Depends on the company. Mine (Coalition) does do scanning and ensuring basic metrics and protection are in place. For example, RDP ports must be closed, which is an auto-decline.
The client is given an output of our findings and what would be necessary for us to underwrite the policy.
Any cyber insurance company that does not do this is exposing themselves to outsized risk because they're writing policies based on incomplete data on their exposure.
The client is given an output of our findings and what would be necessary for us to underwrite the policy.
Any cyber insurance company that does not do this is exposing themselves to outsized risk because they're writing policies based on incomplete data on their exposure.