Does Cyber Insurance Require a Penetration Test?

The short answer is: increasingly yes, and the threshold for when it becomes mandatory has dropped significantly in 2026. Most cyber insurance carriers now require annual penetration testing for policies above $1 million in coverage. Policies at $5 million and above typically require documented internal and external penetration tests with remediation evidence before coverage is issued or renewed.

The longer answer is that even where penetration testing is not a hard underwriting requirement, it directly affects whether your policy is priced competitively, whether your application clears the first submission, and critically, whether a claim actually pays out if something goes wrong. Of the 38,000+ cyber insurance claims closed in 2024, fewer than 10,000 resulted in a payout, roughly one in four claims paid. Inadequate or misrepresented security controls were a primary factor in the rest.

This post covers exactly what cyber insurers require, how penetration testing affects coverage terms and premiums, and what a pentest report needs to include to satisfy an underwriter.

Key Takeaways

• Most cyber insurance carriers require annual penetration testing for policies above $1 million in coverage in 2026.
• Policies at $5 million and above require documented internal and external pentests with remediation evidence as a standard underwriting condition.
• Regular penetration testing reduces cyber insurance premiums by 5 to 10%, and multiple security certifications together can bring premiums 30 to 40% below market average.
• 41% of cyber insurance applications are denied on first submission, with missing controls and inadequate endpoint protection as the top reasons.
• Carriers can deny claims and rescind coverage retroactively when organizations attest to controls they did not fully implement, including penetration testing they claimed was current but was not.
• The global cyber insurance market is projected to reach $16.6 billion in gross written premiums in 2026, growing at approximately 14% annually through 2034.

What Does Cyber Insurance Actually Cover in 2026?

Cyber insurance covers financial losses resulting from cyberattacks, data breaches, ransomware, and the associated legal and regulatory costs. In 2026, coverage typically spans two categories: first-party losses that your organization incurs directly, and third-party liability arising from harm caused to others through a breach of your systems.

First-party coverage typically includes forensic investigation costs, data recovery and system restoration, business interruption losses during downtime, ransomware negotiation and payment costs where covered, notification costs for affected individuals, and credit monitoring services. Third-party liability coverage includes legal defense costs, regulatory fines where insurable under applicable law, and settlements with individuals whose data was compromised.

The specific scope of coverage has become more important to understand because most policies now include sublimits that cap payouts for specific incident types. A $2 million policy with a $250,000 ransomware sublimit means a ransomware attack maxes out at $250,000, regardless of actual losses. Understanding sublimits, retroactive date restrictions, and the specific conditions under which coverage applies or is voided is as important as the headline coverage amount.

The cyber insurance market is projected to reach $16.6 billion in gross written premiums in 2026, up from $14 billion in 2025, growing at approximately 14% annually through 2034. That growth reflects how rapidly organizations are recognizing cyber risk as an insurable exposure. What it does not reflect is how dramatically the underwriting requirements to obtain that coverage have tightened.

Do Cyber Insurers Require Penetration Testing?

Most cyber insurers in 2026 require or strongly incentivize penetration testing, and the distinction between “required” and “strongly incentivized” matters less than buyers expect. A penetration test that is not explicitly required may still be the difference between a policy that pays claims and one that does not, because carriers can deny claims where the security posture attested to on the application does not match what a forensic investigation reveals.

The shift in underwriting approach over the past four years explains why. Between 2020 and 2024, cyber insurance carriers saw claims consistently outpace premiums as ransomware attacks and large-scale breaches produced losses that exceeded what was priced into the market. In response, insurers moved away from self-reported security questionnaires toward verifiable testing as the standard for assessing actual security posture. Applications now frequently include external scanning of the applicant’s environment to verify what is being attested to. A questionnaire that says “we conduct regular penetration testing” is worth considerably less to an underwriter than a recent pentest report with documented findings and remediation evidence.

