RC4 Kerberos and Cyber Insurance: What Underwriters May Ask For

Cyber insurance applications and renewal questionnaires vary by carrier and policy. This post covers what a carrier might ask about legacy Kerberos encryption (RC4) and what evidence would answer it. Ask your broker what your carrier expects.

This post explains why a carrier might ask about RC4, what such a question would try to establish, and what evidence can answer it. Microsoft’s April 14, 2026 update has passed, and so has the date Microsoft scheduled for its enforcement phase, July 2026. At renewal, what matters is the state your environment is in today. This post does not claim that any carrier asks about RC4. Your broker can tell you.

Why Carriers May Ask About RC4

RC4 is a legacy encryption algorithm that Microsoft’s Kerberos implementation has used for decades. Microsoft’s documentation describes RC4 as insecure and says its use as a default can be abused for Kerberoasting, an attack in which an attacker captures service tickets and cracks them offline to steal credentials.

Carriers differ in which controls they ask about at underwriting and renewal. This post has no source showing that a carrier asks about RC4 specifically, so ask your broker what yours expects.

Microsoft published a public timeline in three phases: audit events from January 13, 2026, default restrictions with the April 2026 updates, and an enforcement phase scheduled for July 2026 (Microsoft, CVE-2026-20833). the April 14 post explains each phase.

Why Documentation Matters on Claims

If a renewal application describes the environment as hardened and a later investigation finds RC4 Kerberos in use, an inaccurate answer on an application can be challenged later. Coverage outcomes depend on the policy language and the carrier. Your broker and counsel can tell you how your policy treats application statements.

Policy terms differ. Some policies may tie coverage to specific controls. If you do not know whether yours does, ask your broker before renewal.

Evidence Worth Having Ready

Questionnaire items vary by carrier, and this post has no carrier’s actual list. A record kept as the work is done would show:

• which accounts and devices depended on RC4
• what was remediated, and when
• what still needs RC4, and why
• dated, per-account records made as the work was done

A statement of belief is different from a dated record of account-by-account status. Carriers differ on what they accept, so ask your broker what your carrier expects.

What This Means Now

Microsoft’s milestones have passed. For a renewal today, what matters is current state: which accounts and devices depended on RC4, which were remediated, and which still need RC4 for a specific reason.

A dated record of that state is useful in the renewal file. Where legacy systems prevented full enforcement, document the dependency, the reason RC4 is still configured, and any compensating controls around it. That is a more complete answer than a general statement that the environment is hardened.

Sources

• Microsoft: Managing Kerberos KDC usage of RC4 (CVE-2026-20833)
• Microsoft TechCommunity: Phase 2 of Kerberos RC4 hardening (April 2026)
• Microsoft Learn: Detect and Remediate RC4 Usage in Kerberos
• MITRE ATT&CK T1558.003 Kerberoasting