Marsh McLennan — controls joined to claims (2023, 2025)
Two reports from marsh-mclennan's Cyber Risk Intelligence Center: Using data to prioritize cybersecurity investments (6 April 2023) and Cybersecurity signals: Connecting controls and incident outcomes (27 August 2025; Scott Stransky, Tom Reagan). Found by the research pass for growth edge 1; read from the two press releases, because the full reports sit behind a registration wall at info.marsh.com. What is on this page is therefore the headline numbers, not the tables.
The design the edge asked for
Marsh is a broker: it holds the Cybersecurity Self-Assessment questionnaire an applicant fills in to get cover, and it sees the claims that follow. The reports join the two and compute a "signal strength" for each of the twelve control categories insurers commonly require — i.e. a holder of the control variable who also observes the outcome, sampled before the incident. That is the cohort design breach-forecasting and compliant-but-not-secure could not reach, because the variable they lacked is exactly the one a broker collects.
The numbers
2023: organisations using automated hardening were "nearly six times less likely" to have an incident; patching high-severity vulnerabilities within seven days halved likelihood but only 24% of respondents did it; broadly implemented MFA gave a 1.4× reduction; EDR and privileged access management ranked in the top five without a published multiplier. The release notes that the three controls insurers most often require (EDR, MFA, PAM) are not the three the data ranks highest.
2025: EDR, logging and monitoring, and awareness training/phishing testing rank top three; incident response planning fourth, with organisations running regular tabletop exercises 13% less likely to suffer a material event; each 25-point increase in EDR coverage correlated with a further 10% fall in breach likelihood; phishing-resistant MFA 9% lower than standard MFA.
What it does and does not settle
It is the first source in this spoke where a control variable and an outcome are held by the same party on the same population, and the first with a denominator — every applicant, not only the breached. Three things bound it. The variable is a control, not a compliance status: the questionnaire asks what you do, not whether an assessor certified it, so edge 1's literal question (does certification correlate) is still open and this answers the better question underneath it. Self-reported inputs: the questionnaire is filled in by the applicant. No N, no period, no method in the public text, and the phrase used is correlation; the effect sizes should be read as ranks with rough magnitudes until the gated report is held. Registration-walled primary, so this page carries the item the hub's encyclopedia entry is not the primary text rule warns about, and says so.
Tier T2 — industry research from a party with the data and a commercial interest in the finding (cover is priced on these controls); named authors, stated method, gated tables.
Related
marsh-mclennan · breach-forecasting · compliant-but-not-secure · strisk · us-breach-dataset-compliance · posture-based-incident-forecasting