Cyber Insurance Now Requires Penetration Testing. Are You Ready?

Back to Blog

A few years ago, getting a cyber insurance policy was straightforward. Fill out an application, check a few boxes about antivirus and backups, and you were covered. That era is over.

In 2026, cyber insurance carriers are denying applications and refusing to renew policies for businesses that cannot demonstrate specific security controls. Penetration testing, MFA, and endpoint detection are no longer nice-to-haves. They are prerequisites for coverage.

If you are an IT director or business owner at a small or mid-size company, this directly affects your ability to transfer risk. Here is what changed, what carriers are demanding, and how to get ahead of it.

Why Carriers Tightened Requirements

The math stopped working. Between 2020 and 2024, ransomware claims skyrocketed. Carriers paid out millions to organizations that lacked basic controls like MFA, tested backups, and network segmentation. Loss ratios exceeded 70% for many underwriters.

The response was predictable: carriers raised premiums, reduced coverage limits, added exclusions, and started requiring proof of specific security controls before issuing or renewing policies.

This is not a temporary correction. It is the new baseline. Every major carrier now uses detailed security questionnaires, and several require third-party validation of controls before binding coverage.

The 8 Controls Carriers Require in 2026

While every carrier has its own application, the following controls appear on virtually every cyber insurance questionnaire today:

1. Multi-factor authentication (MFA) on all remote access, VPN connections, privileged accounts, and email. SMS-based MFA is increasingly rejected in favor of app-based or hardware token authentication.
2. Endpoint detection and response (EDR) deployed on all endpoints with 24/7 monitoring. Traditional antivirus alone no longer qualifies.
3. Tested, immutable backups stored offline or in a separate environment. Carriers want proof you can actually restore from backup, not just that backups exist.
4. Patch management with critical vulnerabilities remediated within 30 days. Some carriers require 14 days for actively exploited vulnerabilities.
5. Email security with advanced phishing protection, DMARC enforcement, and mailbox-level threat detection.
6. Incident response plan that has been tested within the past 12 months. A plan that sits in a drawer does not count.
7. Security awareness training for all employees, conducted at least annually with phishing simulations.
8. Penetration testing performed by a qualified third party, with findings documented and remediation tracked.

Miss any of these, and you face higher premiums, reduced limits, specific exclusions, or outright denial.

Why Penetration Testing Matters to Carriers

A pentest gives the carrier something a self-reported questionnaire cannot: independent verification that your defenses actually work.

Vulnerability scans are automated and surface-level. They tell you what software versions are running and whether known CVEs exist. A penetration test goes further. A skilled tester attempts to chain vulnerabilities together, escalate privileges, move laterally, and access sensitive data, exactly what a real attacker would do.

For carriers, a recent pentest report signals three things:

• The organization takes security seriously enough to invite scrutiny
• Known exploitable weaknesses have been identified and are being addressed
• There is a documented baseline of security posture that can be measured over time

Several carriers now offer premium discounts of 5% to 15% for organizations that can provide a current pentest report at renewal. Others flat-out require one for policies above $5 million in coverage.

What Happens When You Get Denied

Cyber insurance denial is not just an inconvenience. For many businesses, it creates a cascade of problems:

• Contract requirements. Many enterprise clients and government agencies require their vendors to carry cyber insurance. Losing coverage can mean losing contracts.
• Regulatory exposure. In regulated industries like healthcare and financial services, cyber insurance is often expected as part of your risk management program.
• Uninsured losses. The average cost of a data breach for companies with fewer than 500 employees was $3.31 million in 2024, according to IBM. Without insurance, that comes straight from your balance sheet.
• Board and investor scrutiny. Inability to obtain cyber insurance signals unmanaged risk, which gets attention from boards, investors, and potential acquirers.

How to Prepare for Your Next Renewal

If your cyber insurance renewal is coming up in the next 6 months, here is a practical checklist:

1. Audit your MFA deployment. Confirm it covers all remote access, VPN, admin accounts, and email. Switch from SMS to app-based or FIDO2 if you have not already.
2. Verify your EDR coverage. Make sure every endpoint has an agent installed and that monitoring is active 24/7, not just business hours.
3. Test your backups. Run a full restore test and document it. Note the recovery time and any gaps.
4. Schedule a penetration test. Give yourself at least 60 days before renewal so findings can be remediated and documented.
5. Update your incident response plan. Run a tabletop exercise with your leadership team. Document who participated and what was tested.
6. Pull your DMARC and SPF records. Carriers are checking these. If your DMARC policy is set to "none," fix it before application time.

The Pentest Report Carriers Want to See

Not all pentest reports are created equal. Carriers want to see specific elements:

• Scope definition. What was tested and what was excluded.
• Methodology. Industry-standard frameworks like OWASP, PTES, or NIST.
• Findings with severity ratings. Critical, high, medium, low, with clear explanations of business impact.
• Proof of exploitation. Screenshots or evidence demonstrating the vulnerability is real, not theoretical.
• Remediation guidance. Specific, actionable steps to fix each finding.
• Executive summary. A non-technical overview that leadership and underwriters can understand.

If your pentest vendor hands you a 200-page automated scan printout with no manual testing evidence, that is not going to satisfy an underwriter. Carriers know the difference.

The Bottom Line

Cyber insurance is no longer a rubber stamp. Carriers are requiring real security controls, verified by independent testing, before they will issue or renew coverage. Penetration testing has moved from a best practice to a hard requirement for many policies.

The businesses that get ahead of this will pay lower premiums, maintain coverage continuity, and satisfy client and regulatory requirements. The ones that wait will face denials, exclusions, and gaps in coverage they cannot afford.

Start with the controls list above. If you are not sure whether your organization is ready, read our guide on 5 signs your company needs a penetration test. Schedule your pentest 60 to 90 days before renewal. Document everything.