Cyber insurance security scan tool: matching findings to answers

A cyber insurance security scan tool looks at a company the way an attacker on the internet would: open ports, login pages, software versions, certificates, email records and leaked credentials. A carrier can order an outside-in scan from a specialist provider because it shows, without the insured's help, whether some application answers are true. But a scan report is a list of findings, not a decision. Someone still has to tie each finding to a control and to the signed answer it tests, discard what does not matter, and say which answers the scan cannot reach. Botminds' Cyber Underwriting Risk Assessment does that second job. Its scan matcher reads the scan the carrier ordered and the penetration test the broker sent, maps each finding to a control, and hands the control grader the evidence; it never runs a scan or touches the insured's systems.

This guide is for underwriting leads choosing how scans enter their process. It covers what a scan can and cannot show, how a finding becomes evidence against a signed answer, how old a scan can be, and what to ask of any tool in this chain, including where ours fits and where it does not. Examples come from a fictional sample submission, a freight company whose scan found 11 findings on 37 internet-facing assets.

What does an outside-in scan show cyber insurers?

An outside-in scan shows what an attacker could find before breaking in. NIST's guide to security testing describes external testing as an attempt to "view the environment's security posture as it appears outside the security perimeter—usually as seen from the Internet—with the goal of revealing vulnerabilities that could be exploited by an external attacker" (NIST SP 800-115, 2008). For an insurer, that view answers specific questions on the application.

Which services are open to the internet, and is remote desktop one of them? Do the VPN portal and remote-management pages ask for a second factor? Which software versions do banners reveal, and are any of them on CISA's list of known exploited vulnerabilities? Are certificates expired? Does the domain publish SPF, DKIM and a DMARC policy that is enforced? Have employee credentials appeared in breach data, and are any of them administrator accounts? Each of those is a fact about the company that the company did not have to report.

What an external attack surface scan cannot see, and how often it is wrong

An external scan cannot see anything behind the perimeter, and it reports some things that are not there. NIST's testing guide sets external testing beside internal testing for that reason: assessors working from inside "assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses", and reach systems, accounts and configurations the outside view never touches. For underwriting, that means MFA on email and administrator accounts, EDR coverage, backups and segmentation stay with the insured's own evidence.

The scan is also not always right. NIST warns that because the process "is highly automated, vulnerability scanners can have a high false positive error rate (i.e., reporting vulnerabilities when none exist). An individual with expertise in networking and OS security should interpret the results." Scanners also miss things. The working rule for an underwriter follows: a scan finding is strong evidence when it is specific (an address, a port, a banner, a first-seen date) and corroborated over time, and weak when it is a single inferred version with no date. A matching tool should carry those details through to the grade, so the person deciding can see which kind they have.

From finding to control to answer: the scan matcher at work

The scan matcher's job is translation: turning each finding into a statement about one control, so that the control grader can put it beside the signed answer for that control. In the sample, the scan of 9 October found 11 findings on 37 internet-facing assets, and five of them bore on graded controls. The edge VPN appliance on firmware with a known-exploited flaw went to critical patching. Remote desktop open on port 3389 with no MFA gateway went to MFA on remote access. A web server banner for software out of support since October 2023 went to unsupported systems. DMARC at p=none went to email authentication, and 23 credentials in breach data, none of them administrators, went to leaked credentials.

Severity and relevance are different scales, and the matcher keeps both. The scanner's severity says how bad a finding is in general; the mapping says which answer it tests. A low-severity expired certificate tests nothing on the application. A critical remote desktop exposure contradicts a signed yes and becomes a pre-bind subjectivity. The figure below shows how the sample's findings sorted.

The outside-in scan as the scanner recorded it, each finding tied to a control

How do insurers use known exploited vulnerabilities in a scan?

They use them to turn a version number into a dated fact. A banner that says an appliance runs a given firmware is a weak signal on its own; the same banner matched to an entry on CISA's Known Exploited Vulnerabilities catalog says the flaw has been used by attackers, and gives the date CISA listed it. CISA's current directive for federal agencies, BOD 26-04, sets remediation urgency from four questions, and the first two are the ones a scan answers: "Is the vulnerable asset publicly exposed?" and whether the vulnerability is on the catalog (CISA BOD 26-04, 10 June 2026).

In the sample, the edge VPN appliance carried a flaw listed on 21 August; the application, signed on 18 September, said critical patches are applied within 14 days. The listing date makes the contradiction a matter of arithmetic. How the catalog works, and the questions it lets an underwriter ask, are in CISA known exploited vulnerabilities for underwriters.

How old can a cyber scan be before it is reread?

