Bug Circuit

For small business owners

Penetration testing for cyber insurance

Your cyber insurance application asks about security testing and you are not sure what to answer. Here is what insurers usually want to know, what they can already see from outside, and when a website test is worth doing first.

Does cyber insurance require a penetration test? Usually not for a small business, but it depends on the insurer, the coverage limit and your industry. Applications often ask whether you test your systems for vulnerabilities, and some insurers scan your internet-facing systems themselves. A recent website test, with proof that you fixed what it found, lets you answer those questions truthfully and lowers the chance of a claim. Your insurer or broker decides what counts.

Bug Circuit is not an insurer or a broker, and we cannot tell you what your policy needs. This page explains the common questions so you know what to ask.

What cyber insurance applications usually ask

  • Two-factor login for email, admin panels and remote access.
  • Backups that are kept separate or offline, and tested.
  • Updates: how quickly you install security patches.
  • Endpoint protection on staff computers.
  • Vulnerability scanning or penetration testing of your systems, and how often.
  • Staff training about phishing.
  • An incident response plan: who does what if you are hacked.

The exact wording varies by insurer. Answer what the form actually asks. A vulnerability scan and a penetration test are different things, explained in manual vs automated penetration testing.

What insurers can already see from outside

Some insurers run outside-in scans of applicants. They look at what anyone on the internet can see about your domain:

  • Outdated software on your website or server.
  • Exposed admin or login pages and forgotten subdomains.
  • Open ports for services that should not face the internet.
  • Weak email security: missing SPF or DMARC records that make your domain easy to spoof.
  • Certificate problems and missing security headers.

The free Pulse scan shows you much of the same outside view of your own domain in seconds: subdomains, software, headers, certificate and email security, without touching your site. Fix what it shows before you apply or renew.

How a website test helps with cyber insurance

  • Honest answers: “Yes, our website was tested on this date, and these issues were fixed” is a strong answer to a testing question.
  • Fewer claims: websites are a common way in. Fixing the flaws a test finds makes a breach less likely.
  • A report to share if your broker or insurer asks for evidence.

One warning: never overstate your security on an application. Wrong answers can lead to a denied claim. If you have not tested yet, say so, or test before you submit.

What to do, in order

  • Read the application and note every security question.
  • Fix the free items first: two-factor login everywhere, backups, updates.
  • Run the free outside-in scan and fix what it shows.
  • If the form asks about testing, get your website tested by a person. Circuit is a $49 one-time manual audit with a written report. Signal is $299 and adds fixes for the high and critical issues, a retest and 3 months of cover.
  • Ask your broker whether your insurer wants a named or accredited firm. If so, that requirement wins.

Reports usually arrive within about 5 business days after you verify your domain. Bug Circuit is not a PCI DSS QSA or a HIPAA auditor and does not issue compliance certifications. See the steps in how to get a penetration test.

Frequently asked questions

Does cyber insurance require a penetration test?
Usually not for a small business, but it depends on the insurer, the coverage limit and your industry. Applications often ask whether you test your systems for vulnerabilities, and larger policies or some industries are more likely to ask for a recent penetration test. Read your application questions or ask your broker.
Will a penetration test lower my cyber insurance premium?
It might help, but nobody can promise that. Premiums depend on many things, such as your industry, revenue, claims history and controls like two-factor login and backups. A recent test, and proof that you fixed what it found, gives you better answers on the application. Ask your broker how your insurer treats it.
What security questions do cyber insurance applications ask?
Common ones are: do you use two-factor login for email and admin access, do you keep backups offline or separate, how quickly do you install updates, do you use endpoint protection, do you scan or test for vulnerabilities, do you train staff about phishing, and do you have an incident response plan. The exact list varies by insurer.
Do insurers scan my website?
Some insurers run their own outside-in scans of an applicant’s internet-facing systems, looking for things like outdated software, exposed admin pages, open ports or weak email security. Bug Circuit’s free Pulse scan shows much of the same outside view of your domain (subdomains, software, headers, certificate and email security), so you can fix what is exposed first.
Is a vulnerability scan enough for cyber insurance?
If the application asks about vulnerability scanning, a regular scan can answer that question. If it asks about penetration testing, a scan is not the same thing: a penetration test means a person tried to break in by hand. Answer exactly what the application asks.
What if my application says we test, but we do not?
Do not guess or overstate. Wrong answers on an insurance application can lead to a denied claim. If you have not tested yet, say so, or get a test done before you submit and answer with the date and the result.

Keep reading

A customer asked for a pentest reportWhat to do when a client or partner needs proof of testing.Do I need a penetration test?A five-question check.Small business security audit checklistA practical list you can work through yourself.See a sample reportWhat a real website test report looks like.Bug Circuit pricingFree scan · $49 audit · $299 with fixes and 3 months of cover.

See what insurers can see

Run the free passive check on your domain. No login, no card, nothing touches your site.

Ready for the full manual audit? See pricing