Insights
What penetration test does my cyber insurer actually want?
Usually the insurer has not said. The requirement arrives as a line on a proposal form or a note from the broker, “evidence of penetration testing”, with no type of test named and no scope described. The insurer wants to know that an independent tester has looked at the systems that could cause the claim they are underwriting, that the serious findings have been fixed and that this happens regularly. What that means in practice depends entirely on what your business runs, which is why the first thing to do is not to buy a test. It is to ask the broker exactly what wording the insurer needs satisfied.
What the insurer has actually asked for
In almost every case where a client comes to us because their insurer wants a test, the requirement is vague. It does not say external or internal, it does not say web application, it does not say how often. Brokers pass it on as they received it. That vagueness is not carelessness; the insurer is underwriting thousands of businesses that all run different things and cannot write a scope for each one. It leaves the scope to you, which means you can satisfy it with something sensible or with something that looks like a test and is not.
Why the answer depends on what you run
There is no standard insurer pen test. A company whose whole business sits in Microsoft 365 with a website that is just a brochure has a different exposure from a company running its own servers or a SaaS product with customer data behind a login. For the first, an external infrastructure test and a review of the Microsoft 365 tenancy covers the systems an attacker would actually reach. For the second, the internal network is where the damage happens after a phishing email lands, so an internal test matters more than the perimeter. For the third, the application is the business, so the application is the test. A ten-minute scoping conversation establishes which of these you are. Buying a test before that conversation is how people end up with a report that does not cover the thing the insurer would care about after a breach.
The mistake that costs people the most
The most common way this goes wrong is a vulnerability scan report presented as a penetration test. A scan is a tool run against your address range that lists known weaknesses by version number. It takes an hour, costs very little and produces a long document with a lot of red in it. It is not a penetration test, because nobody has verified whether any of those weaknesses can actually be used, chained together or reached at all. Insurers know the difference. If a claim is investigated and the “penetration test” turns out to be a scan, the evidence you relied on is worth nothing. The money spent on it was wasted twice.
A penetration test has a person in it. They verify what is real, discard what is noise and work out what an attacker could do with what remains. The report says what was in scope, what was found, how serious each finding is in your environment rather than in a database and what to change.
Insurers read the report
It is tempting to assume the report goes in a file and is never opened. In our experience the opposite is true. Insurers and brokers read them and they ask questions. The question they ask most is a simple one: have the High and Critical findings been fixed? A report full of open Highs at renewal is worse than no report, because it documents that you knew and did not act. This is why the retest matters more than the test. A test with a retest gives the insurer a closing position: this was found, this was fixed, this was verified. That is the document they want to see.
How often
Two triggers. Annually, matched to the policy renewal so the evidence is current when the form arrives. And after any significant change to your systems, a new application, a migration to the cloud, a merger, a new office network, because the previous report describes an environment that no longer exists. Insurers increasingly ask when the last test was as well as whether one was done.
The one thing to do first
Before you ask anyone for a quote, go back to the broker and ask what wording the insurer needs satisfied. Get it in writing. Sometimes it turns out the insurer wants Cyber Essentials Plus rather than a test, or wants both. Sometimes there is a specific requirement buried in the policy schedule that the renewal form did not mention. Knowing the exact requirement lets you scope a test that meets it at the right size, rather than guessing large or guessing small.
Then have a scoping conversation with a tester who will tell you what your business actually needs, put a fixed price on it and include the retest. That is the test your insurer wants, whether or not they said so.