Identity controls
Check whether critical business accounts, admin roles, and high-risk users are protected with MFA that can withstand common attack pressure.
01 / Cyber insurance readiness
Prepare the security evidence insurers actually ask about.
A focused sprint for SMBs that need a clearer view of MFA, endpoint coverage, backups, awareness training, and incident response readiness before cyber insurance application or renewal pressure turns into a scramble.
From $1,5007 business daysCISSP-led
A clear distinction
This is readiness support, not an insurance promise.
Cyber insurance carriers may ask about controls like MFA, endpoint protection, backups, employee training, and incident response planning. This sprint helps you understand what is in place, what is missing, and what evidence you can reasonably prepare. It does not guarantee coverage, approval, or lower premiums.
02 / Readiness areas
What the sprint reviews
Endpoint coverage
Review whether company devices are visible, protected, and monitored well enough to rely on during an incident.
Backup resilience
Look at whether critical data could be recovered if production systems or privileged accounts were compromised.
Incident readiness
Build a simple, usable response path so the business knows who decides what first when something goes wrong.
Evidence packet
Prepare business-readable notes, screenshots, and control context that can support renewal and underwriting conversations.
Remediation roadmap
Translate findings into a prioritized action plan instead of a long report that sits untouched.
A quick fit check
Start with
your environment.
No email needed. This helps frame a conversation, not confirm a quote.
Choose your environment to see a starting point.
03 / Sprint options
The same core deliverable. The right scope.
Payment collection is intentionally handled after fit and scope are confirmed. Start with a request. The price reflects your environment's size and complexity; the scope is confirmed before work begins.
Starter Sprint
$1,500
Single location, roughly up to 25 seats. Same deliverable as every tier — the price reflects the size of the environment, not what you get back.
- Every question on your carrier's questionnaire mapped to the control that answers it
- Gaps closed where they can be closed inside the engagement
- Signed evidence pack — delivered, or we keep working at no additional cost until it is
- Prioritized remediation roadmap for anything that cannot be closed in the window
- Identity, endpoint, and backup-restore evidence for a single location
Flagship
Standard Sprint
$2,500
Multiple locations or roughly up to 75 seats. The default sprint for a firm with more than one office or a mixed environment.
- Every question on your carrier's questionnaire mapped to the control that answers it
- Gaps closed where they can be closed inside the engagement
- Signed evidence pack — delivered, or we keep working at no additional cost until it is
- Prioritized remediation roadmap for anything that cannot be closed in the window
- Everything in Starter, across multiple locations
- Security awareness and phishing readiness review
- Incident response contact path review
Expanded Sprint
$3,500
Complex environments — multiple systems, compliance pressure, or a recent incident that exposed gaps. Scoped on the fit call.
- Every question on your carrier's questionnaire mapped to the control that answers it
- Gaps closed where they can be closed inside the engagement
- Signed evidence pack — delivered, or we keep working at no additional cost until it is
- Prioritized remediation roadmap for anything that cannot be closed in the window
- Everything in Standard
- Deeper Microsoft 365 or Google Workspace review
- Policy and control evidence review
- Follow-up remediation working session
- Renewal-readiness summary for leadership
04 / From questions to evidence
How the sprint works
Scroll to follow the process, or choose a stage.
01 / Agree the scope
Fit check
Start with a short briefing to confirm timing, business size, insurance deadline, and whether the sprint is the right fit.
02 / Validate the controls
Intake
Collect the minimum useful context: identity provider, endpoint coverage, backup approach, security training, and current insurance questionnaire pressure.
03 / Work through the gaps
Readiness review
Review the controls that usually matter most for SMB underwriting and renewal conversations.
04 / Prepare the evidence
Packet and roadmap
Deliver the signed evidence pack, top risks, and the roadmap for anything left open. Delivered, or we keep working at no additional cost until it is. No scare tactics, no fake certainty.
05 / The detailed evidence guide
The 10 controls the 2026 carrier questionnaire actually scores
Most 2026 SMB cyber-insurance applications collapse to the same ten controls. Below is what carriers (Beazley, Coalition, Travelers, Chubb, and the Huntress × Acrisure program format) ask, the answer the Sprint produces from your Obsidian Ridge stack, and the gotcha that quietly disqualifies most applicants when nobody's minding the evidence side. This is the artifact the Sprint hands you.
