CREST-accredited penetration testing Services
Does cyber insurance require a penetration test?
It’s one of the first questions brokers get asked, and, like most things in insurance, the honest answer is “it depends”, with some important nuance.
Very few policies name penetration testing as a blanket, mandatory condition. What is happening, across almost every insurer, is that the security questionnaire you complete to get a quote has grown longer and sharper. Insurers now ask detailed questions about your controls, your vulnerability management and your testing, then price your risk, or decline it, on your answers. At higher limits, in higher-risk sectors, or after a previous claim, independent testing is increasingly expected, and sometimes required outright.
There’s a second reason that matters more than most people realise. That questionnaire is a declaration. If you answer it inaccurately, even honestly but wrongly, an insurer may reduce or refuse a claim at the worst possible moment. A penetration test tells you what your security posture genuinely is, so you can answer accurately, evidence what you’ve claimed, and protect the cover you’re paying for.
Put simply: testing rarely gets you the policy on its own, but it can help you secure cover, improve your premium, and, above all, make sure your insurance actually responds when you need it. If your insurer, broker or proposal form expects independent testing, we make satisfying that requirement straightforward.
How testing supports your cover: What a penetration test does for your cyber insurance
A cyber insurance penetration test isn’t a standalone exercise. It’s evidence that supports you at every stage of the insurance relationship. Here’s how it helps:
- Securing cover: Insurers increasingly want proof of your controls before they’ll quote. Recent, independent testing helps you demonstrate you’re an acceptable risk, not a decline.
- Answering the proposal form accurately: The application is a declaration, and misrepresenting your security, even unintentionally, is one of the most common reasons claims are reduced or refused. Testing shows you what your true posture is, so your answers are grounded in evidence rather than assumption.
- Premium and terms: A demonstrable, tested security posture gives underwriters fewer reasons to load your premium or attach restrictive terms. It won’t guarantee a lower price, but it strengthens your hand.
- Meeting policy conditions: Where your policy makes testing a condition or expectation of cover, we help you satisfy it cleanly, with a report your insurer can accept.
- Evidence at renewal: Cover is reassessed every year, and current testing evidence makes renewal smoother and your negotiating position stronger.
- Reducing the chance of a claim: The best insurance outcome is never needing to claim. Testing finds and helps you fix the weaknesses an attacker would use, before they do.
The result is a test that does double duty: it genuinely strengthens your security, and it produces the evidence your insurance position depends on.
START HERE
Not sure which test you need?
Most people searching “pen test” aren’t sure yet, that’s normal. Pick the closest match, or talk it through directly with a tester. We can incorporate multiple testing types for a single project. We often do web app + network testing if a business wants to cover both.
WHY TRUST CODESHIELD
Trusted & Independently verified.
Which test do you need for cyber insurance?
The right test depends on what your business runs and where your risk sits. Most organisations need one or two of the following, and we’ll help you scope the right combination on a short call. We regularly combine testing types, for example web application plus network testing, to cover your full attack surface in a single engagement.
- Web Application Pen Testing: Customer-facing apps, portals and API layers. Great for SaaS and online businesses.
- Network Penetration Testing: Internal and external infrastructure, remote access and patching. Great for network-heavy and multi-site businesses.
- Cloud Penetration Testing: AWS, Azure, GCP and Microsoft 365 environments. Great for cloud-based businesses.
- Social Engineering: Phishing, vishing and pretexting. Great for evidencing the human-risk controls insurers ask about.
- AI / LLM Penetration Testing: Prompt injection and data leakage. Relevant where AI is part of your systems.
- Mobile Application Pen Testing: Customer-facing apps on iOS and Android.
Still not certain? Tell us what you run and we’ll scope it with you on a 15-minute call.
What your cyber insurer is really looking for
Cyber insurance proposal forms have become detailed security audits in their own right. Insurers want evidence of specific controls, and how you answer directly affects whether you’re covered, what you pay, and whether a future claim pays out. The controls they most commonly probe include:
A penetration test directly evidences several of these controls and validates the rest, which is exactly why testing has moved from “nice to have” to something underwriters expect to see. We’ll help you scope testing that speaks to the questions your insurer is actually asking.
