# Cyber insurance penetration testing requirements: what insurers ask and accept

Source: https://penetrationtestservices.com/guides/cyber-insurance-penetration-testing-requirements/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

Does cyber insurance require a pentest? No universal rule exists. See what applications ask, when a pentest comes up, what to send your broker and what it cannot do.

> **Short answer:** No law or standard we found makes a penetration test a universal condition of cyber insurance. The application form and policy wording decide, and they vary by insurer, limits and industry. A pentest report or summary letter can support underwriting answers. It does not promise cover, a lower premium or acceptance. Ask your broker what your application requires.

Cyber insurance penetration testing requirements are set by each insurer, not by a rule that covers all policies. We found no law or standard that makes a pentest a universal condition of cover. Some applications ask about one, and some insurers ask for one at underwriting or renewal. This page shows what applications tend to ask, what evidence to send, and what a pentest cannot do for a policy.

## Does cyber insurance require a penetration test?

No universal rule exists. The application form and the policy wording decide. Insurers differ, and the answer can change with the policy limit, the industry and past claims.

Vendor pages often say that insurers "require" pen tests. The evidence is thin. The best public number we found is a survey, not policy wording: in Pentera's 2025 survey of 500 CISOs, 93% said their cyber insurance provider had recommended or required security solutions not previously in place, and 59% implemented at least one tool at the insurer's direct request. The survey is from a vendor and does not say how many of those requests were pentests.

Treat "required" as a question for your broker, with the application in hand.

## What do insurers ask on applications?

Applications vary, so use this table as a map of common topics, not as a quote from any insurer. The right column shows where pentest evidence helps.

| Topic an application may ask about | Typical question shape | Where a pentest result helps |
|---|---|---|
| Multi-factor authentication | Is MFA on for email, remote access and admin accounts? | Authentication testing shows whether MFA can be bypassed in the app |
| Backups | Are backups offline or immutable and tested? | Not covered by a web pentest |
| Endpoint detection | Do you run EDR on endpoints? | Not covered by a web pentest |
| Patching | How fast do you patch critical issues? | A retest shows how fast findings were fixed |
| Pentest or vulnerability assessment | When was the last test, and were findings fixed? | The report, letter and retest dates answer this directly |
| Customer data and access control | Do you hold sensitive data, and who can reach it? | Access control and tenant isolation findings |

A web and API pentest speaks to the application rows. It says nothing about backups, endpoints or staff training.

## When is a pentest asked for?

A pentest is more likely to come up in these cases. These are patterns, not rules.

- Higher limits. A larger policy leads to more underwriting questions.
- Sectors that hold sensitive data, such as health, finance and SaaS platforms with customer data.
- Claims or incidents in your history.
- A renewal where your system changed a lot.
- A contract that asks you to hold cyber cover and to show testing, which links to your customer's security review. See [pentest reports for customer security reviews](/customer-security-review/).

Cobalt's 2025 report gives a related fact: third-party pentest reports are the assurance that customers and regulators ask for most, at 59% of 450 respondents. That is customer demand, which sits next to insurance demand and often arrives at the same time.

## What evidence should you send: letter, summary or report?

Send the lightest document that answers the question, and send more when the underwriter asks.

| Document | Holds | Use it when |
|---|---|---|
| Summary letter | Dates, scope, method, counts by severity, fix status, limits, signature | The form asks for the date and outcome of your last test |
| Executive summary | Risk themes and priority actions | The underwriter wants context |
| Full report | Findings, evidence, reproduction, fix advice | An underwriter asks for it, under NDA |

No standard defines the letter, and vendors who describe letters say acceptance varies. Read the [attestation letter guide](/guides/pentest-attestation-letter/) for the contents and a template. Do not describe a letter as "insurer-approved" unless the insurer said so in writing.

## What does a pentest not do for a policy?

A pentest does not buy cover. It also does not promise a lower premium, a higher limit or a claim payout.

- It tests a scope at a point in time. New code adds new risk after the test.
- It does not replace the controls many applications ask about, such as backups and endpoint detection.
- It does not show that no weakness remains.
- A report with open critical findings may raise questions. Fix them and retest before you send it. See [after the pentest](/guides/after-the-pentest-remediation-and-retest/).
- Answering the application wrongly can create policy problems. Answer from facts, and keep the evidence behind each answer.

## How do you scope a pentest for an underwriter's questions?

Start from the questions on your application, then pick the tested systems that answer them.

1. Collect the application or renewal form, and mark every question about testing, access control, authentication and customer data.
2. List the systems that hold or process customer data: the web app, the API and any admin panel.
3. Include the roles that matter: customer user, customer admin, internal staff. Test across tenants if you run a multi-tenant app.
4. Ask the provider to date the report and any retest, and to list scope and limits plainly.
5. Ask whether the provider issues a summary letter. Excession Labs' published materials do not say we issue letters, so ask any provider, including us, what the letter says before you order.

Write the authorization and rules first. See [rules of engagement](/guides/penetration-testing-rules-of-engagement/).

## When should you test, and how does this fit a renewal calendar?

Run the test early enough to fix and retest before the application is due. A pentest finished the week before renewal leaves no time to close findings.

| Step | Suggested timing |
|---|---|
| Read the renewal form | As soon as the broker sends it |
| Scope and book the test | Before your release freeze |
| Test and report | Weeks before the form is due |
| Fix and retest | Before you send evidence |
| Send letter or summary | With the application |

Timing depends on your own release cycle. For the wider question, read [how often should you pentest](/guides/how-often-should-you-pentest/). Early-stage teams can start with [penetration testing for startups](/guides/penetration-testing-for-startups/).

## What to ask your broker

- Does the application ask about penetration testing, and in what words?
- How recent must the test be?
- Will you accept a summary letter, or do you need the report?
- Who sees the document, and where is it stored?
- Does a test change the quote, the terms or the limit? Ask for the answer in writing.
- What happens if the test finds issues we have not fixed on the application date?

## Questions

### Can an insurer deny a claim because we had no pentest?

That depends on your policy wording and the answers you gave on the application. We cannot give legal advice. Read the policy conditions and exclusions, and ask your broker or a lawyer before you rely on any answer.

### Will a pentest lower my cyber insurance premium?

We found no source that shows it will, so we make no such claim. Insurers set premiums by their own rating. Ask your broker whether test evidence changes the quote for your policy.

### Should we send the full report to the broker?

Usually a summary letter or an executive summary is enough to start. A full report lists open weaknesses, so share it only when asked, and under NDA. Check where the broker and insurer store it.

### How recent must the pentest be?

The application or underwriter sets that, not a general rule. We found no insurer text that fixes the period. Ask the broker for the exact wording.

## Sources

- [Pentera: The State of Pentesting 2025 (vendor survey of 500 CISOs)](https://pentera.io/wp-content/uploads/2026/03/Pentera-Report-The-State-of-Pentesting-2025.pdf)
- [Cobalt: State of Pentesting Report 2025](https://resource.cobalt.io/state-of-pentesting-2025)
- [Blaze Infosec: Pentest attestation letter](https://www.blazeinfosec.com/post/pentest-attestation-letter)
- [PCI SSC Information Supplement: Penetration Testing Guidance v1.1](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)