Penetration Testing Business Insurance

Data breaches cost U.S. businesses millions of dollars per year. Penetration testers can help reduce those costs by identifying vulnerabilities. It's often an essential service for regulatory compliance in certain industries due to its efficacy.

Penetration testing can help businesses:

• Safeguard private client data, including Health Insurance Portability and Accountability Act (HIPAA) information, and adhere to regulatory obligations, such as the General Data Protection Regulation (GDPR)
• Meet insurance company requirements for cyber insurance policyholders
• Fulfill the Payment Card Industry Data Security Standard (PCI DSS), which requires regular pen testing for a cardholder data environment (CDE)
• Obtain ISO 27001 certification
• Complete an audit for System and Organization Controls 2 (SOC 2)

Vulnerability management tools help strengthen a business's overall security posture, which is especially important in healthcare, technology, and financial services. A security breach could expose sensitive data belonging to thousands of customers.

Small businesses concerned about data protection should consider hiring a penetration testing firm for a cybersecurity assessment.

Identifying an organization’s security issues and cyber risk profile through pen testing can save companies thousands of dollars in fines, ransomware payments, and other costs.

"Penetration testing" and "ethical hacking" are often used interchangeably. Both aim to identify vulnerabilities in a client's computer systems in similar ways.

That being said, there are some subtle differences between them:

• Penetration testing: This modality tends to have a narrower, more systematic approach to vulnerability scanning. The pen testing client dictates the testing scope and the manual penetration testing methods to be used. Professionals provide a penetration test report detailing their findings and an actionable risk management plan for the client.
• Ethical hacking: Hacking is a broader approach that employs a wide range of techniques, including red teaming, which emulates real-world attack scenarios. For example, an ethical hacker might use social engineering techniques to simulate ransomware attacks and identify vulnerabilities in employees' security training.

Penetration Testing as a Service (PTaaS) businesses can usually obtain insurance through traditional insurers, whereas ethical hackers face higher risk and may need to purchase coverage from a non-admitted carrier. 

There are several factors underwriters consider when determining your pen testing insurance rates.

These factors include:

• Cybersecurity measures. Insurers often provide discounts for companies that implement specific security controls that help prevent data breaches, such as multi-factor authentication (MFA), firewalls, and ongoing employee training.
• Types of pen testing services. Companies that engage in narrower pen testing services will pay lower premiums than broader ethical hacking services, which are harder and more expensive to insure.
• Number of employees. More employees often means higher rates for your coverage. Additionally, many businesses with employees are required to carry workers' compensation insurance.
• Number of clients and vendors. If you have more clients and vendors, you face greater risk, which raises your insurance premiums.
• Annual income. The higher your annual revenue, the more you're likely to pay for coverage.
• Coverage limits and deductibles. The amount of coverage you carry and the deductible you choose will directly impact your coverage rates.
• Claims history. A history of insurance claims can directly increase your coverage costs because insurers will see it as an indicator of future claims.

Pen testers may need additional insurance policies to protect against other exposures:

• Business interruption insurance: Also called business income insurance, this policy helps with lost income and other financial costs resulting from a covered incident, such as a fire or other unexpected event.
• Equipment breakdown coverage: This policy protects your business from financial losses arising from the breakdown of specialized machinery and computers. It can often be added as an endorsement to your commercial property policy or BOP.
• Electronic data processing (EDP) insurance: Protects your electronic equipment, including storage devices and computers, if you experience data loss due to a power surge, fire, or covered natural disasters.
• Tools and equipment insurance: Also called inland marine insurance, provides coverage for company property while it’s in transit over land or stored at an off-site location. This coverage helps pay for the repair or replacement of tools and equipment if they're lost, stolen, or damaged.

It's easy for penetration testing professionals to save money on business insurance through a few simple steps:

• Practice risk management. Avoid costly claims that can increase your premiums by reducing your risks.
• Shop around. Get quotes from several insurance companies to find pricing that matches your budget. TechInsurance makes this possible with one easy online application.
• Pay the annual premium. Insurers offer two options for paying your premium: monthly or annual. Paying the full annual amount usually costs less.
• Bundle policies. When you buy multiple policies from the same insurance company, it's often possible to combine coverages for a discount. The most common bundles are a business owner's policy and a tech E&O policy.
• Pick only the policies you need. Figuring out the best insurance for your coverage needs will help you save money and prevent unnecessary out-of-pocket expenses.