# Best Endpoint Security for Insurance Agencies (November 2026) *What NYDFS Part 500 requires at each agency size.* > How New York's cybersecurity regulation sorts insurance agencies and brokers into three tiers, what each tier's endpoint obligation is, why 500.14(a)(2) puts email filtering on the shopping list for agencies without the exemption, and the extortion-payment notice that ransomware can trigger. Endpoint Index research (Industry guide). Published 2026-09-25, updated 2026-10-09, data as of 2026-11-01. Source: https://endpointindex.com/research/endpoint-security-insurance-agencies-nydfs/ ## Executive summary **A New York insurance agency should work out its Part 500 tier before buying anything, because the tier decides what the regulation asks of its computers: an agency with the limited exemption must still use multi-factor authentication and has a practical reason to run centrally managed malware protection, an agency without it must have malware controls that also filter email and web traffic, and only a Class A company is told to run EDR, unless its CISO approves equivalent controls in writing.** The middle tier is the one agencies under-buy. Section 500.14(a)(2) of [23 NYCRR](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.14) asks for "risk-based controls designed to protect against malicious code, including those that monitor and filter web traffic and electronic mail to block malicious content." Endpoint antivirus alone does not filter email. Our records (17 products, vendor-checked 2026-11-01) show 8 with EDR, while only 2 include email security and 6 more sell it as an add-on to the endpoint agent. Every covered agency, exempt or not, must notify the Department of Financial Services within 72 hours of determining that a cybersecurity incident has occurred, and within 24 hours of paying a ransom ([500.17](https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101)). *This is general information, not legal advice.* ## What does NYDFS Part 500 require at each tier? | Tier | Test | Endpoint obligation | What to buy | |---|---|---|---| | Limited exemption | Any one of: fewer than 20 employees and independent contractors; under $7.5 million gross annual revenue in each of the last three fiscal years; under $15 million year-end total assets (500.19(a)) | Exempt from 500.14(a)(1), (a)(2) and (b); the risk assessment still applies | Centrally managed endpoint protection, plus MFA as 500.12 requires | | Covered, not exempt | Licensed by DFS and over every exemption threshold | Monitor authorised users' activity (500.14(a)(1)) and protect against malicious code, including web and email filtering (500.14(a)(2)) | Endpoint protection with email security, EDR preferred | | Class A | At least $20 million gross annual revenue in each of the last two fiscal years, plus over 2,000 employees or over $1 billion revenue (500.1) | EDR to monitor anomalous activity including lateral movement, and centralised logging and alerting, unless the CISO approves equivalent controls in writing (500.14(b)) | EDR feeding a SIEM | Each exemption test brings in affiliates as well as the agency itself, so a small agency inside a larger group may not be as small as it looks. ## What does the NYDFS limited exemption cover? [500.19(a)](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.19) exempts qualifying agencies from sections 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16. That is a long list, and it is easy to read it as "nothing applies". It is not. An exempt agency still runs a cybersecurity programme and a risk assessment, still files its annual certification or acknowledgment by 15 April, still reports incidents within 72 hours, and under [500.12](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.12) still uses MFA for remote access to its systems, for remote access to third-party applications holding nonpublic information, and for all privileged accounts other than service accounts that prohibit interactive login. For an exempt agency, endpoint protection is not named, but a risk assessment that leaves client policy data on unprotected PCs is hard to defend. The sensible buy is cheap, tested and centrally managed: Microsoft Defender for Business ($36.00 per user per year) or Bitdefender GravityZone Business Security ($38.50 per endpoint per year), both with current lab results on their product pages. The [small-business cost report](/research/small-business-endpoint-security-cost-2026/) sets their prices against the rest of the market. A sole agent working under an agency's or carrier's cybersecurity programme may not need a separate programme at all (500.19(b)). ## Why do agencies without the exemption need email filtering? This table is limited to products that include email security or sell it as an add-on to the same console, because 500.14(a)(2) names email filtering and most agencies' malicious code arrives by email. It also shows which of them record activity (EDR, useful for 500.14(a)(1)) and which include a 24/7 team.