The formal position across most major carriers in 2026 reflects this shift. Annual penetration testing is a standard requirement at the $1 million coverage threshold. Semi-annual or documented continuous testing is increasingly expected at higher coverage levels and in higher-risk industries. Healthcare organizations subject to HIPAA and financial services firms under PCI DSS and DORA face sector-specific requirements that stack on top of insurer minimums.

At What Policy Level Does Penetration Testing Become Mandatory?

Penetration testing becomes a mandatory underwriting requirement at different thresholds depending on the carrier, industry, and coverage amount. Still, the clearest dividing lines in 2026 are at $1 million and $5 million in coverage.

Under $1 million in coverage: Penetration testing is typically recommended but not always a hard requirement. The focus at this level is on demonstrating baseline security controls: phishing-resistant MFA, endpoint detection and response, regular data backup with tested restoration, a documented incident response plan, and network segmentation. Many carriers at this level will accept a security questionnaire with supporting documentation rather than requiring a formal pentest report.

Between $1 million and $5 million in coverage: Annual internal and external penetration testing is now a standard requirement with most major carriers. The pentest report needs to be current, typically within 12 months of renewal, and must include evidence that findings were remediated. Applications that reference penetration testing without producing the actual report are increasingly flagged by underwriters for additional scrutiny.

Above $5 million in coverage: Documented internal and external penetration tests with detailed remediation evidence are a baseline underwriting condition. A security audit or formal security assessment may also be required. In high-risk sectors, semi-annual testing schedules are becoming standard expectations rather than differentiating features.

Healthcare and financial services organizations face an additional layer of requirements regardless of coverage amount because the sector-specific regulatory frameworks they operate under HIPAA, PCI DSS, DORA, and state financial regulations create penetration testing obligations that insurers treat as baseline expectations for any coverage in those sectors.

How Does Penetration Testing Affect Cyber Insurance Premiums?

Penetration testing directly reduces cyber insurance premiums and improves coverage terms, with the effect most pronounced when test results are current, findings are documented as remediated, and the testing program is part of a broader demonstrated security posture rather than a standalone activity conducted for the application.

Regular penetration testing reduces premiums by 5 to 10% on its own. Combined with other security certifications and controls, the savings compound: ISO 27001 certification reduces premiums by 15 to 25%, SOC 2 Type II reports reduce them by 10 to 15%, and implemented SIEM or XDR reduces them by a further 10 to 15%. Organizations with multiple certifications and mature security programs can negotiate premiums 30 to 40% below market average.

The premium impact is easiest to understand as a risk signal. An underwriter pricing a policy is assessing the probability that the organization will file a claim and the likely severity of that claim. A recent penetration test that produced findings, had those findings remediated, and was retested to confirm the fixes demonstrates two things no self-reported questionnaire can: the organization actively identifies its vulnerabilities rather than assuming they do not exist, and it addresses what is found rather than documenting it and moving on. Both signals reduce the expected claim probability and therefore the premium.

The inverse is equally true. An organization that cannot produce a penetration test report, or that produces one more than 18 months old, is signaling that its security posture has been unvalidated for a significant period in which the environment almost certainly changed. Underwriters price that uncertainty into the policy.

For a clear understanding of what penetration testing costs relative to the premium savings and risk reduction it delivers, our post on penetration test costs in 2026 covers the full pricing landscape across engagement types.

What Happens to Your Claim if You Misrepresent Security Controls?

Misrepresenting security controls on a cyber insurance application, whether deliberately or through an inaccurate understanding of what “regular penetration testing” means, is the most dangerous error an organization can make in the cyber insurance process. Carriers can deny claims and rescind coverage retroactively when attested controls are not present at the time of the incident, even if the misrepresentation was unintentional.

Courts have upheld coverage denials where organizations attested to controls they did not fully implement, including MFA deployments that only covered part of their environment and penetration testing they described as “regular” when the last test was two or three years old. The legal exposure runs in both directions: uncovered losses from the breach itself and potential liability for misrepresentation in the application.

