---
title: "Pentest for Cyber Insurance: Evidence for the Questionnaire"
url: https://mr-cyber.com/cyber-insurance-penetration-testing
language: en
description: "Pentest for cyber insurance: what insurers’ questionnaires typically ask and how a pentest report and an attestation letter help you answer them."
---

# Pentest for cyber insurance: evidence for your insurer’s questionnaire

Cyber insurers ask about your security before they make an offer: typically about multi-factor authentication, patching, backups, and often whether your internet-facing systems have been tested. A recent external pentest report and a one-page attestation letter back up your answers with evidence instead of a tick box.

[See my fixed price](https://mr-cyber.com/quote?service=external)

Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book)

To be clear: we can’t promise a lower premium, or that you’ll get cover. That is the insurer’s decision alone. We deliver dated, verifiable test results you can show them.

## What questionnaires typically ask. And what a test can show.

-   ### Multi-factor authentication
    
    For email, remote access and admin accounts. An external pentest checks whether remote access really asks for a second factor.
    
-   ### Patching
    
    How quickly you install security updates, especially on internet-facing systems. A test shows where outdated software is still reachable.
    
-   ### External testing
    
    Whether your internet-facing systems have been scanned or pentested, and when. The report states the timeframe and scope.
    
-   ### Remote access
    
    How VPN or remote desktop is secured, and whether services are open to the internet that should not be.
    
-   ### Backups and restore
    
    Separated or offline backups and tested restores. A pentest does not check this directly; it stays your own statement.
    
-   ### Protection and detection
    
    Endpoint protection and monitoring. An internal test or an assumed breach scenario shows what of it detects an attack.
    

Questionnaires differ by insurer and company size. This list shows common topics, not the requirements of any particular insurer.

## How the report and the attestation letter help

You answer the questions with evidence, and you see beforehand where the weak spots are, so you can fix them before you apply or renew.

### What you get

-   Report with timeframe, scope and every finding with a recommendation
-   Free retest within 60 days, confirmed in writing
-   Attestation letter: one page for insurers and brokers, who tested what and when and the status after the retest, without finding details
-   Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
-   Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
-   Ticket import file: your team works through the findings quickly

[See my fixed price](https://mr-cyber.com/quote?service=external)

## Tests that fit.

-   [External network pentest The usual starting point: your internet-facing systems and remote access, from €1,900.](https://mr-cyber.com/services/external-network-penetration-testing)
-   [Vulnerability assessment An affordable regular check for known vulnerabilities, €390. Not a pentest.](https://mr-cyber.com/services/vulnerability-assessment)
-   [Internal network pentest How far an attacker gets inside your network, from €3,800.](https://mr-cyber.com/services/internal-network-penetration-testing)
-   [Active Directory pentest A common path to ransomware: your Active Directory, from €3,400.](https://mr-cyber.com/services/active-directory-penetration-testing)
-   [Report What a report looks like.](https://mr-cyber.com/sample-report)

## Pentest and cyber insurance: FAQ

Will a pentest lower our premium?

We can’t promise that. Premium and cover are the insurer’s decision alone. A pentest gives you evidence for the questionnaire and shows weak spots you can fix before you apply or renew.

Do insurers require a pentest?

Some ask whether and when you had one; requirements differ by insurer and company size. Your questionnaire is what counts; if in doubt, ask your broker.

Which test fits?

Usually [the external network pentest](https://mr-cyber.com/services/external-network-penetration-testing), because questionnaires focus on internet-facing systems and remote access. If ransomware is the concern, the internal network and Active Directory come next.

What can we show the insurer?

The one-page attestation letter: who tested what and when, scope, standards and the status of the findings after the retest, without finding details. The full report only if you want to. It is a confirmation, not a certificate.

When should we test?

Ideally a few weeks before you apply or renew. That leaves time to fix the findings and have them confirmed in the free retest within 60 days. You pick the start date in the [quote form](https://mr-cyber.com/quote).

Also useful: [NIS2 & Compliance](https://mr-cyber.com/nis2-penetration-testing)  [Pentest or vulnerability scan?](https://mr-cyber.com/pentest-vs-vulnerability-scan)  [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing)  [TISAX pentest](https://mr-cyber.com/tisax-penetration-testing)