A new report from Triple-I and Fenix24 finds that insurers have strengthened key controls, but important gaps remain in ransomware recovery, patch management, and defenses against business email compromise.