At-Bay's cyber short application: what it asks about email, question by question

When a client's broker sends over an At-Bay application, the MSP usually gets the security questions to answer. This page goes through the public At-Bay Cyber Short Insurance Application, form AB-CYB-SAP, edition 06/2026, and lists what it asks that touches email, in the form's own words. It also covers what the form doesn't ask, so you don't over-prepare for questions it never raises. This describes the form. It's not insurance advice, and only At-Bay and the client's broker can say how answers are underwritten.

About the form

• Form: At-Bay Cyber Short Insurance Application, footer "AB-CYB-SAP 06/2026" on pages 2 to 11 of 11.
• Source: a public PDF on at-bay.com. The URL path contains "2023/09," but the file is the 06/2026 edition. The edition is in the footer and the file name.
• Who signs: the form's signature requirements list the applicant's Chief Executive Officer, Chief Financial Officer, Chief Security Officer, Chief Technology Officer, Chief Information Officer, Risk Manager, General Counsel, "or any functionally equivalent positions." The client signs the answers, not the MSP.

At-Bay also states at the start that it can't bind policies for companies in its restricted industries: Gambling, Adult Content or Cannabis.

The questions that involve email

Domains (Question 01). The applicant section asks for the applicant's websites or domains, and specifies that the list "should include the main website, any primary domains used for corporate email, franchise or subsidiary websites." For an MSP, this is the inventory step. Every domain the client sends mail from belongs here, including the second brand domain and the old domain that still has mailboxes.

MFA on email (Question 03).

> Does the Applicant have multi-factor authentication enforced on all email access?

Yes or No. Notice the wording: enforced and all email access. A tenant where MFA is available but not required for every user, or where legacy protocols still allow password-only access, is the kind of gap to resolve with the client before they answer. This can't be seen from DNS. It lives in the Microsoft 365 or Google Workspace tenant's settings and sign-in policies.

MFA on remote access (Question 04).

> Does the Applicant have multi-factor authentication enforced on all remote access including VPN or other remote network access?

This isn't email, but it sits right next to the email question, and the same MFA conversation usually covers both.

Inbound email security (Question 12, optional).

> Which of the following Inbound Email Security products (i.e. Secure Email Gateway (SEG)) does the Applicant use, if any?

The listed choices include No SEG in place, Appriver, Avanan, Barracuda, Darktrace, Datto, Google, Inky, Intermedia, Ironscales, Microsoft Defender for O365, Mimecast, Perception Point, Proofpoint, Vade and Other/Unknown. The form marks this question Optional. Defender for Office 365 and Google appear in the list even though they aren't gateways in the MX sense, so a client protected by Defender can answer accurately without a third-party gateway.

Related questions an MSP will be asked about

These aren't email questions, but the same person usually fills them in:

• VPN (Q05–Q07, optional): whether a VPN is used, how it's hosted, and which products, from a list.
• MSP (Q08, optional): "Does the Applicant use a Managed Service Provider (MSP)?" with a field for the MSP's name.
• Backups (Q09–Q11): Q09 asks about offline or cloud-stored backups. Q10 (optional) asks how backup copies are stored. Q11 (optional) asks whether all critical backup copies are immutable.
• EDR (Q13–Q14, optional): which EDR product, and how it's managed.

What this form doesn't ask

The 06/2026 short form has no question about SPF, DKIM or DMARC, and none about email domain authentication or DMARC enforcement. That's worth knowing in two directions:

• Don't tell a client their At-Bay application depends on DMARC. On this form, it doesn't.
• Email authentication still matters, because it limits spoofing of the client's domain. It may also come up in other carriers' forms, supplements or underwriting review, outside this form.

Where MSPs get caught out

The common problems aren't the questions themselves. It's answering them from memory:

• A forgotten domain on Q01. An acquired brand, or a domain kept only for a few mailboxes, gets left off.
• "Yes" on Q03 while MFA is enforced for staff but not for a shared mailbox, a service account, or a legacy protocol someone switched back on for a scanner.
• The wrong product on Q12. "Microsoft Defender for O365" gets ticked by default. Check which Microsoft email-protection licenses and policies the tenant actually has before you answer, and pick Other/Unknown if you can't confirm it.

How an MSP can prepare the answers

1. List every email domain for Q01: domains with MX records, plus any domain that appears in a From: address.
2. Verify MFA enforcement in the tenant for every user, and check that legacy or basic authentication paths are closed. Keep screenshots or exports in case the broker asks.
3. Identify the inbound email security product for Q12. If filtering is Defender for Office 365, it won't show in public MX records. Confirm it in the tenant.
4. Hand the client a short written summary of the controls in place, with dates, so the person signing can answer accurately.

Map the client's email controls

Run the free insurance email controls check →

It maps public DNS to common application email questions (DMARC, SPF, DKIM, inbound filtering) and labels each one Verified, Unknown or Not tested, with an evidence line you can paste. MFA and backups can't be seen from DNS, so they stay Not tested. That covers At-Bay's Q03 too. It's not insurance advice.

Founding Partner: $1,999, one time. Turn insurance renewals into a reason to review every client's email security, with branded reports and the Policy library. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →