No law requires a pen test to buy cyber insurance, and the carrier applications we read ask about testing instead of demanding it. Some ask whether you run one every year, and your answer goes into underwriting.
Somebody at a San Antonio company usually hits this question at renewal. The broker sends a form, one line asks about penetration testing, and the owner wonders whether the answer decides the premium or the coverage. Uprite sells scoped pen tests as part of our cybersecurity services in San Antonio, so we’ll say where a test is worth buying and where it isn’t. Our penetration testing in San Antonio page explains the full process. We read three carrier applications, a State of Indiana underwriting toolkit, an NAIC market report, and the one federal rule that does mandate testing for some businesses. If a test is the answer, here is how to prepare for a penetration test before the tester starts.
Cyber insurance doesn’t require a pen test by law, and the three carrier applications we read ask whether you test rather than making it a condition. Corvus asks about annual testing, Beazley asks how often, and Calsurance asks about third-party testing. A vulnerability scan can’t honestly answer a pen test question. Tax preparers and other financial businesses under the FTC Safeguards Rule need an annual test no matter what the policy says.
Does cyber insurance require a pen test?
A pen test is an authorized attempt to break into your network, apps, or staff the way a real attacker would, followed by a report of what worked. NIST SP 800-115 describes it as testing where evaluators “mimic real-world attacks.” A person does the work. A scan is software running down a list of known flaws.
Cyber insurance is a contract between you and a carrier. We didn’t find a federal or Texas rule that makes a pen test a condition of buying a policy, and none of the carrier forms we read lists one as a condition on its face. What they do is ask. The table shows the wording on each form.
| Source | What it asks about testing | Answer format |
|---|---|---|
| Corvus Smart Cyber Application, version 3.2, September 2024 | “Do you conduct penetration testing of your network at least annually?” It is question 17 of about two dozen, sitting between intrusion detection and employee training | Yes or no |
| Beazley InfoSec Application | Which procedures you use to test computer security controls, with a frequency for internal vulnerability scanning, external vulnerability scanning, and penetration testing | A frequency picked from a list |
| Calsurance cyber application | “Regular network security assessments/penetration testing performed by third parties?” It’s one line in a list of privacy practices | Yes or no |
| State of Indiana cyber insurance toolkit | Whether you run a vulnerability management tool, test your disaster recovery plan every year, and test backups for restorability. It has no pen test question on that page | Yes or no |
Carriers revise these forms, so read the table as a set of examples. Ask your broker for the version you’ll sign this year. The Corvus form is the only one of the three that carries a date. The Corvus application also defines the term in its glossary as a simulated pressure test, usually done by an authorized third party. The Beazley form and the Calsurance form are public PDFs, and the State of Indiana lists its questions on the Indiana Cybersecurity Hub.
What happens if your honest answer is no?
The forms don’t say. NAIC’s 2025 cybersecurity insurance report notes that companies investing in their security controls is “looked upon favorably by underwriters.” That’s as far as the regulator goes. Nothing we read says what a no costs or whether a yes earns a credit, so any article quoting you a percentage is guessing.
We’d ask the broker two things. What does this carrier do with a no? Would a recent scan and a dated fix plan satisfy the underwriter? None of the forms we read answers either one.
We wouldn’t answer yes because a vulnerability scan ran last month. Our cyber insurance application guide covers Travelers v. International Control Services, filed in federal court in Illinois in July 2022. The carrier asked to void the policy because multifactor authentication covered the firewall and little else, and the policyholder agreed in a stipulation that the policy was void from inception. A scan passed off as a pen test sets up the same kind of dispute.
When does something other than the policy require testing?
The FTC Safeguards Rule does. We read 16 CFR 314.4(d)(2) in the eCFR. It says testing “shall include continuous monitoring or periodic penetration testing and vulnerability assessments.” A business without effective continuous monitoring has to run “annual penetration testing of your information systems determined each given year based on relevant identified risks.” It also has to run vulnerability assessments “at least every six months” and after material changes to its operations.
The rule covers the non-bank financial institutions the FTC regulates, such as tax preparers and mortgage brokers. San Antonio has CPA offices in Alamo Heights and mortgage shops on the North Side that fit. A client contract can add its own demand too, since a hospital system or a bank can put a testing date in a vendor questionnaire. PCI DSS sets its own schedule for businesses that take cards, which your acquirer or assessor can confirm.
Pen test, vulnerability scan, or neither?
