Penetration Testing for Cyber Insurance: What Insurers Are Starting to Ask For

Cyber insurers aren’t regulators, and nobody is legally required to buy a cyber policy. But for many UK businesses, the questionnaire that arrives at renewal has quietly become one of the most demanding security assessments they face all year, and questions about penetration testing for cyber insurance are becoming a regular part of it. It asks detailed questions about how you protect your systems; it often asks how often you test them, and your answers can affect how much you pay, how much cover you get, and, ultimately, whether a claim is paid at all.

This guide looks at what insurers are asking about penetration testing and related controls, how test evidence can affect your premium, and what can happen to a claim if the controls you declared weren’t actually in place.

A quick note before we start: this is a practical overview from a security testing perspective, not legal or insurance advice, and policy wordings vary a great deal. Your broker is the best person to explain how your own policy works.

Why Cyber Insurance Questionnaires Have Become So Detailed

Cyber attacks are common enough that insurers have had to get much more careful about who they cover. According to the government’s Cyber Security Breaches Survey 2025/2026, published on the 30th of April, 2026, 43% of UK businesses reported a breach or attack in the previous 12 months, and only 47% had any form of cyber insurance.

Ransomware has been the biggest driver of change because a single ransomware incident can involve forensic investigation, system recovery, business interruption, legal advice and regulatory notifications all at once, which makes it one of the most expensive types of claim an insurer can face. As a result, insurers have moved away from short, tick-box proposal forms and towards questionnaires that ask about specific controls, and increasingly ask for evidence that those controls exist.

What Insurers Ask About Penetration Testing

The exact questions vary from insurer to insurer, but the pattern is consistent. As an example, CFC’s UK cyber application form for larger organisations asks:

• “How often do you conduct penetration testing of your network architecture?”
• “Please state whether you have implemented all high and critical security recommendations from your most recent security tests.”

It also asks how often you scan your network perimeter and internal network for vulnerabilities, and what percentage of the organisation those scans cover.

Interestingly, the second question is the one that catches people out. Insurers want to know if you acted on what the test found, as well as how often you test. A penetration test report with a list of unresolved critical findings can actually work against you if you can’t honestly answer “yes” to that question.

The other controls that sit alongside testing

Penetration testing rarely appears on its own. The same questionnaires typically ask about:

• Multi-factor authentication, usually for remote access, email, cloud services and privileged accounts, which is often the most heavily scrutinised answer on the form.
• Endpoint detection and response (EDR), including which product you use, what percentage of devices it covers and who monitors it.
• Backups, including if they’re disconnected from your network, protected by MFA and regularly tested by actually restoring data.
• Patching, including your target time for applying critical updates and any unsupported software you still run.

Many insurers also ask about incident response, such as having an incident response plan and when it was last tested.

A penetration test is one of the few ways to check all of these at once. A good internal test will show if MFA can be bypassed, how well your EDR detects real attack techniques, how close an attacker could get to your backups and which unpatched systems can be exploited, which gives you far more confidence in your answers than a self-assessment. Our guide to external vs internal penetration testing explains how each type of test covers different parts of the picture.

How Test Evidence Can Affect Your Premium and Cover

Insurers price risk based on what they can see. A business that can show a recent penetration test, a remediation record and a clear testing schedule gives an underwriter much more confidence than one that simply ticks “yes” on a form, and that confidence tends to show up in a few ways:

• Eligibility: Some insurers won’t offer cover at all, or will only offer limited cover, if key controls such as MFA and backups are missing.
• Price: Stronger, evidenced controls generally support better terms at renewal, while gaps can lead to higher premiums or larger excesses.
• Exclusions and sub-limits: Where controls are weak in a particular area, an insurer may limit or exclude cover for related losses, such as ransomware, instead of declining the whole policy.

It’s worth being realistic about this, though. No insurer publishes a formula that says a penetration test will save you a set percentage, and pricing depends on many other factors, such as your sector, turnover, claims history and the wider insurance market. What a penetration test does reliably is put you in a stronger position to answer the questionnaire accurately and to negotiate with evidence instead of assurances.

What Happens to a Claim If Declared Controls Weren’t in Place

This is the part of cyber insurance that gets the least attention until something goes wrong.

The duty of fair presentation

In the UK, business insurance is governed by the Insurance Act 2015, which places a duty of fair presentation on the policyholder. In simple terms, you must disclose everything material to the risk, and the information you give must be substantially correct. The application form will usually remind you of this, and it will typically be signed by a senior member of staff confirming that the answers are accurate and complete.

If you get it wrong, the insurer’s remedy depends on what kind of mistake it was:

• If the misrepresentation was deliberate or reckless, the insurer can avoid the policy entirely, refuse all claims and keep the premium.
• If it was honest but careless, the remedy depends on what the insurer would have done had it known the truth. If it wouldn’t have offered cover at all, it can avoid the policy but must return the premium. If it would have charged more, it can reduce a claim payment proportionately. If it would have included different terms, the policy is treated as if those terms had been included.

