Your cyber insurance renewal questionnaire just landed, and some of the questions are not ones you can answer from memory. Is multifactor authentication turned on for every account? Are backups stored where ransomware can’t reach them? When was your last penetration test? For a lot of small businesses in Chester County and the Philadelphia suburbs, that last question is the one that stops the form cold.
Here is what the question means, why your answers matter more than they look like they do, and what to ask your IT provider before you sign anything.
Some insurers ask for a penetration test, and nearly all of them ask questions a penetration test helps you answer
Requirements vary by carrier, by coverage amount and by industry, so there is no single rule that applies to every business. What has changed over the last few years is how specific the applications have become. Where a renewal once asked whether you had antivirus, it now tends to ask about:
- Multifactor authentication on email, remote access and administrator accounts.
- Endpoint detection and response (EDR) on every computer and server, and who is watching the alerts.
- Backups that are kept separate from your network, and how recently a restore was tested.
- Patching, meaning how quickly security updates get installed after they are released.
- Security awareness training and phishing simulations for employees.
- Vulnerability scanning or penetration testing, sometimes as a direct question and sometimes as a condition for higher limits.
Even when a carrier never uses the words “penetration test,” a recent test report is the cleanest way to back up your answers on everything else in that list.
Your questionnaire answers can decide whether a claim gets paid
The application is not a formality. Insurers underwrite the policy based on what you tell them, and if a claim investigation later finds that a control you said was in place was missing, the carrier may have grounds to dispute or reduce the payout. That is the worst possible time to learn that MFA was on for most accounts but not the one that got compromised.
This is why the person who checks “yes” on the form should be able to prove it. If you are filling out the questionnaire on your own and guessing at the technical answers, stop and loop in your IT provider and your insurance broker. Your broker can tell you how your carrier treats each question. Your IT provider should be able to show you the evidence.
What a penetration test gives you at renewal time
A penetration test is an authorized, simulated attack on your network by someone whose job is to find the weaknesses before a criminal does. For insurance purposes, the value is in the paper trail it leaves behind:
- A dated report showing what was tested and what was found.
- A prioritized list of fixes, so you know what to correct first.
- A retest that confirms the problems were actually fixed, which is the part many providers skip.
At Pegasus Technologies, we recommend a white box internal test as the primary engagement for most small and mid-sized businesses. White box means the tester works with full visibility and physical access, so the test comprehensively covers what a black box or grey box test would find and then some. Pairing it with an external test shows what an attacker on the internet can see. Our complete guide to penetration testing walks through the types, the timeline and what the final report should include. For a closer look at what testers typically uncover, see how penetration testing reveals hidden vulnerabilities in Chester County small businesses.
A penetration test for a small business typically costs $3,600 to $5,400 with Pegasus
That range covers internal and external testing, all three test types, one site, and one retest within the year. Additional sites or networks with more than 250 devices add to the scope. Compared with the cost of a denied claim, or a premium that jumps because you could not document your controls, it is one of the more predictable line items in a security budget.
When you compare quotes, ask every provider whether a retest is included. A report full of findings with no proof they were fixed does not help you much at renewal time.
Five questions to ask your current IT provider before you sign the renewal
If you already have an IT provider, these should be easy for them to answer. If they are not, that tells you something too.
- Can you show me that MFA is on for every account, including administrator accounts? A screenshot or report, not a verbal yes.
- Where are our backups stored, and when did you last test a full restore? A backup nobody has restored is a hope, and hopes don’t satisfy underwriters.
- Who reviews our EDR alerts, and how fast do they respond? Software that raises an alarm nobody hears will not help you after an incident.
- When was our last penetration test or vulnerability scan, and were the findings fixed?
- Will you help complete the questionnaire and stand behind the answers? Your provider knows your environment better than you do. They should be in the room for this.
If your current provider has never raised any of this with you, it may be time to take a hard look at whether they are keeping up with security threats.
Get your renewal answers in order before the deadline
Pegasus Technologies helps businesses across Chester County, Delaware County, the Main Line and the Lehigh Valley get their security controls documented and tested, from our offices in Kennett Square, Media, Wayne and Bethlehem. If your renewal is coming up and you are not confident in your answers, learn about our penetration testing service or contact us and we will help you figure out where you stand. You can also call us at 610-444-8256.
