How a Penetration Test Helps with Cyber Insurance Proposals and Renewals

Buying or renewing cyber insurance in the UK now involves a long list of security questions. Underwriters want to know how you protect accounts, how quickly you patch, whether you could recover from ransomware and how you check that any of it works. Those questions are often answered by whoever has time, from memory, a few days before the deadline. A recent penetration test gives you a firmer footing: it shows what is really in place, highlights gaps before an insurer finds them and produces evidence you can point to.

What proposal forms commonly ask about

Forms vary, but the same themes appear again and again across UK cyber policies. Most of them describe controls that a penetration test can check directly.

The point is not to pass a quiz. An answer on a proposal form is a statement of fact, so it should be one you can stand behind.

Why accuracy matters more than a perfect score

Many organisations believe MFA is on everywhere until a tester finds an old remote access portal or a mailbox protocol that skips it. Others think backups are isolated, then learn that a single compromised admin account can reach them. If a form says a control exists and an incident later shows it did not, the conversation with your insurer becomes much harder. Talk to your broker about what disclosure means for your policy; the practical step is to check your controls before you describe them.

A test also tells you where to spend the weeks before renewal. Closing an MFA gap or isolating backups is usually faster than people expect once someone has shown exactly where the gap is.

Choosing a test that helps at renewal

You do not need to test everything. Pick the areas that map to insurer questions and to the way most damaging incidents unfold:

• External network testing to find exposed remote access, unpatched edge devices and services that should not face the internet.
• Active Directory testing, including Entra ID where you run hybrid identity, to measure how far one compromised account could go and whether backups or admin tools are within reach.
• Internal network testing from an assumed-breach starting point, to check segmentation around critical systems and backup infrastructure.
• A purple team exercise if you want proof that EDR and monitoring alert on realistic attacker behaviour, with your analysts or managed provider watching.

Organisations that sell online or run customer portals should add their main web application, because a data breach through an application is just as relevant to a claim as ransomware.

Timing the test around your renewal date

Work back from the renewal date. A sensible plan for a UK organisation looks like this:

1. About three months before renewal: agree scope and sign written authorisation. In the UK this must come from someone entitled to give it under the Computer Misuse Act 1990.
2. About ten weeks before: testing runs in windows agreed in UK time. Critical findings are reported to you as soon as they are confirmed.
3. Eight to four weeks before: fix the issues that relate to insurer questions first, then everything else rated critical or high.
4. A few weeks before: retest the fixes and receive a dated retest letter.
5. When completing the form: answer from the evidence, not from memory.

If renewal is close, a smaller test of external exposure and identity is still worth doing. Our pentest timelines resource shows how long each type usually takes.

What to share with an insurer or broker

A full penetration test report is a detailed map of your weaknesses. It should not travel further than it needs to. In most cases a short summary, an attestation of the test scope and dates, or a retest letter answers the question. If an underwriter asks for more, agree with your broker exactly what will be sent, how it will be protected and who will see it. Keep the full report for your own team and auditors.

Whatever you share, make sure it matches the answers on the form. Consistency between documents is part of what makes the evidence credible.

Common gaps a test brings to light

• MFA enforced on the main email service but not on a legacy remote access gateway or an older mail protocol.
• Service accounts with broad rights and passwords that never change, giving a short path to domain control.
• Backup servers joined to the main domain, so the same admin credentials reach production and backups.
• Internet-facing systems missing security updates for months, despite a patching policy that says otherwise.
• EDR installed but tuned so quietly that common attacker techniques raise no alert.

Each of these is fixable, and each is the kind of detail that makes the difference between an accurate form and an optimistic one.

Beyond the renewal

Insurance is one reason to test, but not the only one. The same report can support ISO 27001 evidence, UK GDPR Article 32 duties and customer questionnaires. Build the test into an annual plan rather than treating it as a renewal chore; the pentest frequency resource explains how, and the remediation and retesting guide covers the fix-and-verify cycle that gives the evidence its value.

Frequently asked questions

Renewal coming up? Get a budget in pounds from the cost calculator or request a fixed-price proposal.