InsurTech company KYND recently released a report exploring whether external or internal vulnerability scanning is more useful to assess a company’s cyber posture.
In the dynamic digital age where cyber threats emerge daily, the need for cyber insurance is at an all-time high, it said. Organisations are aiming to limit risk exposure, and underwriters are increasingly relying on external vulnerability scanning tools. These tools, known as outside-in scans, identify possible external entry points for intrusion and are used alongside traditional application forms to swiftly and accurately evaluate a client’s cyber risk profile.
However, there has been recent debate regarding the efficacy of these outside-in scans. Some suggest that internal vulnerability scanning might be more valuable to underwriters in assessing a company’s cyber risk profile. Internal scans, or inside-out scanning, identify a business’s internal network and its at-risk factors. So, is there any substance to this challenge? An exploration of both methods is warranted.
Historically, underwriters depended on application forms to assess business risks, but these often gave an unreliable picture, oversimplifying complex situations. With technological advancements, methods such as internal and external vulnerability scanning have become invaluable in offering a more comprehensive view.
External or outside-in scanning is a quick and usually non-intrusive approach to view a business’s vulnerabilities. Conversely, internal or inside-out scanning, takes a more in-depth look at an organisation’s internal network, focusing on workstations, servers, and software. The installation process can be prolonged and costly, but with the current global economic pressures, underwriters are evaluating whether a more thorough analysis may lead to cost savings and additional risk management value.
The question arises: which method should underwriters concentrate on? Both are essential to understanding a business’s risk position. However, some arguments suggest internal scanning as the superior choice, but the real answer requires deeper exploration.
Cyber criminals often exploit external methods to breach systems, targeting exposed infrastructure. Understanding what this means in practice involves analysing real-world cyber attack numbers and their implications. For example, email phishing susceptibility can be assessed by looking at protective measures and actively tested using non-invasive external scanning methods.
External scanning holds significant importance for cyber underwriters, allowing visibility into vulnerabilities exposed to the outside world. Most of these critical risk factors can be assessed pre-submission using external vulnerability scanning. Though the data is overwhelming, its effective use brings insurers closer to optimal underwriting outcomes.
Internal scanning often necessitates time-consuming and costly processes, requiring businesses to share sensitive internal access. In contrast, technology like KYND’s utilises external vulnerability scanning for quick evaluations, saving underwriters time and resources.
The benefit of external vulnerability scanning in cyber underwriting lies in enhancing risk assessment capabilities, driving intelligent underwriting decisions, establishing partnerships in risk management, and harnessing continuous monitoring. It’s about quality data over quantity.
Companies like KYND offer comprehensive solutions for underwriters to effectively assess their clients’ risk posture, allowing them to see critical vulnerabilities instantly and make evidence-based insurance decisions.
Read the full story here.
Keep up with all the latest FinTech news here
Copyright © 2023 FinTech Global
Copyright © 2018 RegTech Analyst
