Cyber insurance applications and renewal forms have become long security questionnaires. Underwriters want to know how you protect remote access, how fast you patch, whether backups would survive an attack and whether anyone has tested your defenses. Answering from memory is risky: an inaccurate answer can complicate a claim later. A penetration test gives you evidence for several of those questions, and it often finds the gaps an underwriter would care about while there is still time to fix them.
What insurers commonly ask about
Forms differ between carriers and change from year to year, but the same themes come up again and again. Insurers commonly ask about:
- Multi-factor authentication for email, remote access, cloud consoles and privileged accounts
- Patching: how quickly critical updates reach internet-facing systems and the rest of the estate
- Backups: whether they are separated from the main network, protected from deletion and tested by restoring
- Endpoint detection and response (EDR): whether it is deployed and who watches its alerts
- Security testing: whether you run penetration tests or vulnerability scans, and what happened to the findings
- Staff awareness: phishing training and whether it is tested
- Remote access: which services are exposed to the internet and how they are protected
Your broker is the right source for what a particular carrier expects. This guide focuses on where a penetration test can help you answer.
Where a pentest gives you evidence
Many answers on an insurance form describe what you believe is configured. A test shows what an attacker would meet. The two are often different, especially for MFA coverage and exposed services.
| Question area | What testing can show | Test that fits |
|---|---|---|
| MFA on remote access and email | Whether any login route skips MFA, such as a legacy protocol or a forgotten VPN portal | External network pentest |
| Privileged accounts | Whether a normal user can reach admin rights and whether admin accounts need MFA | Active Directory pentest |
| Patching | Out-of-date software reachable from the internet or inside the network | VAPT |
| Backups | Whether an attacker with domain admin could reach backup servers or consoles | Internal network pentest |
| EDR | Whether common attacker techniques were detected and escalated | Purple team exercise |
| Phishing resilience | How many staff reported a simulated phish, and how fast | Social engineering assessment |
What a pentest cannot answer for you
Some questions sit outside any test. A pentest will not confirm that backups restore cleanly, that your incident response plan is current, or that vendor contracts have the right security clauses. It can show that an attacker could reach a backup console. Proving the backups work needs a restore exercise run by your own team.
A test is also a snapshot of the scope you chose. If the form asks about your whole organization, make sure the test covered the parts that matter, or describe its scope accurately in your answer.
Timing the test before renewal
The most common mistake is testing too close to the renewal date. If the test finds remote access without MFA two weeks before the form is due, you face an awkward choice between a rushed fix and an unwelcome answer. Work backward from the renewal date instead:
- Request the renewal questionnaire, or last year's version, early.
- Agree the test scope so it covers the areas the form asks about.
- Allow time for the test, the report and a few weeks of fixes.
- Retest the fixes and keep the retest letter.
- Complete the form with answers that match what the test showed.
For a typical mid-sized company, starting this process a few months before renewal leaves room to breathe. Our guide on pentest timelines helps you plan the calendar.
Answer accurately, not optimiztically
An application is a statement about your controls. If the pentest found that one remote access route lacked MFA and you fixed it, you can answer yes with evidence. If it is still open, say so and explain the plan. Your broker can advise on how to present a gap that is being worked on. They will be less able to help if a claim reveals that an earlier answer was wrong.
Keep the report, the retest letter and a short note of which form questions each finding relates to. That record is useful at the next renewal too.
Sharing results with your insurer or broker
A full pentest report is a detailed map of your weaknesses. Share it only when someone has a real need for that detail. In most cases an executive summary or our attestation letter, issued after a retest, tells a broker what they need: the scope, the dates, that testing happened and that serious findings were fixed. Ask your broker what the underwriter wants before sending anything.
Which tests to start with
If you only have budget for one engagement before renewal, insurer questions usually point to the perimeter and identity. An external network test checks the services exposed to the internet and their login protection. An internal network and Active Directory test shows how far an intruder could spread and whether backups and admin accounts are reachable. Our Active Directory assessment guide explains the second in more depth.
Phishing simulations and purple team exercises add evidence about people and detection once those basics are covered. The pentest frequency guide helps you build a yearly plan around the renewal date.
After the test
Fix the findings that relate to insurance questions first: MFA gaps, exposed remote access, privileged account paths and unpatched internet-facing systems. Then request a retest. Our retest of fixed findings is free, and the letter we issue gives you a dated, shareable record.
Frequently asked questions
Do insurers require a penetration test?
It varies by insurer, policy and company size. Many applications ask whether you test regularly and how you track fixes. Your broker can tell you what a specific carrier expects.
Should we share the full pentest report with our insurer?
Usually a summary or attestation letter is enough, and a full report is a sensitive document. Ask your broker what the underwriter needs and share only that, ideally after fixes are retested.
Which test gives the most useful evidence for a renewal?
For most companies, an external network test plus an internal and Active Directory review, because insurer questions focus on remote access, privileged accounts and how far an intruder could spread.
Renewal coming up? Look at our external network and Active Directory tests, check a budget with the cost calculator, or request a fixed-price proposal.