There is no regulatory maximum; it is a carrier setting, and it should be short. Exposures change in days: a remote desktop port opened for a vendor, a firmware update applied or skipped, a new entry on the exploited list. CISA's directive makes the same point about its own timelines: they "are dynamic as facts change", and one valid mitigation is to take a system off the internet, which changes the answer to the exposure question. A scan from last quarter describes last quarter's company.

The sample carrier reruns any scan older than 30 days before grading. The first-seen date matters as much as the scan date. The sample's remote desktop exposure was first seen on 2 August and still open on 9 October, at least 68 days, which says more about the company's control of its perimeter than a single sighting would.

The scan settings: read on arrival, rerun when stale

Can a scan replace a cyber insurance questionnaire?

No. A scan settles the controls that face the internet, and most of a ransomware supplement asks about controls that do not. Of the fifteen controls the sample carrier grades, the scan fed five; the penetration test, the supplement's own counts, a restore-test report and the loss history fed the rest. New York's regulator frames the two as complements: information-gathering through surveys and interviews first, with external cyber risk evaluations as an additional source (DFS Circular Letter No. 2, 2021).

The reverse is also true: the questionnaire cannot replace the scan. The questionnaire records what the applicant believes or represents; the scan records what is there. The value is in the comparison, and the comparison is the step that gets squeezed when the quote is due on Friday.

What scan findings lead to a declined or conditioned cyber quote?

The carrier's guide decides, not the scanner. A finding leads to a decline only when it fails a control the guide treats as eligibility and cannot be fixed before binding. In the sample guide, MFA on remote access is an eligibility control, yet the exposed remote desktop became a pre-bind subjectivity, because it can be fixed in days and confirmed by a rescan. The subjectivity carries a consequence: if it is not met at binding, ransomware cover is sublimited.

Public guidance explains why exposed remote access weighs so heavily. CISA tells organisations: "Do not expose services, such as remote desktop protocol, on the web", and to disable unused ports and protocols, naming "Remote Desktop Protocol [RDP]—Transmission Control Protocol [TCP] Port 3389" as the example (CISA #StopRansomware Guide). Which MFA evidence settles the question once the port is closed is in does cyber insurance require MFA.

What to look for in a cyber insurance security scan tool

Buy two capabilities, and do not confuse them. The first is the scan itself: coverage of the insured's internet-facing estate, accuracy, first-seen dates, and a format that can be read by the next step. The second is the matching: a tool that reads the scan beside the application and the supplement and grades your controls. A scanner with a risk score gives you the first and a number; it does not tell you which signed answer is untrue.

Where Cyber Underwriting Risk Assessment fits, and where it does not

The solution is the matching step, not the scanner. If you need someone to scan insureds, you need a scan provider; the solution reads that provider's report. Its scan matcher reports only what the scan recorded and never probes the insured's systems, and where the scan was the evidence for a contradiction, the subjectivity it drafts asks for a rescan before binding.

What it adds is the rest of the chain: the same reading applied to the penetration test, the application, the supplement and the loss history; every finding tied to a control and an answer; every grade citing both sides; and a run log that shows what each agent did and how long it took. On the sample submission the matcher's step took 22 seconds and the whole graded check under four minutes of agent time; the solution's design target, from documents to a graded scorecard, is 25 minutes.

The check, step by step: what each agent read and how long it took

Questions people ask

Do cyber insurers scan my company?

A carrier may order an outside-in scan when your submission arrives. It looks only at what is reachable from the internet: open ports, login pages, banners, certificates and email records. It does not enter your network. New York's regulator names external cyber risk evaluations as a valuable source of underwriting information.

What is an external attack surface scan?

It is an inventory of an organisation's internet-facing assets and their weaknesses, taken from outside. NIST describes external testing as viewing the security posture "as it appears outside the security perimeter", with the aim of finding what an external attacker could exploit.

Is an outside-in scan the same as a penetration test?

No. A scan inventories and checks what is exposed; a penetration test tries to exploit weaknesses, often from inside, and reaches accounts and systems a scan cannot. In the sample, the scan found the exposed remote desktop, and the penetration test found two administrator service accounts without MFA.

Can a scan be wrong about my company?

Yes. NIST notes that automated vulnerability scanners can have a high false positive rate and that an expert should interpret results. If a finding is wrong, the fix is evidence: a rescan, a configuration screenshot or a short note from your IT team, sent through the broker before binding.

How do I fix a finding before binding?

Close or protect the exposure, then ask for the carrier's rescan. In the sample, the subjectivity asks the insured to close remote desktop on the named address or put it behind an MFA-enforced VPN, with the insurer's rescan to confirm, and sublimits ransomware cover if it is not met at binding.