WHY CODESHIELD – 20+ YEARS EXPERIENCE
You work with the person doing the testing.
At CodeShield, our UK penetration testing team brings 20+ years of combined expertise delivering practical, results-driven security solutions tailored to your business.
You work directly with a fully-qualified pen tester. You meet them before you pay, so you know who you’re working with.
Our Values
What’s in your penetration testing report
The report is where a penetration test earns its value. For cyber insurance it does double duty: it tells your team what to fix, and it’s the independent evidence that backs up your declarations to your broker and insurer. Ours are built to be read and acted on, not filed away.
See a sample report
Want to see the quality of our reporting before you commit? Download an anonymised sample penetration testing report and see exactly what you’ll receive: the structure, the depth of detail, and the clarity of our remediation advice.
When to test for cyber insurance
Getting the timing right means your evidence is current when it counts. Consider a penetration test when:
- You’re applying for cover: Test before you complete the proposal form, so your answers are backed by evidence and you go to market as a stronger risk.
- Your renewal is coming up: Cover and pricing are reassessed every year. Recent testing is one of the clearest ways to show your posture has held or improved.
- Your insurer or broker asks for it: Where testing is a condition or expectation, we help you satisfy it with a report they can accept.
- You’ve made significant change: New applications, migrations, integrations or major releases can change your risk, and your declarations. Testing keeps your evidence, and your answers, accurate.
- You’ve had a near miss or an incident: Fresh testing evidence strengthens your position at your next renewal, when underwriters will be paying close attention.
- It’s simply been a while: Best practice is at least annually, and many insurers now effectively expect it.
Not sure which of these applies to you? A quick scoping conversation will tell you what you need, and just as importantly, what you don’t.
LIVE REPORTING
Stay informed throughout your penetration test with real-time access to findings through our secure client portal.
Stay informed throughout your penetration test with real-time access to findings through our secure client portal.
As vulnerabilities are identified, they’re immediately available for your team to review, giving you complete visibility as the assessment progresses. Any High or Critical findings are communicated straight away via your agreed contact channels, so urgent risks are never left waiting until the final report.
Our collaborative approach also allows for interactive re-testing during the engagement. As fixes are implemented, our consultants validate them in real time, helping you reduce outstanding vulnerabilities and close findings, ideally before your application or renewal date.
At the end of the engagement, your portal is updated with the final quality-assured report: a comprehensive record of the assessment, findings, remediation guidance and supporting evidence.
TRUSTED UK PENETRATION TESTERS
Contact CodeShield today for your cyber insurance pen test
At CodeShield, our UK penetration testing team brings 20+ years of combined expertise, delivering practical, results-driven security tailored to your business.
Penetration testing FAQs
In black box testing the tester has no prior knowledge of the application. In white box testing they have full access to code and documentation. Grey box sits in between, with partial knowledge for a realistic yet efficient assessment. We’ll help you choose the right approach for your goals during scoping.
Our testing is designed to minimise disruption. We agree all rules of engagement with you during scoping, and where any activity carries a risk to stability, we plan it carefully and keep you informed throughout.
The cost depends on scope: the cloud platforms involved, the size and complexity of your environment, and the depth of testing required. Rather than quote a misleading flat rate, we scope every engagement individually so you only pay for testing that delivers real value. Get in touch for a tailored quote.
Traditional testing targets code, infrastructure, and known vulnerability classes. AI penetration testing adds the behaviour of the model itself, testing how it can be manipulated, what it can be made to reveal, and what it can be tricked into doing. It requires a different mindset and adversarial techniques that standard tools and tests don’t cover.
We have extensive experience across AWS, Azure, and Google Cloud, and we also support hybrid and multi-cloud environments. Every engagement is tailored to the platforms and services you actually use.
Most major providers now permit customer-authorised penetration testing of your own environment, though some activities carry specific rules. We handle this as part of scoping, ensuring all testing stays within your provider’s acceptable use policies.
Prompt injection is the most significant vulnerability affecting LLM applications. It occurs when crafted input, either directly from a user or hidden inside content the model processes, manipulates the model into ignoring its instructions or behaving in unintended ways. Testing for it is a core part of every AI engagement we run.
