Veterinary Practice Cyber Insurance: Do You Need a Penetration Test?

No law tells a veterinary practice to commission a penetration test. The request usually comes on a cyber insurance renewal or proposal form, written by the insurer, so the answer depends on its exact wording. Practices hold owner contact and payment details and run on one shared practice system, which is why a question about testing reaches them.

Does a cyber insurance renewal require a veterinary practice to have a penetration test?

Not by law, and not on every policy. A cyber insurance form is a private contract document, so there is no public rule to quote. What exists is the wording of individual forms, which varies by insurer and policy. If your broker has asked about testing, the answer sits in that form.

Our general guide, cyber insurance renewals that ask for penetration testing, explains how underwriters use the answer, how to time a test before renewal and what evidence to send. This page does not repeat it. It covers what changes when the insured business is an independent practice, a practice group or a referral hospital.

What does a cyber insurance form actually ask a veterinary practice?

One published example is the DUAL cyber proposal form. Its network security section asks: “Conduct penetration tests of your network at least annually?” and, if yes, asks you to confirm that all high critical findings and recommendations have been remediated or actioned. Other insurers word this differently, so it is one real example, not a template.

The same form has other questions that a practice will find awkward, because of how a practice runs. These are worth reading before you answer:

• Restoring systems. It asks how long it takes to restore your critical systems after a network outage. For a practice, that means the practice management system holding appointments, clinical notes and billing, and what happens at the consulting-room desk while it is down.
• Segregated data. It asks whether you isolate critical or sensitive data in its own segregated environment. In a practice group, that is a question about branches, laboratory links and back-office networks sharing one estate.
• Personal devices. It asks whether you permit Bring-Your-Own-Device. Locum vets, out-of-hours cover and visiting specialists often bring their own phones and laptops, so the honest answer takes thought.
• Vendor access. It asks whether vendors have access rights to your network and whether those rights are periodically reviewed. Practice software suppliers, laboratory partners and remote IT support all qualify.

The form is silent on which accreditation the tester should hold. A form that states one is the exception, and if yours does, use the one it states.

What is different about veterinary data?

The personal data in a practice belongs to the owner, not the animal. A pet’s clinical record is not personal data about an identifiable person in its own right, but the owner’s name, address, contact details and payment information are, as are owner-identifying notes attached to the record. That is what a breach would expose, and what the insurer is pricing.

UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. Our page on GDPR penetration testing explains how a test fits that duty.

Corporate practice groups and referral hospitals ask for security evidence from independent practices too. In our experience they sometimes ask for Cyber Essentials Plus before they engage. That is an assessor-led technical audit, which is a different thing from a penetration test, so say which one you hold when a partner or an insurer asks.

Who can carry out the test?

Veterinary organisations can use a CREST-accredited company, or whichever scheme their own requirement states. EJN Labs is CREST-accredited. Read the exact wording of the question from your broker or insurer, and use the accreditation it states, if it states one. A practice group’s own supplier policy may say more than the insurance form does.

Two practical checks help. Ask which legal entity holds the accreditation and look for it on the scheme’s own register. Then ask whether the test is manual work by named testers or an automated scan with a report attached, because a form asking about penetration tests is asking about the first.

What should a veterinary practice test?

Test the systems that hold owner data and the links between them. Start with what an outsider can reach, then the practice management system, then the connections to laboratories and insurers. The list follows the veterinary systems we test, and a single practice will only need part of it.

• Practice management systems. Whether a receptionist, nurse and vet each see only what their role allows, and whether records stay intact across a shared system.
• Pet owner portals and booking. Whether one owner can open another owner’s pets or history, how proxy access works for shared ownership, and how repeat-prescription requests are approved.
• Laboratory and diagnostic results. The trust boundary between your practice system and the in-house or reference laboratories it connects to, and the integrity of results and audit trails.
• Payments and pet-insurance claims. Whether a payment state or claim amount can be tampered with, and the boundary between your system and the claims portal of the pet insurer, without testing the insurer’s own platform.
• Multi-site group networks. Separation between branches, laboratories and back-office networks, and between managed devices and clinical equipment.
• Video triage and consultation apps. Consultation identity, meeting links, attachments and clinical data held on the device. See mobile application penetration testing.
• Cloud-hosted clinical data. Configuration of the cloud accounts holding practice management and clinical-record platforms.
• Phishing defence. A simulation against practice admin, laboratory and finance staff using supplier-invoice and fake insurance-claim lures. See phishing assessments.

What evidence do you hand back to the insurer or the group?

Hand back what was asked: the date of the last test, the scope, and confirmation that high and critical findings were fixed. The DUAL wording asks for that last confirmation, and a retest report is what supports it. Offer a short summary letter first and keep the full report for when someone asks for it.

This is practice, not a rule, so confirm with your broker. A practice should also keep a note of what the test did not cover. If the laboratory link or the pet-insurance claims connection was out of scope, say so plainly, so the answer on the form is not wider than the work behind it.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your practice or group.

How EJN Labs approaches testing for veterinary practices and groups

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated veterinary and animal health service. We test practice management systems, pet owner portals, laboratory result feeds, payment and pet-insurance claims workflows, group networks and the cloud platforms behind them, keeping practice staff and pet-owner access separate throughout.

We agree safe testing windows around clinic opening hours, test against non-production environments with synthetic owner and clinical data wherever possible, and run safe by default on production with no denial of service. Out of hours slots are available. The work is done by UK-based, CREST-certified testers.

You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does my veterinary practice need a penetration test for cyber insurance?

Not by law, and not every policy asks. Some UK cyber insurance forms do ask whether you run penetration tests, and the wording varies by insurer. Read the question on your form. If it asks about testing, a CREST-accredited test with a retest is a direct way to answer it.

Is a pet’s clinical record personal data?

Not in its own right. The owner’s name, contact details, payment information and any owner-identifying notes attached to the record are personal data. UK GDPR Article 32(1)(d) asks for a process for regularly testing the effectiveness of your security measures for that data, without naming penetration testing.

Will testing disrupt a clinic day?

It should not. Testing windows are agreed around clinic opening hours, non-production environments with synthetic data are used wherever possible, and testing is safe by default on production with no denial of service. EJN Labs also offers out of hours slots at no extra charge.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is an assessor-led technical audit, and a penetration test is a different exercise. Corporate practice groups sometimes ask for the first and insurance forms sometimes ask about the second. Check which one your partner or insurer means, and answer that one.

Can the test include our laboratory and pet-insurance connections?

Yes, for your side of each connection. We test the boundary between your practice system and the laboratory or the pet insurer’s claims portal, for owner data leakage and claims-amount tampering. The laboratory’s or insurer’s own platform is not part of the test.

Get a quote for your practice

Tell us which systems are in scope and what the insurance form says. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Veterinary Practices and Groups, Best Penetration Testing Companies for UK Veterinary and Animal Health, penetration testing for UK veterinary and animal health, penetration testing for insurance firms, Cyber Essentials Plus and what underwriters accept at a cyber insurance renewal.