Why pen testing is key to cyber insurance eligibility

Cyber threats can have a major financial impact on small businesses. The average data breach cost for a small business with fewer than 500 employees is nearly $3 million, according to data from IBM and the Ponemon Institute.

To protect your small business against the financial risks of a data breach, cyber insurance is a good investment. It can pay for things like data recovery, customer notification, credit monitoring, and legal fees.

To get cyber insurance, however, you might be required to hire a security team to perform a penetration test (also called a pen test). This method uses ethical hacking to identify security weaknesses to reduce the chance of internal and external threats that could lead to a costly data breach.

A penetration test is when security experts gain authorized access to your business’s computer systems to mimic a real-world attack and look for security vulnerabilities.

The security professional acts like a hacker in a simulated attack to find weak spots in a system's defenses before a real attacker can exploit vulnerabilities. Pen testing can also be done on apps, APIs, routers, source code, and other networks.

Pen testers use various pen testing tools to evaluate the target system in a black-box, gray-box, or white-box test. Some things a security expert looks for during a pen test include:

• Web application vulnerabilities
• Open ports
• SQL injections
• Misconfigurations
• Cross-site scripting (XSS)
• Malware

Once the testing process is finished, the testing team provides their findings to the business with recommendations for patching weak points.

Pen tests are only performed by ethical hackers—also called pen testers, white hat hackers, and legal hackers—that your business hires. It’s important to note that ethical hackers are not the same as malicious hackers.

Ethical hackers are hired by businesses to legally gain access to their systems. Penetration testers are given consent to access the data your business owns and controls. Malicious hackers illegally gain unauthorized access to your systems for their personal gain, or to cause financial harm to your business.

To get cyber insurance coverage for your business, you might be required to undergo penetration security testing.

The main reason why pen tests are often a cyber insurance requirement is to demonstrate to the insurance company that your business takes cyber security seriously, and that you're implementing strategies to reduce known vulnerabilities. It also validates how likely a breach is, and where the potential threats are.

Based on the findings of a pen test, the insurance company can determine if your business qualifies for coverage. Some cyber insurance companies also require regular penetration tests to keep your coverage, or to renew your policy.

Insurance companies use the results from penetration tests to determine your eligibility for cyber insurance, but also the cost of your policy. Insurers consider the likelihood of a claim when setting premiums.

If your business conducts regular pen tests and has already identified security issues, there’s a lower risk of a breach occurring. And if an attack does happen, you might already have a remediation plan in place to immediately address it.

For businesses committed to cybersecurity, insurance providers usually charge lower premiums. On the other hand, for businesses that haven’t invested in cybersecurity, the risk of a claim is higher, and so is the insurance premium.

Make sure to keep all documentation of pen test results, which can help you negotiate the terms of your insurance policy. For example, you might be able to use positive test results as leverage to get a reduced rate or higher cyber insurance coverage limits.

Additionally, it’s important to align your pen testing results with other risk management practices. For instance, if a cybersecurity expert finds an internal phishing threat, consider installing multi-factor authentication (MFA) software on employee devices, using firewalls, and conducting regular employee cybersecurity training.

Ethical hacking and pen testing aren’t the same, but they work hand in hand.

Ethical hacking is a broad cybersecurity practice where a hired "red team" legally looks for system weaknesses through external tests. While penetration testing is a type of ethical hacking, there are other tests that fall under the ethical hacking umbrella, like wireless network hacking, web application security hacking, and social engineering tests.

Penetration testing is just one kind of ethical hacking. It specifically looks for weaknesses in a business’s operating system (OS), internal network, or external network. It doesn’t look at every single system that could potentially be exploited by a malicious hacker.

Many large organizations are using ethical hacking to spot security flaws and improve security controls before something goes wrong.

For example, Wells Fargo assembled a security team of ethical hackers, called the Offensive Security Research Team (OSRT), to identify flaws in the bank’s systems and prevent cyberattacks that could expose a customer's sensitive data.

Penetration testing should be performed on a regular basis. A one-time test likely isn’t sufficient to identify every security weakness. As your systems evolve, conducting pen tests once or twice a year will help you spot new threats that could pose a risk to your systems.

It’s also important to remember vulnerability assessments are just one piece of a risk management strategy. You should also be implementing other methodologies that improve your security posture, like backing up important data, installing the latest security software on employee devices, and encrypting your wi-fi network.

While external threats are possible, don’t ignore internal threats and human error. Employees who use weak passwords or fall for phishing scams can cause major issues for your business. Train your employees regularly on cyber hygiene and encourage a culture of cybersecurity awareness in the workplace.

Complete Insureon’s easy online application today to get free cybersecurity insurance quotes from top-rated U.S. companies.

If you need help purchasing cyber insurance or another policy, you can contact a licensed insurance agent at any point in the process. Our agents can also help you find the cheapest business insurance for your situation and coverage needs.

Once you find the right policy, you can usually begin coverage and get your certificate of insurance in less than 24 hours.