Cyber insurance MFA requirements, and how to meet them
The renewal form asks whether MFA is enforced for email, remote access and administrator accounts, for every employee. Many small companies can't honestly tick "yes," because nobody wants to roll out codes and push prompts to the whole team. NearAuth.ai adds the second factor without them.
What the application usually asks
Wording differs between insurers, but the same questions come up again and again:
| Typical question | What it's getting at | With NearAuth.ai |
|---|---|---|
| Is MFA required for all employees to access email? | A stolen email password is a common start to business email fraud. | Covered for Google Workspace and Microsoft 365 mail, for the people in your NearAuth group. |
| Is MFA required for remote access to your network? | VPN and remote desktop sign-ins are a common way in for ransomware. | Covered if your VPN or gateway signs in through Google, Microsoft Entra ID, SAML or OpenID Connect. Linux servers are covered over SSH. |
| Is MFA required for administrator and privileged accounts? | One administrator password shouldn't be enough to take over everything. | Covered for Microsoft Entra administrators in the group. Google doesn't send super admins to an outside sign-in service, so protect those with a hardware security key. |
| Do you protect against MFA fatigue or push bombing? | Attackers flood people with prompts until one is approved. | There are no prompts to approve, so there's nothing to flood. |
| Can you show who was signed in, and when? | After an incident, the insurer and investigators will ask. | Every check is logged with the person, computer, IP address and time, for 90 days. |
Answer for what's switched on
The application is a statement your insurer relies on. Before you tick "yes":
- List where people sign in: email, VPN, remote desktop, cloud apps, servers, backups.
- For each, note whether a second factor is enforced today, and for whom.
- Close the gaps you can, and tell your broker about the ones you can't yet.
- Keep a dated record of what was enforced when you signed.
Why teams put off MFA, and how NearAuth.ai removes the reason
No prompts to resent
With their phone nearby, people sign in with no code to type and no push to approve. Work out what prompts cost you.Keep what you have
It works with Google Workspace and Microsoft Entra ID. You switch on one group at a time, and everyone else signs in as before.Everyone, not just IT
Free for up to 12 people, so a small company can cover every employee and answer "all employees" truthfully.What it doesn't do
- It doesn't cover an app or device that has its own separate login, such as a firewall's admin page or a backup console, unless that login goes through your identity provider.
- It doesn't decide what your insurer accepts. Ask your broker.
- Every person needs the NearAuth.ai app on their phone and computer, with Bluetooth on.
- We don't yet hold a SOC 2 report. The audit is under way; see our security page.
See how NearAuth.ai compares with MFA, setup for Google Workspace and setup for Microsoft Entra ID.
This page is general information, not insurance or legal advice.
Frequently asked questions
Do cyber insurers require MFA?
Most applications now ask whether multi-factor authentication is enforced, and many insurers won't quote, or will charge more or limit cover, without it. The exact questions differ by insurer, so read your own application and ask your broker.
Where do insurers want MFA?
The common questions cover email, remote access to your network (VPN and remote desktop), administrator and other privileged accounts, and often backups and cloud services. Many ask whether it applies to all employees, not just some.
Does NearAuth.ai count as MFA on an insurance application?
NearAuth.ai adds a second factor, the employee's own enrolled phone next to their own enrolled computer, to sign-ins through Google Workspace or Microsoft Entra ID. Whether an insurer accepts a particular product is the insurer's decision. Describe it accurately and ask your broker to confirm before you sign.
What happens if we answer the MFA question wrongly?
An application is a statement the insurer relies on. If it says MFA is enforced everywhere and a claim shows it wasn't, the insurer may dispute the claim or the policy. Answer for what is switched on today, not what is planned.
Which sign-ins does NearAuth.ai cover?
Sign-ins that go through Google Workspace or Microsoft Entra ID, including Microsoft 365 email and the apps that use those accounts, other SAML and OpenID Connect apps you connect, and Linux servers over SSH. A VPN or remote desktop gateway is covered if it signs in through your identity provider.
How long does it take to set up?
Most teams have their first five people running in about 15 minutes. Connecting Google Workspace or Microsoft Entra ID for a group takes about 30 minutes.
How much does it cost?
The Essential plan is free for up to 12 users, with no credit card. Advanced is $6 and Enterprise $9 per user per month.
Free for up to 12 people
- The Essential plan is free for teams of up to 12, with Google Workspace or Microsoft 365. No credit card.
- Most teams have their first five people running in about 15 minutes.
- A bigger team? Advanced is $6 and Enterprise $9 per user per month. Book a 15-minute demo and we'll help you roll it out.
Christopher McLain, founder • chris@nearauth.ai • 607-238-3533