Estate Agent Cyber Insurance Renewal: Do You Need a Penetration Test?

No law tells an estate or letting agency to commission a penetration test. The request almost always arrives on a cyber insurance renewal or proposal form, which is a private document, so the exact wording matters. Agencies hold identity documents, referencing data and rent money, which is why the question is put to them, and why the answer needs to be specific.

Does a cyber insurance renewal require an estate agency to have a penetration test?

Not by law, and not on every policy. A cyber insurance form is a contract document written by the insurer, so there is no public rule to point to. What exists is the wording of individual forms, and it varies by insurer and by policy. If your broker has sent you a question about testing, the answer lives in that form.

Our general guide, cyber insurance renewals that ask for penetration testing, covers how underwriters use the answer, how to time a test before a renewal date and what evidence to send. This page does not repeat it. It deals with what is different when the business being insured is an estate agency, a lettings agency or a property management firm.

Insurance forms also carry a legal duty on you. The DUAL proposal form reminds the applicant that “you owe a duty to make a fair presentation of the risk to the insurer”, and says that duty applies when cover is renewed. So the practical point is accuracy: answer the testing question as it is worded, and do not tick a box you cannot evidence.

What does a cyber insurance form actually ask a property business?

One published example is the DUAL cyber proposal form. Its network security section asks: “Conduct penetration tests of your network at least annually?” and, if the answer is yes, asks you to confirm that all high critical findings and recommendations have been remediated or actioned. Other insurers word this differently, so treat it as one real example, not a template.

The same form asks several questions that land hard on an agency. These are the ones we would read twice before signing:

• Volume of personal data. It asks for the approximate number of Personally Identifiable Information records stored on your network, database or system. An agency’s tenant, landlord, applicant and buyer records add up quickly, and they include scanned passports, right-to-rent checks, payslips and bank statements.
• Vendor access. It asks whether vendors have access rights to your network and whether those rights are periodically reviewed. Agencies depend on property management software, referencing providers, portal vendors and outsourced IT, so this answer is rarely a single line.
• Card payments. It asks whether you accept credit card payments and what PCI merchant level applies. Agencies that take holding fees, deposits or rent by card are in scope for this part of the form.

These questions are silent on which accreditation the tester should hold. A form that states one is the exception, and if yours does, use the one it states.

Why does a property business get asked about testing?

Because an agency’s systems hold the documents a fraudster or a data thief wants, and move money on predictable dates. Underwriters ask what a business has done to find weaknesses before someone else does. In our experience that question is put to property businesses of every size, from a single-branch lettings agent to a multi-branch group.

Three things set a property business apart from other insured firms:

• Identity documents on file. Right-to-rent checks, referencing packs and mortgage paperwork sit in portals and shared document stores, often for years after a tenancy ends.
• Rent and deposit money. Payments move on fixed days, between tenants, landlords, agents and solicitors. A changed bank-details message near a payment date is one route into payment diversion fraud, so the controls around a changed payee matter as much as the website.
• Three kinds of login on one platform. Tenant, landlord and agent accounts share the same portal, so the boundary between them is where a test earns its fee.

Data protection law adds a second reason to test, independent of insurance. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. Our page on GDPR penetration testing explains how a test fits that duty.

Who can carry out the test?

The form we have cited is silent on which accreditation the tester should hold. Property organisations can use a CREST-accredited company, or whichever scheme their own requirement states. EJN Labs is CREST-accredited. Read the exact wording of the question from your broker or insurer, and use the accreditation it states, if it states one.

Two practical checks help. Ask which legal entity holds the accreditation and look for it on the scheme’s own register. Then ask whether the test is a manual penetration test by named testers, or a scan with a report attached, because a form that asks about penetration tests is asking about the first. A Cyber Essentials Plus certificate is an assessor-led technical audit, which is a different thing, so say which one you hold when you answer.

What should an estate or letting agency test?

Test the systems that hold tenant and landlord documents and the systems that move rent. Start with what an outsider can reach from the internet, then test the logins and the payment flows. The list below follows the property systems we test, and your own scope will be a subset of it.