| Control | What the carrier asks | Our answer (from your stack) | Evidence we attach | Common gotcha |
|---|---|---|---|---|
| 1. MFA everywhere | Is MFA enforced on email, remote access, admin, cloud, and backup consoles? Phishing-resistant on privileged accounts? | Microsoft 365 / Google Workspace Conditional Access enforces MFA on every user. FIDO2 / WebAuthn keys on admin and break-glass accounts. Managed ITDR, operated end-to-end by Obsidian Ridge, catches the session-token replay that follows an adversary-in-the-middle bypass on either platform, and the bypass attempt itself (EvilProxy, Tycoon) on Microsoft 365. | Conditional Access policy export, FIDO2 key inventory, ITDR alert sample from the last 90 days, named admin-account roster. | SMS-based MFA still counts as “MFA” on most checkboxes but is increasingly flagged in the “phishing-resistant” sub-question. Switch admins to FIDO2 before applying. |
| 2. EDR / MDR on every endpoint | Endpoint detection on every laptop, desktop, AND server? 24/7 SOC behind it? Stated MTTR? | Managed EDR deployed on every workstation and server with a real 24/7 SOC reading every alert. Servers covered, not just laptops. | EDR agent inventory + server-coverage attestation, SOC escalation log from the last 90 days. | Server coverage gap. Practices cover laptops with consumer AV and leave the PMS/file server bare. Carriers ask specifically about servers in 2026 questionnaires. |
| 3. Immutable backups + tested restore | Are backups encrypted, air-gapped or immutable, and was the last restore actually tested? | Your backup product keeps an immutable or offline copy behind MFA, and restore tests are logged with date, dataset, and outcome. The Sprint checks each one. | Backup-immutability attestation, last-4-quarters restore-test log with signatures. | “We back up nightly” ≠ “we restored last quarter.” Carriers want the restore test, not the backup job. Untested backups get scored as zero. |
| 4. Privileged access management | Separate admin accounts? Quarterly access reviews? Just-in-time elevation? | The Sprint checks for separate daily and admin accounts, no standing local admin rights, and a current roster of who holds admin, and documents what it finds for the evidence pack. | Admin-account roster with the MFA method on each, local-admin removal report, the date and result of the last access review. | One person doing daily work as Global Admin. Carriers flag this fast. Even single-operator practices need a daily-driver account and a separated admin account. |
| 5. Email security | SPF, DKIM, DMARC enforced? Advanced threat protection (Defender / equivalent) live? | SPF / DKIM / DMARC published and enforced at p=quarantine or stricter. Microsoft Defender for Office 365 (or Google ATP) sandbox-detonates attachments and rewrites URLs. Managed ITDR layers identity-based detection on top. | DNS export of SPF / DKIM / DMARC records, DMARC aggregate report sample, ATP policy export. | DMARC at p=none doesn't count as “enforced.” The questionnaire wants p=quarantine minimum. Most SMBs leave it at none indefinitely. |
| 6. Security Awareness Training | Annual training for all staff plus phishing simulations? Documented click-rate trend? | Managed security awareness training, operated end-to-end by Obsidian Ridge, runs continuous micro-lessons and quarterly phishing simulations. Click-rate trend exported per user, per department, per quarter. | Training completion roster (last 12 months), phishing-simulation click-rate dashboard export, repeat-clicker remediation log. | One-and-done annual training. Carriers in 2026 want a click-rate trend, not a completion checkbox. Static training without simulations gets a partial score at best. |
| 7. Incident response plan | Written IR plan tested in the last 12 months via tabletop or live exercise? | Per-client incident-response runbook aligned to NIST SP 800-61r3, reviewed every year, with a ransomware tabletop exercise every year (both included on Ridge Reserve). | IR plan document (current version), last tabletop after-action report, named escalation contacts with phone numbers (not just email). | The plan exists but lists former employees as escalation contacts. Carriers ask to see the contact list. Stale contacts get flagged. |
| 8. Patch and vulnerability management | Documented patch SLA? Priority handling for KEV-listed CVEs? Vulnerability scan cadence? | The Sprint checks for a written patch standard with a critical-patch deadline in days and a process for CISA KEV listings, compares it with a current patch report by host, and documents the gaps. | Patch-policy document, last 30-day patch-compliance report by host, KEV-response log (CVE → patch deployed time). | “Auto-update is on” doesn't survive the audit question. Carriers want a written SLA with named exceptions and a KEV process. |
| 9. Network segmentation + no exposed services | Internal network segmented from guest, IoT, and OT? RDP / SMB exposed to the internet? Public-facing services inventoried? | Segmentation review during onboarding: guest Wi-Fi VLAN-isolated, no inbound RDP (require ZTNA / VPN), public-facing services inventoried via external attack-surface scan during the Sprint. | External attack-surface scan results, RDP/SMB exposure attestation, network-segmentation diagram. | RDP open to the internet on a non-standard port. Carriers run their own external scan during underwriting. Hiding the port doesn't work. |
| 10. Vendor / sub-processor management | List of critical vendors? SOC 2 review on each? Breach-notification clause in contracts? | The Sprint checks for a list of every vendor that touches client data, with each one's SOC 2 status and breach-notification terms, and documents what is missing. | Sub-processor inventory (with SOC 2 report dates), reviewed DPA samples, vendor-incident log if any in the last 12 months. | The practice management software vendor isn't on the list because “it's not IT.” If it touches client data, it's on the list. Missing vendors get scored as unmanaged risk. |
The threshold-killing trifecta — missing MFA on admins, missing EDR on servers, and untested backups — gets called out specifically by major reinsurers in their 2026 underwriting guidance as auto-decline signals. The Sprint closes those three before everything else. Not sure what a ransomware week actually costs? Model the range.
