Glossary

Multi-factor authentication (MFA)

A login check that requires two or more kinds of proof, such as a password plus a code or device, and a control cyber insurers now expect.

Also called: MFA, two-factor authentication, 2FA, two-step verification

Multi-factor authentication asks a user to prove identity with at least two of three kinds of evidence: something they know (a password), something they have (a phone, authenticator app or hardware key) and something they are (a fingerprint or face). A stolen password alone no longer opens the account.

Cyber underwriters treat MFA as a gating control. Applications ask whether it is enforced on email, especially cloud email; on remote access such as VPN or remote desktop; on administrator and privileged accounts; and on backup systems. Missing MFA on email and remote access is a common reason for a declination, higher retentions, or restricted terms such as a ransomware sublimit with coinsurance. Underwriters ask because compromised credentials are a frequent way attackers reach email and networks, which is also how business email compromise begins.

Answer the application precisely. "MFA enabled" for some users or only on a pilot is not the same as enforced for everyone, and an inaccurate answer can jeopardize a later claim. Not all methods are equal: texted codes are weaker than app-based codes or hardware keys, and attackers can wear users down with repeated push approvals. The guide on MFA, EDR and backups lists what insurers ask for, and the cyber insurance readiness checklist helps you prepare.

Last reviewed October 10, 2026

In the index now

Related terms

Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Business email compromise (BEC) Fraud in which a criminal impersonates an executive, vendor or client by email to trick an employee into sending money or changing payment details. Social engineering fraud Fraud that tricks an employee into voluntarily sending money or data by impersonating a vendor, executive or client, rather than breaking into systems. Computer fraud A crime-policy coverage for money, securities or property lost when someone uses a computer to fraudulently move it out of your premises or accounts. Cyber extortion A demand for payment backed by a threat to encrypt, destroy or publish your data or disrupt your systems, and the cyber policy coverage that responds to it.

Related guides

Building an incident response plan your insurer will like What a cyber incident response plan needs for your policy to work: the hotline call, consent rules, evidence, legal deadlines and a tested first 24 hours. The cyber insurance application: what underwriters ask and how to answer What a cyber application and ransomware supplement ask, how insurers rely on your answers, and how to complete them so a claim is not denied or rescinded. MFA, EDR and backups: the controls cyber insurers now require The security controls cyber underwriters expect before quoting full terms, what a credible answer looks like for each, and a 90-day order for closing the gaps. Deepfakes and AI-driven fraud: what cyber and crime policies cover How AI voice and video impersonation is used to move money, which policy answers a deepfake loss (crime, cyber or neither), and the controls insurers expect. HIPAA breaches and cyber insurance for healthcare providers How the HIPAA Breach Notification Rule, OCR penalties and state laws drive costs after a patient-data breach, and what a cyber policy does and does not pay. Ransomware sublimits and coinsurance in cyber policies How ransomware sublimits, retentions and coinsurance split a cyber loss, why the order of application matters, and what to negotiate at renewal.

Related industries

E-commerce business insurance Product liability, marketplace insurance requirements, stock at fulfillment centers, cyber and shipping losses for online sellers.

Related tools

Cyber insurance readiness checklist Rate 25 security controls yes, partly or no to see your readiness score, your gaps and which controls cyber insurance applications commonly ask about.