Rethinking cyber insurance questions to find real risk

This article argues that traditional compliance-based cyber insurance questionnaires miss real operational risk and recommends asking exception-focused questions instead—such as where passwords are weak, which systems remain unpatched and why, where customer data is stored unencrypted, and what MFA gaps exist (including break-glass paths)—to elicit transparency, understand compensating controls, and improve underwriting accuracy and cyber resilience.