The wording on the form decides. Here’s each testing question we found, matched to the work that answers it.
| Question as written | What answers it | Where it comes from |
|---|---|---|
| Do you run a vulnerability management tool? | A scan report with a date on it | Indiana toolkit |
| Do you conduct penetration testing at least annually? | A pen test report from the past 12 months | Corvus question 17 |
| How often do you test, from continuously to annually? | The frequency you actually keep, scans and pen tests listed separately | Beazley InfoSec |
| Are assessments or pen tests performed by third parties? | A report from an outside firm, not an in-house scan | Calsurance |
| Annual penetration testing scoped by your risk assessment | A pen test, with a scan every 6 months on top | 16 CFR 314.4(d)(2) |
A scan report answers the first row and doesn’t answer the rest. We’d also put MFA, backups, and patching ahead of any test, because a test of an open door only tells you the door is open. Our comparison of pen testing and vulnerability scanning covers the difference in more detail. If a carrier does ask for a test, our ranking of the best penetration testing companies in San Antonio shows who can run one locally.
What does the San Antonio picture look like?
We pulled the breach reports businesses file with the Texas Attorney General and filtered for the San Antonio area, meaning San Antonio plus nearby cities such as Windcrest, Converse, Floresville, and New Braunfels. Between November 7, 2025 and November 6, 2026, the office posted 276 Texas-based filings. Twenty-five of them came from our area.
Healthcare providers filed 9 of the 25. Another 7 checked the retail or merchant box, and 2 of those were law offices. Medical information turned up in 17 filings. The largest filing affected 191,848 Texans and the smallest affected 287. The median was 3,394, and 15 of the 25 were under 5,000.
Those are dental offices, small clinics, and firms with a few dozen staff. A company holding the same kind of data shouldn’t be surprised by a testing question on its form. And for anyone who can’t say what a test would cover, a cyber risk assessment in San Antonio costs less and shows where to aim.
What does a small test cost, and what goes to the broker?
For price we went to federal contract rates. The GSA CALC rate tool lists what vendors bill the government. When we pulled it in November 2026, it returned 441 pen-tester rates from 142 vendors, with a median of $155.78 an hour, or about $1,246 for a tester day. A 3 to 5 day external test would land between $3,700 and $6,200 in labor. The day counts are our own assumption, a real quote depends on scope, and Uprite doesn’t publish a flat price. For the rest of the budget, see what cybersecurity costs in San Antonio.
An underwriter needs a date and a scope, and nobody at the broker’s desk will read a 90-page report. A short package from the tester should hold four things.
- The signed scope, listing the systems that were tested and the dates.
- A one-page summary of findings, ranked by how bad each one is.
- A fix list where every item gets an owner and a due date.
- Proof that the serious items were retested and closed.
Our honest take is that a pen test is the wrong first purchase for a company that hasn’t turned on MFA everywhere or confirmed its backups restore. If your form already asks and you’re ready, send us the question and your last scan, and we’ll tell you what you need.
Common questions about pen tests and cyber insurance
Is a pen test required to get cyber insurance in Texas?
No. We read three carrier applications, a State of Indiana toolkit, and NAIC’s 2025 report, and none of them makes a pen test a condition of buying a policy. Corvus asks about annual testing, and the others ask about frequency or third-party work.
Will a pen test lower my premium?
We found no source that ties a pen test to a discount. NAIC’s 2025 report says only that stronger controls are looked upon favorably by underwriters. Ask your broker whether a specific carrier gives credit before you buy a test for that reason.
Can a vulnerability scan count as a pen test?
Not under the Corvus wording, which asks about penetration testing, and not under the FTC rule, which lists pen tests and vulnerability assessments separately. A scan checks for known flaws, and a pen test has a person trying to get in.
How often should a San Antonio business test?
Once a year, going by Corvus and the FTC Safeguards Rule. The rule adds vulnerability assessments at least every six months and after material changes to operations. Beazley’s form lets you report any frequency from continuous to annual.
What should I tell my broker if we’ve never had a pen test?
Say so plainly. Corvus and Calsurance both offer a simple no. Pair it with what you do run, such as scans, MFA, and backups you’ve restored as a test, and a month for the first pen test.
Does the type of business change the answer?
Yes. Tax preparers and mortgage brokers fall under the FTC Safeguards Rule, which names annual pen testing. Everyone else meets the question on an insurance form or a client questionnaire, and the wording on that form decides what counts.
Send us the testing question from your cyber insurance application and your last scan report. We’ll tell you whether you need a pen test, a scan, or neither.
Talk to a security expert