The specific scenario most relevant to penetration testing: a carrier that asks on the application whether annual penetration testing is conducted, receives an affirmative answer, issues the policy, and then during a claim investigation discovers the organization’s last test was 27 months ago. The carrier has grounds to deny the claim based on a material misrepresentation of the security controls in place at the time of the policy application. This scenario is not theoretical. It is the documented basis for a significant share of denied claims in recent years.

The practical implication is that an organization should not represent penetration testing as part of its security program unless it has a current, documented test report, ideally completed within the past 12 months, and confirmation that identified findings were remediated and retested.

What Else Do Cyber Insurers Require Alongside Penetration Testing?

Penetration testing is one requirement within a broader security control framework that underwriters evaluate in 2026. The baseline controls most carriers require at the $1 million coverage threshold and above include phishing-resistant MFA on all privileged accounts and remote access, an endpoint detection and response platform deployed across the environment, a documented and tested incident response plan, network segmentation, 12-character minimum passwords, annual security awareness training, and a backup restoration capability that has been tested within the past 12 months.

The NIST Cybersecurity Framework and CIS Controls are the most commonly referenced security frameworks in underwriting applications. Alignment with one of these frameworks, demonstrated through documentation rather than self-attestation, strengthens an application and supports the premium reduction case. Carriers are increasingly asking applicants to reference a specific framework rather than describing controls in open-ended terms, because framework alignment creates a structured basis for comparing one organization’s posture to another.

The CISA’s cyber insurance resources outline how government guidance on minimum security standards intersects with insurer requirements, particularly for organizations in critical infrastructure sectors where CISA guidelines carry regulatory weight alongside commercial insurance expectations.

The NIST Cybersecurity Framework provides the identify, protect, detect, respond, and recover structure that most carriers use as their mental model for evaluating an applicant’s security program, even when the framework is not explicitly required.

What Should a Penetration Test Report Include to Satisfy an Insurer?

A penetration test report that satisfies cyber insurance underwriters needs to include more than a list of vulnerabilities. It needs to demonstrate an independent, methodology-based assessment of the organization’s actual security controls, with findings that map to recognized vulnerability categories and documented evidence that critical issues were identified and addressed.

The specific elements underwriters look for in a pentest report:

Independence of the tester. The report should clearly identify who conducted the test, their qualifications (certifications, experience), and confirm that they are independent of the organization’s internal IT function. Internal testing does not satisfy most insurers’ requirements for independent validation.

Scope coverage. The report should document which systems, networks, and applications were tested and confirm that the scope aligned to the organization’s actual attack surface. A test that covers a subset of the environment while leaving significant systems untested raises questions about whether the overall posture is genuinely understood.

Methodology documentation. The test methodology should reference a recognized framework such as PTES, OWASP, or NIST SP 800-115. This gives underwriters a basis for assessing the rigor of the testing approach rather than accepting the test at face value.

Findings with severity ratings. All identified vulnerabilities should be documented with CVSS or equivalent severity ratings, exploitation evidence for confirmed findings, and the specific systems or controls affected.

Remediation evidence. Critical and high findings need to be accompanied by documentation that they were remediated and that a retest confirmed the remediation was effective. A report listing unresolved critical findings is a liability, not an asset, in a cyber insurance application.

Recency. Most carriers require the test to have been completed within 12 months of the application or renewal date. Tests older than 18 months are typically treated as insufficient evidence of current security posture.

Our penetration testing services produce insurance-ready reports that include all of these components, structured so the evidence underwriters need is immediately accessible rather than buried in a technical appendix.

Get a free quote for an insurance-ready penetration test

How Often Should Your Penetration Test Be Updated for Insurance Purposes?

For cyber insurance purposes, penetration testing should be updated annually at minimum, and more frequently if your coverage level exceeds $5 million, your industry is healthcare or financial services, or your environment changes significantly between annual tests. The key principle is that the test needs to be current enough to reflect your actual security posture, not the posture you had when you were last tested.

