As ransomware attacks become more frequent, insurance companies have become extremely stringent when reviewing Cyber Insurance renewals. Today, "MFA on Everything" is almost a non-negotiable baseline for receiving a premium quote. However, for many IT Managers, the reality includes one or two "Legacy Servers" running mission-critical applications on operating systems or software architectures that simply do not support native MFA.
When faced with the mandatory renewal questionnaire asking, "Is MFA implemented for all access?" IT Managers find themselves in a dilemma. Checking "No" could lead to sky-high premiums or an outright denial of coverage, but checking "Yes" could lead to a claim denial later if an incident occurs. This article provides a survival guide on using "Compensating Controls" to satisfy insurers without replacing your legacy systems.
The Insurer’s Bottom Line: Why the Obsession with MFA?
From an insurer's perspective, over 80% of data breaches involve compromised credentials. If a single entry point in your environment exists without MFA protection, hackers can use it as a foothold to move laterally through your network and launch a massive attack.
Consequently, insurers care about more than just your cloud email or VPN; they are deeply concerned about privileged access to servers. Even if it's an unpatchable Windows Server 2008 that has been running for a decade, its connection to the network makes it a fatal gap in your enterprise defense. This is why "MFA on Everything" has become a critical metric for renewal.
Never Lie on the Questionnaire: The Importance of Honest Disclosure
Under pressure, some businesses might choose to be vague on their questionnaire or hide legacy servers that lack MFA. This is an extremely dangerous decision. Cyber insurance is built on the principle of "Utmost Good Faith."
If, during a claim investigation, forensic experts discover that a breach occurred via a legacy system you claimed was "MFA-protected" when it wasn't, the insurer has every right to void the policy and deny all payouts. For IT Managers, the most professional and secure approach is to be honest while providing a detailed explanation of your "Compensating Controls."
Compensating Controls: Technical Alternatives to Native MFA
When a legacy server cannot support MFA software directly, insurers often accept "Compensating Controls." This means that while you haven't installed MFA on the server itself, you have built an equivalent layer of protection around it.
One common solution is using a "Bastion Host" or "Jump Server." You can move the legacy server into a completely isolated network segment (VLAN) and prohibit all direct logins. All administrators must first log into a Jump Server secured with strong MFA. Only after successful authentication can they remotely access the legacy system. Logically, this ensures that the "access behavior" is fully protected by MFA.
A second solution involves "Micro-segmentation and Network Access Control (NAC)." By using strict firewall rules, access to the legacy server is restricted to a few specific IP addresses, and these source devices must themselves be subject to rigorous authentication. When combined with "Virtual Patching" to protect against known vulnerabilities of the old system, insurers typically recognize the effectiveness of this composite approach.
Implementing Third-Party MFA Proxy Solutions
If an insurer insists on seeing protection at the server level, IT teams can consider third-party MFA proxy solutions (such as Silverfort or specific Duo components) designed for legacy environments.
The advantage of these solutions is that they do not require heavy software installations on every legacy server. Instead, they intercept underlying authentication protocols (like NTLM or Kerberos) and inject an MFA confirmation step into the validation process. This allows older versions of Windows or specialized industrial control systems to gain MFA capabilities instantly without changing a single line of code or system architecture.
Establish a Clear Decommissioning or Upgrade Plan
Beyond technical remediations, insurers highly value a company's "Commitment to Improvement." Including a clear "Decommissioning Plan" with your renewal—stating how the company plans to phase out non-compliant legacy equipment over the next 12 to 18 months—will significantly strengthen your case.
Cybersecurity is a journey of continuous improvement. Insurers are far more willing to cover companies that understand their weaknesses and have an active plan to address them. By combining compensating controls with a clear upgrade roadmap, you can pass your renewal audit, keep your premiums reasonable, and genuinely improve your organization’s resilience.
🛡️ Ready to Strengthen Your Security?
UD is a trusted Managed Security Service Provider (MSSP)
With 20+ years of experience, delivering solutions to 50,000+ enterprises
Offering Pentest, Vulnerability Scan, SRAA, and a full suite of cybersecurity services to protect modern businesses