Cyber Insurance Vulnerability Scanning Requirements

Vulnerability scanning for cyber insurance

Cyber insurance applications have become security questionnaires, and vulnerability scanning is on every one of them. Underwriters want to know whether you scan, how often, and whether critical findings get fixed. Many carriers also run their own external scan of your domain before quoting. This page explains what they ask, how to answer with evidence, and how to have scanning in place before renewal.

What insurers actually ask

Application forms from the major carriers ask whether you perform regular vulnerability scans of internal and external systems, how frequently, whether critical and high-severity findings are remediated within a set time, and whether you use multi-factor authentication, endpoint protection and backups alongside. Underwriters also use outside-in scanning services to check your public attack surface for open ports, outdated software and exposed services, and a bad result raises your premium or ends the quote. A dated scan report with findings closed is the simplest way to answer yes with evidence.

What your auditor needs to see

External scan reports from at least the last quarter, showing no open critical findings.
Internal scan coverage of servers and workstations.
A stated cadence you can repeat on the application, monthly is a strong answer.
Evidence that critical and high findings were fixed and rescanned.
A scan of your public domain and IP range before you submit, so you see what the underwriter will see.

Getting it done this week

Clone Systems external vulnerability scanning covers your public domains and IP addresses, the same surface the underwriter scans and is ready the moment you check out. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. Add internal vulnerability scanning for your servers and workstations. Internal scanning is $1,095 a year for 128 IPs, $1,495 for 512, $2,295 for 2,048. Every package includes free rescans, and reports export mapped to cyber insurance from the portal.

Why Clone Systems

PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.

Buy vulnerability scanning · Talk to our scanning team

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.