By EJN Labs · 14 Sep 2026 · 7 min read
No UK law requires penetration testing for cyber insurance. At renewal, insurers commonly send a security questionnaire, and many treat a recent report from an independent, CREST-accredited firm as stronger evidence than a self-assessment alone, especially once cover limits or risk profile rise.
Why does penetration testing come up at cyber insurance renewal?
Penetration testing comes up at renewal because insurers reassess your risk profile each year, and a questionnaire alone does not show whether your defences hold up. In our experience, brokers increasingly ask for independent test evidence once cover limits rise or the business handles sensitive data.
The National Cyber Security Centre’s cyber insurance guidance confirms most policies are reassessed every twelve months and that insurers need current information about your security controls, without prescribing how you provide it. For many buyers, that scrutiny is not a certification ask: there is no pass-or-fail badge to earn, only evidence an underwriter finds convincing enough to hold your terms or improve them.
Is penetration testing a legal requirement for cyber insurance in the UK?
No. Cyber insurance is not compulsory in the UK, and no statute or regulator mandates penetration testing as a condition of holding or renewing a policy. Where a requirement exists, it comes from the insurer’s proposal form or the broker’s placement conditions, a private contract rather than law.
Where a question about testing appears, it usually sits inside the policy’s warranties or conditions, the statements you sign as accurate at renewal. The NCSC’s guidance is direct about the consequence of getting that wrong: if you claim security measures are in place when they are not, the insurer may not be obliged to pay a claim. That, more than any single clause, is the real driver behind buyers asking us for evidence instead of relying on memory when the form arrives.
What kind of penetration test do underwriters actually want to see?
In our experience, underwriters rarely specify a methodology: they want evidence that externally facing systems have been examined by an independent third party within the last year, most often via an external infrastructure test covering internet-facing IP ranges, remote access and email configuration.
Those systems matter because they are the routes attackers commonly use to gain an initial foothold: exposed VPN and remote-desktop gateways, misconfigured firewalls, and Microsoft 365 or Google Workspace tenants without enforced multi-factor authentication. An external infrastructure penetration test is the closest thing to a default here, and a web application or cloud configuration review is worth scoping in alongside it if either sits on the same attack surface, since one report covering both saves commissioning twice before your deadline.
| What the renewal form asks | What it is really checking | Evidence that satisfies it |
|---|---|---|
| Has your security posture been independently tested? | Whether controls have been verified by someone other than your own IT team | A report from a CREST-accredited firm, dated within the last twelve months |
| Are internet-facing systems protected? | Exposure on your external attack surface, the most common route into a claim | External infrastructure penetration test findings |
| Is remote access secured with MFA? | Whether VPN, remote desktop and cloud email are hardened against credential attacks | Configuration review findings alongside the infrastructure test |
| Have prior findings been fixed? | Whether earlier weaknesses were remediated, not just identified | A signed retest confirming closure of high and critical findings |
How do you get a penetration test done in time for a renewal deadline?
Book the test as soon as your renewal notice arrives, ideally six to eight weeks before the renewal date. That window covers a short scoping call, one to three weeks of testing depending on scope, report drafting, and time to fix anything the report flags before you submit it.
A scoping call is where we map your renewal questionnaire against an actual test: which IP ranges are in scope, whether remote access or cloud configuration needs covering, and what format your broker expects the report in. Most straightforward external perimeter engagements run one to two weeks from kick-off to draft report, and the final version pairs an executive summary with full technical findings and CVSS scores, the format most buyers preparing for a renewal ask us to produce. If remediation is needed before submission, we build a short retest into the same engagement rather than starting a second conversation.
What does a penetration test for insurance renewal cost in the UK?
A straightforward external infrastructure test for a renewal typically costs £3,300 to £7,000 in the UK market, based on 3 to 5 days at £1,100 to £1,400 a day. Adding web application or cloud coverage moves that to 6 to 9 days, £6,600 to £12,600. Exact price comes from the quote form.
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| External infrastructure only | 3 to 5 days | £3,300 to £7,000 |
| External infrastructure plus web application | 6 to 9 days | £6,600 to £12,600 |
| Retest after remediation | 1 to 2 days | £1,100 to £2,800 |
These are typical UK ranges rather than a quote; your actual price depends on how many systems sit in scope and how quickly you need the report back. For a broader view of how pricing is built up across different test types, see our guide to penetration testing costs in the UK.
How EJN Labs approaches cyber insurance renewal testing
EJN Labs is a CREST-accredited penetration testing firm, certified to ISO 27001 and ISO 9001, with every engagement carried out by UK-based testers. We ask to see your renewal questionnaire or broker’s request before we scope anything, so the test covers what your insurer wants evidence of rather than a generic template.
Our reports are written for two readers at once: a technical appendix your IT team can action, and an executive summary a broker or underwriter can read without a security background. Where findings need fixing before your renewal date, we build a retest into the original quote rather than treating it as a separate sale. If you are also weighing up other providers, our guide on choosing a CREST-accredited penetration testing provider sets out the questions worth asking any firm, including us.
Frequently Asked Questions
Do all cyber insurance policies require a penetration test?
No. Cyber insurance is a commercial product, not a legal requirement, so there is no single rule that applies to every insurer or policy. Whether a test is asked for depends on your cover limit, sector and insurer’s underwriting appetite; many smaller policies are still assessed by questionnaire alone.
What evidence do insurers accept instead of a full penetration test?
A completed security questionnaire, evidence of Cyber Essentials or Cyber Essentials Plus, and confirmation of basics like multi-factor authentication and patching are commonly accepted for lower-risk policies. As cover limits or claims history rise, insurers more often ask for independent test evidence instead.
How much does a penetration test for cyber insurance renewal cost in the UK?
A straightforward external infrastructure test typically costs £3,300 to £7,000 in the UK market, based on 3 to 5 days at £1,100 to £1,400 a day. Adding web application or cloud configuration coverage takes it to £6,600 to £12,600 for 6 to 9 days. Get a quote for the exact scope and price.
How far in advance of renewal should you book a penetration test?
Book six to eight weeks before your renewal date if possible. That allows time for scoping, one to three weeks of testing depending on how much sits in scope, report delivery, and a short remediation window if the test finds anything worth fixing before you submit it to your broker.
Does Cyber Essentials Plus replace a penetration test for insurance purposes?
No. Cyber Essentials Plus is an assessor-led technical audit against a fixed set of controls, not a penetration test; the two evidence different things. Some insurers offer premium discounts for Cyber Essentials or Cyber Essentials Plus, but for higher cover limits they typically still ask for test evidence too.
Get renewal-ready evidence before your deadline
If your renewal questionnaire is asking for testing evidence and the clock is running, we can scope an engagement around the exact form your broker sent. Get a CREST pentesting quote and you will get a fixed scope and price back.
Related research
- Do UK businesses need penetration testing for cyber insurance? covers policy conditions in more general terms.
- Choosing a CREST-accredited penetration testing provider is a useful checklist if you are comparing firms for the first time.
- Our guide to picking a UK penetration testing provider covers the wider questions worth asking beyond accreditation alone.
Leave a Reply