to prevent such costly incidents.
A recent industry survey found that nearly half of all claims are rooted in privilege misuse or identity compromise. Consequently, over 40% of insurers now require proof of least privilege enforcement, and 95% of insured U.S. organizations must implement identity-related controls to remain eligible for coverage.
These developments signal a tightening, yet maturing, cyber insurance environment.
Looking for a PAM solution that checks your insurer’s boxes? Explore Devolutions PAM.
Defining the insurer's PAM expectations
Although expectations vary by insurer, several clear trends have emerged, and many converge on PAM. As noted earlier, ransomware has been a principal driver of this shift toward PAM. From the insurer’s perspective, PAM controls — whether explicitly named or not — are valued for their capacity to “prevent, detect, and respond to malicious activities throughout the ransomware lifecycle”.
In other words, insurers may not always use the term “privileged access management,” but their technical requirements frequently align with its capabilities.
The following are notable PAM and PAM-adjacent controls commonly required by insurers:
1. Multi-factor authentication (MFA)
Considered foundational by many insurers, MFA is either explicitly stipulated (for example, for domain admin accounts or remote access) or implied in layered access control expectations.
2. Credential management and password rotation
Secure credential storage, enforced password complexity, and automated rotation are becoming standard requirements.
3. Logging, monitoring, and session recording
Auditability is a consistent concern. Insurers may require session recording, monitoring, and/or logging of administrative activity, including credential checkouts, privilege escalations, password resets, and group membership changes.
4. Just-in-time (JIT) access and zero standing privileges (ZSP)
Insurers increasingly expect temporary privilege elevation workflows like JIT access, grounded in a zero standing privilege approach. JIT elevation grants privileges on a temporary basis, while ZSP ensures privileges are immediately revoked and none remain when not in use.
5. Principle of least privilege (PoLP) and role-based access controls (RBAC)
Delinea found in their cyber insurance survey that 41% of respondents were required to implement role-based access and/or least-privilege controls (as a best practice, both should be implemented) to maintain cyber insurance eligibility. Insurers expect privileges to be assigned according to job function, not granted universally.
6. Secure remote access
Remote access, whether for remote workers, vendors, or contractors, is an ongoing insurer concern. Misconfigured remote access protocols, such as Microsoft Remote Desktop Protocol (RDP), pose a significant security risk, notably since the COVID-19 shift to remote work. Insurers expect layered defenses such as VPNs and MFA over RDP to mitigate these risks.
Devolutions' PAM solutions: Our holistic approach
Consolidating all essential PAM and PAM-adjacent functions within a unified architecture, Devolutions' privileged access management solution can help organizations align themselves with insurer expectations. Our solution includes:
- A centralized password vault (Devolutions Server or Devolutions Hub), with MFA enforcement, RBAC, and encrypted storage;
- Devolutions Remote Desktop Manager, which brokers access to remote sessions and restricts permissions granularly;
- Devolutions Gateway, a lightweight VPN alternative enabling session recording and third-party access management;
- Devolutions PAM, offering automated password rotation, JIT elevation, and least-privilege enforcement.
Organizations already using solutions like CyberArk, Delinea Secret Server, or BeyondTrust Password Safe can integrate them into the Devolutions PAM platform, preserving existing investments while expanding capabilities.
Our PAM solution provides an efficient, auditable management platform that supports insurer-aligned best practices across identity, access, and privilege. Because the Devolutions platform is priced affordably and designed for ease of deployment, it brings advanced PAM within reach of small, midsized, and large businesses alike.
For teams of five or fewer, our Starter Pack delivers the same robust PAM features as our full solution — including JIT elevation and password rotation — but at a price optimized for smaller IT operations. It’s an ideal first step for teams looking to establish a solid cybersecurity foundation and obtain cyber insurance early in their growth.
Conclusion
As underwriting criteria continue to evolve, organizations in North America must adapt their security strategies accordingly. PAM — whether or not insurers name it explicitly — is no longer optional.
By understanding and aligning their PAM controls with insurer expectations, organizations can not only improve their chances of obtaining coverage, but also build a more resilient and responsible security posture. Devolutions' integrated PAM solutions offer insurer-aligned foundations for this critical transformation.
If you’re looking for a PAM solution in order to be eligible for cyber insurance coverage, explore our privileged access management package, or our Starter Pack for small teams.
Matt Miller