What cyber insurers look at on your internet exposure
Cyber insurance applications and renewals increasingly ask how well a business protects what it exposes to the internet. What insurers ask varies by company and by policy, so this guide describes the common themes, not the rules of any one insurer.
Insurers can see your public systems too
Some insurers and brokers run their own outside-in scans of your domains before they quote or at renewal. What they find, such as an expired certificate, a remote access service open to the internet or missing email protection, can affect the price, the conditions or whether they offer cover. The practical advice is simple: know what they will see before they look.
The questions that come up most
- Do you scan your internet-facing systems for weaknesses, and how often?
- How quickly do you fix serious problems?
- Is remote access (such as remote desktop or a VPN) protected with multi-factor authentication?
- Is email protected against spoofing with SPF, DKIM and DMARC?
- Are your systems patched, and are backups kept and tested?
- Do you have an incident response plan and security awareness training?
An outside scan can speak to the first, second and fourth. It cannot see multi-factor authentication settings, backups, patching of internal systems, endpoint protection, training or plans. Those need your own records, and you should not claim otherwise on an application.
The weaknesses that are quickest to fix
- Remote access open to the internet. If remote desktop or a database port is reachable from anywhere, close it or put it behind a VPN.
- Missing email authentication. Publishing SPF, DKIM and DMARC records takes an afternoon.
- Expired or weak certificates. Renew, and set a reminder or automatic renewal.
- Forgotten systems. Old test sites, unused subdomains and abandoned vendor pages. Remove them or secure them.
- Outdated, exposed software. Public pages that announce an old version of a content management system or a web server are an easy target.
Keep a record, not just a result
A clean scan on one day proves little. A record that shows you check regularly, and how quickly you fix what turns up, tells a better story and answers questions an application is likely to ask. Keep the dates of your scans, what was found and when each issue was closed.
Be accurate on the application
Answer every question with what is true today. An inaccurate answer on an application can cause problems with a claim later, and no tool can answer for you. If something is not in place yet, say so, and fix it.
How Frontage helps
Frontage checks your public systems on a schedule and keeps the history. The insurance report in your portal summarizes that record for a chosen period: which checks ran and how often, what is open now, how fast problems were fixed and which common application topics it can and cannot speak to. Each report has an ID that a broker can use to confirm it came from Frontage and was not edited. It is evidence from automated monitoring of your internet-facing systems. It is not a certification, an audit or a guarantee, and it does not replace answering your application yourself.