• Tenant and landlord portals. Whether one tenant can see another tenant’s tenancy agreement, or one landlord another landlord’s statements, and whether identity documents and EPCs are exposed through shared document stores.
• Property listing and applicant systems. Whether an agent can edit or remove a listing they do not own, and who can open applicant records across enquiries, viewings and offers.
• Mortgage application portals. For firms that run broker or borrower journeys, who can change a selected product or rate mid-application, and the integrity of uploaded payslips, bank statements and ID.
• Property management software. Separation between branches and between managed landlord portfolios, plus contractor and maintenance workflows.
• Rent, deposit and fee payments. The payment APIs behind online collection, and whether a changed payee or bank detail is flagged before funds move.
• Agent and tenant mobile apps. Viewing-booking and tenant apps, including what identity and referencing data is stored on the device. See mobile application penetration testing.
• Phishing and payment-fraud defence. A simulation against agents, finance staff and conveyancers using changed bank-detail lures. See phishing assessments.
• Cloud hosting. Configuration of the cloud accounts that hold tenancy, referencing and payment data.

What evidence do you hand back to the insurer or broker?

Hand back what the form asks for and no more: the date of the last test, the scope, and confirmation that high and critical findings were fixed. The DUAL wording asks for exactly that last confirmation, and a retest report is the document that supports it. Send the full report only if your broker asks, and prefer a short summary letter first.

This is practice, not a rule, so check with your broker. Three points tend to save time:

• Match the scope to the answer. A test of your website does not support a tick against “network” if your branch offices were never in scope.
• Keep the retest. The finding list shows what was found. The retest shows it was fixed, and that is the part the form asks you to confirm.
• Date it. A form that says “at least annually” is read against a date, so book the next test before the last one is twelve months old.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your agency.

How EJN Labs approaches testing for estate agents, letting agents and property firms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated property and proptech service. We test tenant and landlord portals, listing and applicant systems, property management software, rent, deposit and fee payment flows, mobile apps and the cloud platforms behind them. The aim is to check that tenant, landlord and applicant data stays on the right side of each boundary.

Testing is safe by default on production, with no denial of service, and out of hours slots are available so an agency can keep trading. The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing.

Retests are free until findings are resolved, so the evidence you send your broker can include the fix as well as the finding. There are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does my letting agency need a penetration test to get cyber insurance?

Not by law, and not every policy asks. Some UK cyber insurance forms do ask whether you run penetration tests, and the wording varies by insurer. Read the question on your form. If it asks about testing, a CREST-accredited penetration test with a retest is a direct way to answer it.

What does the insurance form mean by “high critical findings”?

It means the most serious results in a test report. The DUAL form asks you to confirm that all high critical findings and recommendations have been remediated or actioned. A report with CVSS-scored findings makes this easy to answer, and a retest shows the serious ones were fixed.

Is a vulnerability scan enough to answer the question?

Read the wording first. The form we cited asks about penetration tests of your network, and a scan is not the same thing. Some forms ask about vulnerability assessments as well, so a scan may answer a different question. Ask your broker which one the underwriter means before you tick.

Should the test cover our property management software supplier?

Test your own configuration of it and the way your branches, landlords and contractors log in. A supplier’s own platform is only in scope with the supplier’s written permission. The form’s vendor questions are about access, so also keep a list of who has it and review it.

Does the test have to be done by a particular scheme?

The form we cited is silent on the tester’s scheme. Property organisations can use a CREST-accredited company, or whichever scheme their own requirement states. EJN Labs is CREST-accredited. If your broker or insurer states a scheme, use that one.

Get a quote for your agency

Tell us which systems are in scope and what the insurance form says. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Estate and Letting Agents, Best Penetration Testing Companies for UK Property and Proptech, penetration testing for UK property and proptech, penetration testing for insurance firms, GDPR penetration testing and what underwriters accept at a cyber insurance renewal.