Insurers now require DMARC, MFA, and EDR before they’ll bind a policy. They do not yet require monitoring for the brand impersonation campaigns that drive most social engineering losses.
In an Illinois federal case that has become a reference point for cyber insurance attorneys, a company’s CFO fell for a spear-phishing email that impersonated a trusted contact. What followed was multimillion-dollar losses, a claim filed under the cyber policy’s computer fraud provision, and a denial from the carrier, Hartford Fire Insurance Company. Hartford’s argument was blunt: this was not a computer crime. No system was breached. No malware was deployed. Employees had been manipulated, not hacked, and the policy did not cover that distinction.
It is a distinction that sits at the center of the cyber insurance market in 2026. Impersonation, whether through spoofed emails, deepfake voices, or fabricated identities, now drives the most costly category of cyber claims. FBI data attributed $3.046 billion in BEC losses in 2025 alone. Yet the insurance products designed to cover these losses are still catching up to the way the attacks actually work. And the security controls insurers require of policyholders stop well short of the external monitoring that would detect impersonation campaigns before they reach an employee’s inbox or phone.
What insurers require in 2026
Underwriting has changed. Carriers that once accepted self-attestation now verify controls through external scanning, and misrepresenting controls on an application is the single most common cause of claim denials.
Before binding a policy in 2026, most carriers require phishing-resistant MFA on every account touching business data, endpoint detection and response on every endpoint and server, immutable and tested backups, a documented incident response plan, patch management with defined SLAs, and security awareness training with phishing simulation tracking. Email security has sharpened specifically: carriers now expect DMARC at enforcement, SPF and DKIM alignment, impersonation protection, and URL rewriting as baseline controls.
How much do these requirements drive actual spending? Considerably. Palo Alto Networks’ 2026 Identity Security Landscape report found that 98 percent of organizations say insurance requirements influenced their identity security investments over the past 12 months, with 81 percent calling that influence moderate or significant. No regulation has that kind of compliance pull. Insurance has become the lever.
Where the requirements stop
MFA protects the login. EDR protects the endpoint. DMARC protects the domain. Each of these controls is essential, and organizations that implement them are measurably more resilient. Coalition’s 2026 claims data showed that 86 percent of ransomware victims with proper controls refused to pay, and 64 percent of closed claims resulted in no out-of-pocket loss.
But social engineering fraud, the most costly claims category, operates largely outside the infrastructure these controls protect. A BEC attack that spoofs a vendor’s domain to redirect a payment never touches the victim’s MFA, EDR, or DMARC. A vishing campaign impersonating the IT helpdesk uses the phone network, not the email system. A cloned storefront collecting customer credentials under the organization’s brand runs on infrastructure the organization does not own.
Coverage for these losses is thin. Social engineering is typically offered as a sub-limit or endorsement rather than core policy, and most carriers cap it at $250,000. Consider that against BEC’s $3 billion in annual losses. And courts are still wrestling, as the Hartford case showed, with whether social engineering losses qualify as “direct” losses under computer fraud provisions at all.
What nobody is monitoring
Ask what carriers require and the answer sounds comprehensive. Ask a different question and a gap opens.
“Can an attacker get into our systems?” Every control on the underwriting checklist addresses this. “Is someone impersonating our brand to attack our customers, employees, or partners?” Nothing on the checklist addresses that.
Brand impersonation monitoring sits in this gap. Lookalike domains registered to mimic login portals. Fake social media profiles impersonating executives. Cloned websites collecting credentials under the organization’s name. Spoofed caller ID numbers matching the organization’s published phone lines. All of it observable before the impersonation campaign reaches its target. Detecting and removing this infrastructure does not replace the controls insurers already require. It covers the attack surface those controls were not designed for.
Industry voices are beginning to connect the dots. At NetDiligence, the leading cyber insurance conference, CSC’s Vincent D’Angelo presented research connecting domain security, brand impersonation, and the phishing and wire transfer fraud that drive claims. Swiss Re’s 2025 Sonar report warned that deepfakes and synthetic identities will increasingly contribute to cyber insurance losses. Where this leads looks familiar: external brand protection controls required the way carriers now require EDR and DMARC. Not as an optional enhancement. As a documented capability that affects premiums, coverage terms, and claim eligibility.
Why this changes the business case
Of the 38,000 cyber insurance claims closed in 2024, fewer than 10,000 resulted in a payout. Roughly one in four. Denials trace most often to misrepresented controls, excluded loss categories, and the failure to maintain attested capabilities continuously.
Organizations that can document external monitoring for brand impersonation, domain surveillance, and takedown capability add demonstrated diligence that strengthens both underwriting and claims. Monitoring does not guarantee coverage. But its absence, in an environment where impersonation drives the majority of social engineering losses, creates a documentation gap that underwriters and claims adjusters will increasingly scrutinize.
Every previous control followed the same trajectory. MFA went from best practice to recommendation to requirement to externally verified standard. EDR followed. DMARC followed. Brand monitoring is on the same path. Whether organizations implement it before the requirement arrives or after the first denied claim makes the decision for them is the only remaining question.
The Bottom Line
Cyber insurance has become the most effective compliance lever for driving security investment, with 98 percent of organizations reporting that insurance requirements shaped their spending. What insurers require in 2026 is meaningful, and organizations that implement those controls are demonstrably more resilient. But the requirements stop at the perimeter. Brand impersonation campaigns driving $3 billion in annual social engineering losses operate on infrastructure those controls do not reach. The insurance industry is beginning to close that gap. Organizations that close it first will be better positioned when the next renewal questionnaire asks about external brand monitoring.
Key Takeaways
Carriers typically require phishing-resistant MFA on all accounts, endpoint detection and response on every endpoint and server, immutable tested backups, DMARC at enforcement with SPF and DKIM, a documented incident response plan, patch management with defined SLAs, and security awareness training with phishing simulation tracking. Applications are verified through external scanning, and misrepresenting controls is the leading cause of claim denials.
Standard cyber policies do not automatically cover social engineering losses. Coverage is typically offered as a sub-limit or endorsement, often capped at $250,000. Whether impersonation-driven losses qualify as “direct” losses under computer fraud provisions is an active legal question, with courts reaching different conclusions depending on the specific policy language and circumstances.
Current requirements protect the organization’s own infrastructure through MFA, EDR, and DMARC. Brand impersonation campaigns operate on external infrastructure the organization does not control: lookalike domains, cloned websites, fake social media profiles, and spoofed phone numbers. These attack surfaces fall outside the scope of what insurers currently verify.
Documented external monitoring for brand impersonation adds demonstrated diligence that strengthens both underwriting and claims positions. Organizations that can show active domain surveillance, impersonation detection, and takedown capability demonstrate they are addressing the attack surface that drives the majority of social engineering losses.
Every major security control now required by carriers followed the same path from voluntary best practice to underwriting requirement. Industry voices at NetDiligence are connecting domain security and brand impersonation to cyber insurance losses. Swiss Re has warned that deepfakes and synthetic identities will increasingly drive claims. Brand monitoring appears to be on the same trajectory.
