Pulse · MFA Analysis for cyber insurance · Live
The MFA analysis insurers ask for after a breach. Before it.
After an incident, one of the first things an insurer asks for is an MFA analysis. Pulse runs it before the policy is bound, read-only from Microsoft 365, and keeps running it through the term.
What it checks
Seven questions behind one “Yes.”
The application asks whether MFA is enforced. MFA Analysis answers the questions an underwriter would ask before binding, and a claims team would ask after an incident.
| The question | What Pulse verifies | Verified answer | Insurance impact |
|---|---|---|---|
| Is everyone enrolled?Registration | Which users have MFA set up, and which methods they use, from phishing-resistant keys to text messages. | 4 of 25 users have no MFA method registered. | Likely subjectivity: enroll the remaining users before binding. |
| Is it actually required?Enforcement | Whether a policy requires MFA for each user, or whether it only exists on paper. | MFA policy is in report-only mode, so it is not enforced. | A “Yes” on the application would be inaccurate, a misrepresentation risk at claim time. |
| Who is left out?Named exclusions | Every account excluded from MFA, by name, and the policy that excludes it. | 3 accounts excluded, including an admin. | Likely subjectivity: list each exclusion and explain why it is needed. |
| Are admins protected?Privileged access | How many Global Admins there are, whether each is covered, and with what method. | 9 permanent Global Admins, 2 using text-message codes. | Admin MFA is a common condition of coverage; text-message codes may be questioned. |
| Did MFA really happen?Real sign-ins | Who signed in with a password alone in the last 30 days, not just what the settings say. | 6 users signed in with a password alone last month. | Shows MFA happened in practice, the first thing checked after an incident. |
| Is there a way around it?Legacy sign-in | Whether old protocols that skip MFA are blocked, and whether anyone still uses them. | Legacy sign-in allowed; 1 mailbox still uses it. | A way around MFA that can undermine a “Yes” when a claim is reviewed. |
| Who outside the company can get in?Third-party access | Whether guests and vendor accounts are covered by MFA, whether the tenant trusts other companies' MFA, and which apps hold standing access that never uses MFA. | A vendor guest account with no MFA; 2 apps can read every mailbox. | Vendor and app access is a common breach path underwriters ask about. |
Illustrative example based on common findings, not a real client.
From the field
"Occasionally, an applicant says they have MFA on all their devices, and at the time of the claim we find out some of them didn't. That can lead to misrepresentation, and sometimes a denial of coverage."
Emmanuel Tunda — Cyber Claims Professional
For each reader
Same findings. What they mean for you.
Every report includes the likely underwriter subjectivities: what a carrier may ask the business to fix or confirm before offering terms. Each version shows what that means for the person reading it.
| MSP | A fix list your engineers can work through for each client, and a renewal evidence pack to hand each client before their policy renews. |
|---|---|
| Broker | What could slow or block the placement, and what to fix before you submit. |
| Organization | What to fix to get or keep coverage, before a wrong “Yes” reduces or voids a claim. |
| Underwriter | Conditions to attach before binding, backed by evidence instead of a checkbox. |
How it works
Minutes to connect. Nothing changes in your tenant.
- 01
Connect
A Microsoft 365 admin signs in and approves read-only access. Pulse never changes a setting.
- 02
Analyze
Pulse reads MFA configuration and the last 30 days of sign-in activity, and scores each finding against CIS Controls 5 and 6.
- 03
Share
Get the report for your role, and share a copy with your broker or insurer through a private link.
See a live MFA Analysis report.
Leave your work email and we will walk you through a real report from a test company, from the view of your choice: MSP, broker, organization or underwriter.
We'll only use this to set up the walkthrough.