Skip to content

Pentest for cyber insurance: evidence for your insurer’s questionnaire

Cyber insurers ask about your security before they make an offer: typically about multi-factor authentication, patching, backups, and often whether your internet-facing systems have been tested. A recent external pentest report and a one-page attestation letter back up your answers with evidence instead of a tick box.

See my fixed price

Prefer to talk first? Book a call

To be clear: we can’t promise a lower premium, or that you’ll get cover. That is the insurer’s decision alone. We deliver dated, verifiable test results you can show them.

What questionnaires typically ask. And what a test can show.

  • Multi-factor authentication

    For email, remote access and admin accounts. An external pentest checks whether remote access really asks for a second factor.

  • Patching

    How quickly you install security updates, especially on internet-facing systems. A test shows where outdated software is still reachable.

  • External testing

    Whether your internet-facing systems have been scanned or pentested, and when. The report states the timeframe and scope.

  • Remote access

    How VPN or remote desktop is secured, and whether services are open to the internet that should not be.

  • Backups and restore

    Separated or offline backups and tested restores. A pentest does not check this directly; it stays your own statement.

  • Protection and detection

    Endpoint protection and monitoring. An internal test or an assumed breach scenario shows what of it detects an attack.

Questionnaires differ by insurer and company size. This list shows common topics, not the requirements of any particular insurer.

How the report and the attestation letter help

You answer the questions with evidence, and you see beforehand where the weak spots are, so you can fix them before you apply or renew.

What you get

  • Report with timeframe, scope and every finding with a recommendation
  • Free retest within 60 days, confirmed in writing
  • Attestation letter: one page for insurers and brokers, who tested what and when and the status after the retest, without finding details
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
  • Ticket import file: your team works through the findings quickly
See my fixed price

Tests that fit.

Pentest and cyber insurance: FAQ

Will a pentest lower our premium?
We can’t promise that. Premium and cover are the insurer’s decision alone. A pentest gives you evidence for the questionnaire and shows weak spots you can fix before you apply or renew.
Do insurers require a pentest?
Some ask whether and when you had one; requirements differ by insurer and company size. Your questionnaire is what counts; if in doubt, ask your broker.
Which test fits?
Usually the external network pentest, because questionnaires focus on internet-facing systems and remote access. If ransomware is the concern, the internal network and Active Directory come next.
What can we show the insurer?
The one-page attestation letter: who tested what and when, scope, standards and the status of the findings after the retest, without finding details. The full report only if you want to. It is a confirmation, not a certificate.
When should we test?
Ideally a few weeks before you apply or renew. That leaves time to fix the findings and have them confirmed in the free retest within 60 days. You pick the start date in the quote form.

Also useful: NIS2 & CompliancePentest or vulnerability scan?Pentest for ISO 27001TISAX pentest

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call