The $4.2 Million Email
In September 2025, a 35-person accounting firm in Ohio received an email that looked exactly like it came from their cloud storage provider. One employee clicked the link and entered their credentials. Within four hours, attackers had accessed client tax records, bank account details, and Social Security numbers for over 12,000 individuals.
The firm filed a cyber insurance claim for $4.2 million — covering forensic investigation, client notification, credit monitoring, legal defense, and business interruption.
The claim was denied. The reason? The compromised account didn't have multi-factor authentication enabled.
The MFA Problem
An analysis of cyber insurance claim denials reveals a striking pattern: 82% of denied claims involve organizations that failed to implement multi-factor authentication across all required systems.
MFA — the simple process of requiring a second form of verification beyond a password — has become the single most important factor in cyber insurance claims.
Here's why: when you apply for cyber insurance, you're asked point-blank whether MFA is enabled on all remote access, email, and privileged accounts. Most businesses say yes. But when a claim is filed, insurers investigate. And they frequently discover that MFA wasn't actually deployed everywhere it should have been.
This creates a situation that insurers consider a "material misrepresentation" on the application — which gives them grounds to deny the claim entirely.
Real-World Denial Scenarios
The "Almost Everywhere" Problem
A 50-person law firm had MFA enabled on their main email system and VPN. But they had an older file-sharing system that didn't support MFA natively. They didn't think it mattered — it was just used internally.
Attackers compromised the file-sharing system, used it as a pivot point to access the broader network, and exfiltrated client case files. The insurer denied the claim because MFA wasn't universally deployed, as stated on the application.
The "Admin Exception" Problem
A dental practice enabled MFA for all staff accounts. But the office manager's account — which had admin privileges — was exempted because she found the extra step inconvenient.
That account was compromised through credential stuffing, giving attackers admin access to the practice management system containing patient records. The insurer denied the claim, noting that privileged accounts without MFA represent a material gap in security controls.
The "We Turned It Off" Problem
A marketing agency enabled MFA during their insurance application process. Three months later, after several employees complained about the extra login step, IT disabled it "temporarily." Six months after that, a phishing attack compromised multiple accounts.
The insurer's investigation revealed MFA had been disabled for months. The claim was denied because the security posture at the time of the incident didn't match what was represented on the application.
Why MFA Matters So Much
The reason insurers are so fixated on MFA comes down to simple math:
- 99.9% of automated account attacks are blocked by MFA (Microsoft)
- 80% of hacking-related breaches involve compromised credentials (Verizon DBIR)
- $150,000 average cost of a credential-based breach for small businesses
MFA is the highest-impact, lowest-cost security control available. When an organization experiences a breach that MFA would have prevented, insurers see it as a preventable loss — similar to how a fire insurer would view a claim from a building with disabled sprinklers.
How to Implement MFA Properly
Getting MFA right means more than turning it on for a few accounts. Here's a comprehensive approach:
Step 1: Inventory All Access Points
List every system that employees access, including:
- Email (Microsoft 365, Google Workspace)
- VPN and remote desktop
- Cloud applications (CRM, accounting, project management)
- Admin panels and dashboards
- Backup systems
- Legacy applications
Step 2: Enable MFA Everywhere
For each system on your list:
- Enable MFA through the platform's built-in settings if available
- For systems without native MFA, implement a third-party solution (Duo, Okta, Azure AD)
- For truly legacy systems that can't support MFA, document compensating controls
Step 3: Use Strong MFA Methods
Not all MFA is equal. In order of security:
- 1Hardware security keys (YubiKey) — strongest
- 2Authenticator apps (Microsoft Authenticator, Google Authenticator) — strong
- 3Push notifications — good, but vulnerable to fatigue attacks
- 4SMS codes — better than nothing, but vulnerable to SIM swapping
Insurers increasingly specify that SMS-only MFA is insufficient. Use authenticator apps at minimum.
Step 4: Eliminate Exceptions
This is where most organizations fail. Common exceptions to eliminate:
- Executive accounts ("the CEO doesn't want to be bothered")
- Service accounts ("it's just a system account")
- Legacy systems ("it doesn't support MFA")
- Temporary access ("they're only here for a week")
Every exception is a potential claim denial.
Step 5: Document and Monitor
Maintain records showing:
- MFA is enabled on all systems (screenshots, admin console reports)
- All users have enrolled (no exceptions)
- MFA enforcement policies are active (not just available but required)
- Regular reviews confirm continued compliance
What to Do If You've Been Denied
If your claim has already been denied due to MFA gaps:
- 1Review the denial letter carefully — understand the specific basis for denial
- 2Consult an attorney — insurance denial appeals have legal nuances
- 3Document your current MFA deployment — show what's in place now
- 4Request reconsideration — some insurers will reconsider with additional evidence
- 5File a complaint with your state insurance commissioner if you believe the denial is unjust
Prevention Is Everything
The lesson from these denial stories is clear: implement MFA everywhere, maintain it consistently, and document it thoroughly. The cost of implementing MFA across a small business is typically under $500 per year. The cost of a denied claim can be millions.
Don't let a simple security control be the reason your business can't recover from a cyberattack. Enable MFA today, verify it tomorrow, and document it for your insurer.