Penetration Testing for Cyber Insurance

Why insurers started asking

Cyber claims rose sharply and underwriters responded by pricing on controls rather than on turnover alone. Renewal questionnaires now ask detailed questions about multi-factor authentication, backups, patching timeframes and independent security testing.

That is broadly good news for organisations that have done the work, because it means the controls are worth something commercially rather than just being a cost.

What underwriters look for

• Independent testing rather than self-assessment.
• An accredited provider. CREST accreditation gives an underwriter a recognised standard to assess against, rather than taking a provider's word for the quality of the work.
• Recency, usually within twelve months.
• Evidence findings were addressed. A report with open critical findings can be worse than none — you have documented a known unremediated weakness.

Cyber Essentials frequently appears in the same questionnaire, and some UK insurers include automatic cover for smaller organisations that hold it. If you are answering these questions anyway, it is usually the cheaper thing to get first.

The part that matters at claim time

Be accurate. Insurance operates on the information you provide, and a renewal questionnaire answered optimistically is a problem waiting for the worst possible moment. If you state that you conduct annual penetration testing and a claim investigation finds a single scan from three years ago, that is a materially worse position than having answered honestly in the first place.

The same applies to scope. "We penetration test our systems" while having tested only a marketing website is the kind of statement that gets examined closely after an incident.

We are not insurance advisers and cannot tell you how a specific policy would respond. What we can do is make sure the testing you describe is the testing you actually have.

Check the panel requirement now

Many cyber policies require you to use a provider from the insurer's panel for incident response, and may decline costs incurred elsewhere. That does not usually restrict who does your penetration testing, but it is worth knowing before an incident rather than during one.

On buying the cheapest test to tick the box

Tempting, and the logic is understandable — the test is being bought to answer a question rather than to find problems. But this is precisely the situation where a cheap test creates risk rather than reducing it: you end up describing a level of assurance to your insurer that the underlying work does not support.

If budget is tight, a properly scoped external infrastructure test from an accredited provider is more defensible than a broad, shallow scan. Narrower and real beats wider and nominal.

Common questions