Two more questions on current forms
They sit outside the ten above. The Sprint checks both.
| Control | What the carrier asks | Our answer (from your stack) | Evidence we attach | Common gotcha |
|---|---|---|---|---|
| Payment call-back rule | When a vendor asks to change its bank details, do you confirm it by a different channel than the request came in on? At what dollar amount? | A written call-back rule: every payment or bank-detail change is confirmed on a number already on file, at any amount, and the people who move money are trained on it. If there is no written rule, the Sprint writes one with you. | The signed procedure, the staff training record, and the verification log. | A dollar floor. Coalition asks about requests over $25,000, but Beazley and Corvus set no floor, so “we verify anything over $X” fails their question. |
| End-of-life software | Any end-of-life software on the network? If so, is it reachable from the internet, and is extended support paid for? | An inventory showing every operating system and major application is still supported by its vendor. Anything that is not is kept off the internet and walled off, or covered by paid extended support. | Operating-system and application inventory with support status; extended-support receipts. | “We know about it” is not an answer. Fusion and At-Bay both ask the follow-ups: is it reachable from the internet, and is extended support paid for. |
Free worksheet
Score yourself before an underwriter does.
A companion ten-control worksheet, including funds-transfer verification, with carrier questions, answer guidance, and notes for 12 SMB verticals. Its scope differs from the evidence guide above; use your own carrier's current application as the final reference.
06 / Related paths
If the readiness sprint isn't the right fit, one of these usually is.
Three pages on this site cover adjacent ground. Pick the one that matches what you actually need — we'd rather route you to the right page than have you book a sprint that doesn't fit.
Cyber Insurance Readiness Sprint
(you are here)
Consulting work that prepares your security evidence packet for whichever carrier you can apply to. Right answer when you have an application or renewal coming up and need a clean baseline first.
- Carrier-neutral — works for any insurer
- Right for under-50-employee SMBs and most professional practices
- Fixed-fee, time-boxed engagement
Huntress × Acrisure Cyber Insurance Program
An actual primary cyber insurance path with a $0 deductible described for eligible applicants in the public program materials, placed by Acrisure and underwritten at launch by Dual North America. Available to applicants with qualifying Huntress Managed EDR + ITDR, subject to underwriting review, state availability, and policy terms.
- $0 deductible on covered losses
- 50–2,500 employees, sub-$100M revenue (Huntress-published target)
- Qualifying Managed EDR + ITDR required; eligibility confirmed by Acrisure
- Statement-of-Fact application, not a 40-page questionnaire
Multi-Vendor Managed Security
We operate the security stack you already have — CrowdStrike, SentinelOne, Microsoft Defender, Zscaler, Wiz, Rapid7, Tenable, Abnormal, Proofpoint, and more. Right when you've already invested in a tool and want it run correctly.
- Vendor-neutral operator (CCFH on CrowdStrike, ZDTA on Zscaler)
- No rip-and-replace, no swap commission
- Per-environment scoping — one accountable lead
07 / Questions, answered
Questions before you request a sprint
Does this guarantee a lower cyber insurance premium?
No. Obsidian Ridge does not guarantee insurance approval, premium reductions, or underwriting outcomes. The sprint helps identify, improve, and document security controls that are commonly reviewed during insurance conversations.
Who is this sprint for?
It is built for small and mid-sized businesses that need clearer security evidence before a cyber insurance application, renewal, customer questionnaire, or compliance review.
What if we already have an IT provider?
That is common. The sprint can work alongside an IT provider by clarifying security gaps, evidence needs, and practical remediation priorities.
Is this a full compliance audit?
No. It is a focused readiness sprint. If the work uncovers deeper SOC 2, HIPAA, PCI-DSS, or ISO 27001 needs, those should be scoped separately.
Can this lead into managed security?
Yes.
If the sprint shows that ongoing monitoring, identity protection, awareness training, or SIEM coverage is needed, the next step is typically a managed security engagement — either the single-platform lane operated end-to-end by Obsidian Ridge (greenfield, eligible for the $0-deductible Huntress × Acrisure cyber insurance program at 50+ employees) or the multi-vendor lane (operating an existing stack like CrowdStrike, SentinelOne, Defender, Zscaler).
How does this differ from the Huntress × Acrisure cyber insurance program?
Different intent and different audience. The Huntress × Acrisure program is an actual primary cyber insurance policy with a $0 deductible, available only to organizations running Huntress Managed EDR + ITDR (mid-market: 50–2,500 employees).
The Cyber Insurance Readiness Sprint is consulting work that prepares the evidence packet for whichever carrier you can apply to — including the Huntress × Acrisure program if you qualify, or any traditional carrier if you don't.
Most under-50-employee buyers land here, not on the program page.
Not sure where you stand?
Start with the assessment, then request the sprint if the gaps are real.
The assessment gives you a fast posture snapshot. The sprint turns that snapshot into evidence, priorities, and a practical readiness plan.