In our first article on cyber insurance readiness, you learned what insurance companies require. Now it’s time to find the security problems hiding in your own systems before insurance companies or hackers discover them.
Most security gaps don’t happen because you ignored security completely. They happen through drift. Someone leaves the company, but their account stays active. Software stops updating but keeps showing “protected” in the dashboard. Backups run successfully, but no one tests if they actually work. These issues sit in plain sight until an insurance audit or an attacker exposes them.
This guide shows you where to look inside your business systems and how to fix what you find quickly.
Identity and Access: Where Problems Multiply
User accounts create the most security drift. You add people constantly, but rarely clean up when someone leaves or their job changes. Start here, as these are usually the fastest problems to find and fix.
Stale Admin Accounts
Former employees, old contractors, and forgotten test accounts often keep admin access months after they should have been deleted. Each one gives attackers a potential way into your systems.
What to do: Export all administrator accounts and compare them to your current employee and contractor lists. Delete accounts for anyone who left. Downgrade people who no longer need admin access. For generic accounts like “admin” or “webmaster,” either delete them or assign them to a specific person with two-step login enforced.
Shared Credentials
Beyond individual stale accounts, many businesses have a more fundamental problem: “We all use the admin account” creates serious problems. Shared logins make it impossible to track who did what, and they usually skip two-step login because sharing codes is inconvenient.
What to do: Create individual accounts for everyone who needs admin access and turn on two-step login for all admins. Delete shared accounts. If you absolutely need a shared emergency account, keep it in a password manager that requires two-step login. Check your login records for accounts showing up in different cities at the same time. That’s a sign of sharing.
Temporary Exceptions That Never Ended
Even when you’ve cleaned up accounts properly, exceptions create new holes. “Just for this project” or “until we fix the real problem” often means an exception stays in place for months or years. These might be two-step login exceptions, extra permissions, or special access rules that should have been temporary.
How to find them: Review your security rules for exceptions. Check your notes or documentation for anything marked “temporary.” Look at accounts with permissions that don’t match what their job actually needs.
How to fix it fast: Put quarterly calendar reminders to review all exceptions. Either make the exception permanent with proper documentation and approval, or remove it. Don’t let quick fixes become permanent security holes.
Endpoints and Patching: Silent Coverage Gaps
Once your access controls are clean, turn your attention to the security software protecting your devices. Security software only protects you if it’s actually running and up to date. Many businesses discover during audits that their protection has quiet gaps.
Antivirus That Stopped Working
Security software sometimes stops reporting, loses connection, or fails quietly. Your dashboard might show a device as “protected” even though the software hasn’t checked in for weeks or the virus definitions are months old.
What to do: Review your security console for devices that haven’t reported in over 7 days or have virus definitions older than 72 hours. Prioritize devices with admin access or sensitive data. Reinstall or repair software on devices that stopped reporting. Remove retired equipment from your console. Set up automatic alerts for devices that go offline or miss updates.
Critical Patches Delayed
Security software that’s running is only half the battle. Your systems also need current patches. “We’ll patch during next month’s maintenance window” works fine for minor updates. It’s dangerous for critical security patches, especially for problems hackers are actively exploiting. Insurance companies want proof that you install critical patches within 30 days.
How to find it: Run a security scan or check your update management system for missing critical updates. Sort by severity and age. Pay special attention to anything marked “actively exploited” or that can spread automatically. Check your servers first, then workstations.
How to fix it fast: Create an emergency update process for critical security fixes that lets you skip your normal maintenance schedule. Update internet-facing systems first: email, website, VPN. Write down that you patched within 30 days for your insurance records. For systems you can’t patch right away, document what other protections you added, like isolating the system or adding extra monitoring.
End-of-Life Software Still Running
Some systems can’t be patched at all because they’re too old. Operating systems and programs that no longer get security updates create a risk that keeps growing. Old versions of Windows Server, SQL Server, WordPress, and similar software won’t get fixes for new security problems.
How to find it: Make a list of your operating systems, database versions, and critical programs. Check manufacturer websites for end-of-support dates. Look for anything past its end date or ending in the next 12 months.
How to fix it fast: Create a plan with specific dates to replace each end-of-life system. If you can’t migrate immediately, disconnect the system from the internet and limit access. Write down your plan and timeline for insurance purposes. Budget for replacement or upgrades now, not when you’re forced to migrate during a crisis.
Backups: Showing Success But Untested
With your systems secured and patched, verify your last line of defense actually works. Backup jobs that show “success” don’t prove you can actually restore your data. Most businesses learn their backups don’t work during a ransomware attack when it’s too late.
No Test Restore Records
If you can’t prove you tested a restore in the past 90 days, insurance companies assume your backups won’t work. Even if you test sometimes, without written proof, it doesn’t happen.