Most carriers treat 12 months as the standard validity window for a penetration test for underwriting purposes. A test completed 13 months ago may be technically recent enough to satisfy some carriers at renewal but may not satisfy others. The safest practice is to schedule the test at least 60 to 90 days before your policy renewal date, which provides time to receive the report, remediate any critical findings, and produce the retest evidence that underwriters increasingly expect to see alongside the original report.

The environment-change trigger matters independently of the calendar. A significant change, whether a cloud migration, a new application in production, a significant architecture change, or a major third-party integration, creates an attack surface that the previous test did not evaluate. Insurers who discover that a breach occurred through an attack vector introduced after the organization’s last test, and that the organization did not test after making that change, have grounds to argue the attested security posture was inaccurate at renewal.

For a complete framework on building a testing cadence that covers both insurance requirements and actual risk, our post on how often your business should perform a penetration test covers the decision framework in full.

Frequently Asked Questions

Can I get cyber insurance without a penetration test?

For policies under $1 million in coverage, many carriers will issue coverage based on a security questionnaire and documentation of baseline controls without requiring a formal penetration test. Above $1 million, most carriers require one. Above $5 million, it is effectively a non-negotiable underwriting condition. In regulated industries like healthcare and financial services, penetration testing expectations apply at lower coverage thresholds due to the sector-specific regulatory requirements those organizations operate under.

Does a vulnerability scan satisfy the penetration testing requirement for cyber insurance?

No. Underwriters distinguish between vulnerability scans, which use automated tools to identify known issues against a baseline, and penetration tests, which involve a human tester actively attempting to exploit identified vulnerabilities to confirm real-world impact. Submitting a vulnerability scan report in response to a penetration testing requirement is one of the patterns that triggers additional scrutiny in the underwriting process. If the requirement is for penetration testing, the report must document manual, human-validated testing.

What if my penetration test found critical vulnerabilities? Should I still submit it to an insurer?

Yes, but with remediation evidence. A penetration test that found critical vulnerabilities and documented their remediation through a retest demonstrates that your security program actively identifies and addresses issues. That is a stronger position with an insurer than no test at all, or a test that appears to have found nothing. What creates problems is submitting a test with open critical findings without evidence of remediation, which tells an underwriter your known vulnerabilities remain unaddressed.

Can my carrier deny a claim if I said I had penetration testing, but the test was outdated?

Yes. Courts have upheld claim denials where organizations represented security controls that were not current or fully implemented at the time of the policy application or renewal. An outdated penetration test characterized as current testing is a material misrepresentation. The safe position is to ensure the test date and scope documented on your application accurately reflects what was actually conducted, and to disclose the test date clearly.

Does penetration testing also affect deductibles and sublimits, not just premiums?

Yes. A strong security posture demonstrated through penetration testing and other controls can improve not only the headline premium but also deductible amounts, sublimits for specific incident types like ransomware, and the breadth of coverage included. Carriers price the full policy, not just the premium, based on their assessment of risk. An organization with demonstrably strong controls may negotiate a lower ransomware sublimit deductible or broader coverage scope than an equivalent organization without that documentation.

Penetration Testing Is Now Part of Your Insurance Strategy

The relationship between cyber insurance and penetration testing has shifted in one direction over the past four years and shows no sign of reversing. Carriers have moved from accepting self-reported questionnaires to requiring verifiable testing because claims experience taught them that organizations that do not test consistently are materially more likely to produce large claims.

For any organization carrying $1 million or more in cyber insurance coverage, the practical position in 2026 is straightforward: penetration testing is part of your insurance program, not an optional addition to it. The report you produce satisfies an underwriting requirement, reduces your premium, and in the event of a claim, is the documentation that positions your organization as having exercised reasonable security diligence.

The organizations that struggle with this are the ones that treat penetration testing as a one-time compliance exercise rather than an annual practice. A test from three years ago does not tell an underwriter, or an attacker, anything accurate about your current posture.

Contact us to discuss building a penetration testing program that satisfies your cyber insurer