Crucially, these remedies are proportionate, which was one of the main changes the Act introduced. But proportionate doesn’t mean painless. If you told your insurer that MFA protected all remote access when it didn’t, and the attacker came in through an unprotected remote access account, a significantly reduced claim payment, or none at all, is a realistic outcome.

Conditions and controls within the policy

Many cyber policies also include specific conditions, such as requirements to maintain MFA or backups. Under the Insurance Act 2015, an insurer generally can’t rely on a breach of this kind of term to refuse a claim if the policyholder can show that the breach couldn’t have increased the risk of the loss that actually happened. So a missing control that had nothing to do with the incident shouldn’t, in itself, sink your claim. A missing control that’s directly connected to how the attacker got in is a very different matter.

A warning from the United States

The clearest public example of what can go wrong comes from the US, where the legal framework is different but the lesson is the same. In 2022, Travelers sued its policyholder, International Control Services, after a ransomware attack, alleging that the company had stated in its application that it used MFA across its systems when, according to Travelers, MFA only protected its firewall. As Lockton reports, the court entered judgment rescinding the policy on the 26th of August, 2022, after the company agreed to it, which left it without cover for the attack.

Cyber Insurance Penetration Testing: Protecting Yourself at Renewal and Claim Time

Perhaps most importantly, as well as giving you evidence to show an insurer, a penetration test tells you if the answers you’re about to give are actually true. Many businesses complete their questionnaire in good faith, believing that MFA is enforced everywhere or that backups are isolated, only to discover during an incident that a legacy system or a forgotten account was the exception.

To get the most from testing in an insurance context, we’d suggest a few things:

• Time your test before renewal: Testing a few months ahead of your renewal date gives you time to fix findings, so you can answer remediation questions honestly. Our guide to annual penetration testing covers how to plan the cycle.
• Scope it around the questionnaire: Make sure the test covers the controls your insurer asks about, such as remote access, email, privileged accounts and the route to your backups, alongside the systems that matter most to your business.
• Close out the findings: Fix high and critical issues, confirm them through retesting after fixing vulnerabilities, and document any you can’t fix yet. Our guide on what to do if you can’t fix everything explains how to handle the rest.
• Keep the evidence together: Store your test reports, remediation records and retest results somewhere you can find them quickly, both for renewal and in case you ever need to support a claim.

And if ransomware is your biggest concern, which it is for most insurers, our guide on how to protect your business from ransomware covers the controls that matter most.

Where Cyber Essentials Fits

For smaller organisations, Cyber Essentials is often the first step towards answering an insurer’s questions with confidence, since it covers several of the same basics, such as patching, MFA and malware protection. Notably, UK-domiciled organisations with an annual turnover under £20 million that certify their whole organisation can opt into cyber liability insurance included with Cyber Essentials, with a £25,000 limit of indemnity.

That cover is useful, but it’s limited, and Cyber Essentials doesn’t include the backups or EDR that most insurers now ask about. It also isn’t a penetration test, as we explain in is Cyber Essentials Plus a penetration test?

Treat the Questionnaire Like a Compliance Requirement

Insurers aren’t regulators, but the effect of their questionnaires is very similar to a compliance standard. They set expectations, ask you to declare that you meet them, and attach real financial consequences to getting it wrong. For a wider view of how formal standards approach penetration testing, see our guide to which compliance standards require penetration testing.

The one thing to avoid is treating the test as a box to tick before renewal. Testing the same narrow scope every year, so that you can answer “yes” to the testing question, while the systems an attacker would actually target go unexamined, is a textbook example of the Pentest Trap.

Getting Insurance-Ready with Fortifi

Fortifi is a CREST-accredited penetration testing company, and our UK penetration testing services help organisations check that the controls they declare to their insurer are genuinely in place. Every engagement includes a clear report, practical remediation guidance and retesting, so you have the evidence ready at renewal and if you ever need to make a claim.

Because we don’t do sales calls, you’ll speak directly to a cyber security expert who can help you scope a test around your insurer’s questionnaire and your real risks. Book a call with our team today.

Cyber Insurance and Penetration Testing FAQs

Do cyber insurers require a penetration test?

It depends on the insurer and the size of the business. Many questionnaires, particularly for larger organisations, ask how often you carry out penetration testing and whether you’ve fixed the high and critical findings. Even where a test isn’t strictly required, it’s one of the most reliable ways to make sure your answers are accurate.

Will a penetration test reduce my cyber insurance premium?

It can help, but there’s no guaranteed discount. Insurers price risk on the controls they can see evidence for, so a recent test with a clean remediation record supports a stronger position at renewal. Pricing also depends on your sector, size, claims history and the wider market.

Can an insurer refuse a claim if our security controls weren’t in place?

Potentially, yes. Under the Insurance Act 2015, the outcome depends on whether a misrepresentation was deliberate, reckless or careless, and on what the insurer would have done had it known the truth. Remedies range from a proportionate reduction in the claim to the policy being avoided entirely.

How often should we test for cyber insurance purposes?

Most insurers are comfortable with annual testing, ideally timed a few months before renewal so there’s time to fix the findings. You should also test after any significant change to your systems, since that can affect the accuracy of answers you’ve already given.