What to do: If you don’t have documented test restore records from the past 90 days, test one right now. Create a simple form: date, who did it, what was tested, results, restore time, and problems found. Put quarterly test restores on your calendar and keep documentation where your insurance broker can find it. Our website hosting plans include backup testing protocols.
Backups on the Same Network
Testing proves your backups work technically, but location determines whether ransomware can reach them. Keeping all your backup copies on the same network as your main systems means ransomware can encrypt everything at once. Your backups need to be somewhere the ransomware can’t reach.
How to find it: Map where your backup copies are stored. Check if they’re on the same network as your main systems. Look for terms like “network attached storage,” “mapped drive,” or “SAN,” which might indicate vulnerable locations. Make sure your “offsite” or “cloud” backups actually store data separately, not just copy to another drive on the same network.
How to fix it fast: Add protected cloud storage or offline backup copies immediately. Use cloud services that prevent deletion or changes for a set time period. For local backups, keep copies on removable drives that you physically disconnect when not backing up. Use separate login credentials for your backups that aren’t connected to your main admin accounts.
Unknown Recovery Objectives
Finally, even perfect backups need to match your actual business needs. If you don’t know how much data loss you can handle (RPO) or how long you can be offline (RTO), you can’t prove your backup plan meets your business needs.
What to do: List critical systems (email, files, accounting, customer database). For each, answer: “How long can we be offline?” and “How much data can we lose?” Write it down. Example: Email needs daily backups with same-day recovery. Accounting needs recovery within hours. Adjust your backup frequency and storage to meet these goals, then test that your actual restore times match.
Logging and Response: Can You Prove What Happened?
Your final internal check covers what happens when something goes wrong. If you can’t prove what happened during a security incident, insurance companies may fight your claim. You must keep logs long enough to investigate problems.
Logs That Disappear Too Quickly
Default settings often keep logs for only 30 days or less. But attacks often go unnoticed for months. When you discover a problem, the logs that would explain what happened are already gone.
How to find it: Check how long your key systems keep logs: email, servers, firewall, security software. Look for logs that show who did what, login attempts, and security alerts. Write down how long each system keeps these records.
How to fix it fast: Extend log retention to at least 90 days for admin actions and security events. If storage space is tight, focus on logs that show who accessed what, login attempts, and security warnings. Consider sending critical logs to a central location or cloud service that retains them longer.
Incident Response Plan Nobody’s Practiced
Logs show what happened, but your response plan determines what you do about it. A plan sitting in a drawer doesn’t work during a crisis. If no one has practiced it, nobody knows who to call, where to find emergency contacts, or what to do first.
How to find it: Look for your incident response plan. Check when it was last updated. Ask your team who would handle a ransomware attack this afternoon. If they don’t immediately know the answer, your plan hasn’t been practiced.
How to fix it fast: Schedule a 30-minute practice session within the next two weeks. Sit down with key people and walk through a scenario: “Someone in accounting clicked a link, and now we see ransom messages on multiple computers. What happens next?” Write down who does what and in what order. Update your plan based on what you learn. Do this twice a year minimum. If you’ve already been hacked, our incident response playbook shows you exactly what to do.
Taking Action This Week
You don’t need to fix everything at once. Start with the problems that create the most risk and are fastest to fix.
Day 1: Check User Accounts. Export your admin accounts and compare them to current employees. Delete or downgrade any that don’t belong. This takes an hour and closes one of the most common security gaps.
Day 2: Review Security Software. Check your security software console for devices that haven’t reported in over a week. Fix or remove them. Look for critical missing updates and install them.
Day 3: Test Your Backups. Do an actual test restore of a few files or one small system. Write down the results. This proves your backups work and gives you confidence.
Day 4: Review Exceptions and Access. Look at any temporary exceptions or special permissions that are still active. Either document them properly or remove them.
Day 5: Practice Your Response Plan. Gather your key people for 30 minutes. Walk through what happens if you get hit with ransomware today. Update your plan based on what you discover.
What Comes Next
Finding gaps in your internal systems is only part of the picture. The next article in this series focuses on your online presence and external attack surface. You’ll learn how to find problems with your email security, website, and anything else exposed to the internet before insurance companies or attackers find them.
Most of these internal problems aren’t hard to fix. They’re just easy to miss when you’re busy running your business. Spend a few hours this week working through the checklist above. Every gap you close before applying for cyber insurance saves you money and protects your business from attacks targeting these exact weaknesses.
Need Help Finding Your Gaps?
If this checklist reveals more problems than you can handle alone, or if you want an expert review of your Beacon-hosted systems before insurance companies do, we can help. At Beacon Web, we find these hidden gaps for your website and help you fix them quickly.
We’ll review your website’s user accounts, security software, backup systems, and logging to find problems before they become claim denials or real attacks. Then we’ll help you fix issues and document everything properly for insurance underwriting.
Contact us to schedule an assessment and close your security gaps before they cost you coverage or become an actual breach.