ProductEmail securityEDR24/7 managed response
Bitdefender GravityZone Business SecurityAdd-onNot offeredNot offered
ESET PROTECT CoreAdd-onNot offeredNot offered
Bitdefender GravityZone Business Security PremiumAdd-onNot offeredNot offered
Acronis Cyber ProtectAdd-onNot offeredNot offered
ThreatDown EliteAdd-onIncludedIncluded
ThreatDown AdvancedAdd-onIncludedNot offered
Cynet All-in-OneIncludedIncludedIncluded
Trend Micro Worry-Free Services AdvancedIncludedNot offeredNot offered
From each vendor's product and pricing pages. "Add-on" means available at extra cost. Follow a product link for sources and verification dates.
An agency on Microsoft 365 can address the email part through Microsoft's own mail filtering instead, and pair it with any endpoint product. What matters for the examiner is that both controls exist and are documented. ## What does Class A status add for an agency? Class A thresholds are high enough that few independent agencies reach them. A Class A company needs EDR plus centralised logging and alerting, unless its CISO approves equivalent controls in writing. See [EDR products with SIEM integration](/research/best-edr-siem-integration-small-business/) for which products feed which log platforms. ## What must an agency do within 24 hours of paying a ransom? If an agency pays an extortion demand, 500.17(c) requires notice to DFS within 24 hours of the payment and a written explanation within 30 days, including the alternatives considered. Ransomware rollback, where a product includes it, is one of those alternatives, and so are tested backups. Being able to say "we could restore without paying" is the better position. ## What should each agency buy? **Sole agent or two-person agency.** Check 500.19(b) first. If you still need your own programme, one centrally managed endpoint product plus MFA on email and carrier portals can address the risk assessment's obvious findings. **Agency of 10 to 19 people.** Exempt on headcount. Buy a low-cost managed product, turn on MFA for privileged accounts, and document both in the risk assessment you must still keep. **Agency of 20 to 60 people, over the revenue test.** Not exempt. Buy endpoint protection with email filtering from the table above, or pair Microsoft's email filtering with your endpoint product, and prefer EDR for the activity-monitoring duty. ## What endpoint security mistakes do insurance agencies make? - **Treating the limited exemption as a full exemption.** MFA, incident notice and the annual filing remain. - **Measuring size without affiliates.** The exemption tests count affiliates too. - **Buying endpoint protection with no email filtering** when not exempt, then struggling to show 500.14(a)(2)'s email control. - **Paying a ransom without the 24-hour notice.** The clock runs from the payment, not the incident. ## Frequently asked questions ### Does Part 500 cover independent insurance agents? Agents and brokers licensed by DFS are covered entities. An agent covered by the cybersecurity programme of their agency or carrier need not build a separate one (500.19(b)). ### Must a small agency run EDR under NYDFS? Only Class A companies must (500.14(b)). A non-exempt agency must monitor authorised users' activity and protect against malicious code, and EDR is one practical tool for both; an exempt agency has neither duty. ### What are the limited exemption thresholds? Fewer than 20 employees and independent contractors, or under $7.5 million gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets, each including affiliates (500.19(a)). ### What must an agency tell DFS after paying a ransom? Notice within 24 hours of the payment, and within 30 days a written description of why payment was necessary, and the alternatives to payment that were considered (500.17(c)). ## Methodology and caveats Sections 500.1, 500.12, 500.14, 500.17 and 500.19 of 23 NYCRR were checked word for word against the Department of Financial Services' text of the Second Amendment on 9 October 2026. The capability table's eight products were selected because each lists email security as included or as an add-on in the Endpoint Index database; other values come from the same database with vendor sources and dates. Your agency's status under Part 500 is a legal question for counsel or DFS. This guide covers what to buy once you know it. ## Sources 1. New York State Department of Financial Services. [Second Amendment to 23 NYCRR Part 500, adopted text](https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101) (effective 1 November 2023): sections 500.1, 500.12, 500.14, 500.17 and 500.19. Checked 9 October 2026. 2. Legal Information Institute. [23 NYCRR 500.14, Monitoring and training](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.14), a convenience copy of each section. Checked 30 September 2026. 3. New York State Department of Financial Services. [Cybersecurity resource center](https://www.dfs.ny.gov/industry_guidance/cybersecurity). 4. Endpoint Index records for the eight email-capable products and the two low-cost options named (2026-11-01).