Coverage-vs-Controls Heatmap
Security teams and insurance buyers argue over different lists. They are mostly the same list. This heatmap shows each control’s effect on both breach risk and insurability/premium, so you can prioritise the controls that pay off twice. Tick what you have in place to see your double-impact gaps. Directional, illustrative model — not carrier-specific ratings, not insurance advice.
| Control | Breach risk ↓ | Insurability ↑ | In place? |
|---|---|---|---|
| MFA everywhere (email, remote, privileged) Both a top breach-preventer and a near-universal bind requirement. | High | High | |
| EDR / MDR on endpoints & servers Strongly correlated with stopping ransomware; often a hard underwriting gate. | High | High | |
| Tested, immutable/offline backups Decides recoverability and is a core underwriting question. | High | High | |
| Fast critical-vuln patching Cuts exploited-vuln risk; a surcharge driver if slow. | High | Med | |
| No internet-exposed RDP/DB A classic entry point and a common auto-decline trigger. | High | High | |
| Privileged access management / least privilege Limits blast radius; priced in by underwriters. | High | Med | |
| Advanced email filtering / anti-phishing Reduces BEC/malware delivery frequency. | Med | Med | |
| Security-awareness training + phishing sims Human-layer frequency reduction; a surcharge driver if absent. | Med | Med | |
| Network segmentation Reduces loss severity by containing lateral movement. | High | Med | |
| Logging / SIEM with retention Speeds containment and lowers forensic cost. | Med | Med | |
| Tested incident response plan Lowers claim severity; favoured in underwriting. | Med | Med | |
| Third-party / vendor risk management Addresses dependent-vendor exposure, a growing loss driver. | Med | Med |
These reduce breach risk and unlock insurability at once — fix them first: MFA everywhere, EDR / MDR on endpoints & servers, Tested, immutable/offline backups, No internet-exposed RDP/DB.
What this heatmap shows
- One view of each security control’s effect on BOTH breach risk and insurability/premium — because the two lists are mostly the same list.
- Tick what you have in place and the heatmap surfaces your "double-impact gaps": high/high controls that cut risk and unlock cover at once.
- Directional, illustrative ratings to prioritise spend — not carrier-specific scoring.
- Educational, not insurance advice. Everything runs in your browser.
Why this matters
Security and insurance are usually run as separate programs with separate checklists, competing for the same budget. But the modern underwriting gate and the modern breach-prevention list have converged: the insurer is, in effect, pricing your control posture. Seeing both effects on one grid turns "harden the environment" and "get insurable" into a single, prioritised plan.
Fix the double-impact gaps first and every dollar works twice. The ratings are directional, not carrier-specific, and this is not insurance advice — use it to sequence investment, then confirm specifics with your broker.
Frequently asked questions
Do the same controls that reduce breach risk also lower cyber-insurance premiums?
Largely yes, and that is the useful insight. The controls underwriters now gate and price on — MFA everywhere, EDR/MDR, tested immutable backups, no internet-exposed RDP, fast patching, least privilege, segmentation — are the same controls that actually prevent and contain incidents. So investment in them pays off twice: lower real risk and better insurability/terms. This heatmap lines the two effects up side by side so you can prioritise the controls that do both, rather than treating "security hardening" and "getting insurable" as separate projects competing for budget.
What is a "double-impact" control?
A control rated high on both axes — it materially reduces breach likelihood or severity AND strongly affects whether you can get cover and at what price. MFA, EDR, tested backups and closing exposed RDP are the clearest examples: each is both a leading incident-preventer and a common underwriting gate. If one of these is missing, you are carrying more real risk and are harder (or impossible) to insure — which is why the tool flags missing double-impact controls as the first things to fix.
Are these ratings specific to my insurer?
No. They are directional, illustrative ratings meant to help you prioritise, not carrier-specific factors. Real underwriting weightings vary by insurer, sector and year, and your actual premium depends on many things this does not model. Use the heatmap to decide where to invest first; confirm the specifics with your broker, and pair it with the application simulator to see which gaps are outright decline triggers.
How should I use this with a limited budget?
Start with the high/high gaps the tool flags — they buy you the most risk reduction and insurability per dollar. Then work the high-security / medium-insurance controls (segmentation, PAM, fast patching) for the risk benefit, and the medium/medium controls (awareness training, email filtering, logging) to clean up surcharge drivers. The point is to sequence by double impact rather than by whichever audit shouted loudest.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.