Your underwriter is already scanning your domain. This is what they find.

A cyber insurance application asks you to describe your security practices. Underwriters and their vendors treat that as self-reported information, which means they verify it independently. Most major carriers and their third-party risk vendors often scan your public domain at renewal time using passive automated tools to grade your external posture before issuing a quote.

This scan runs against your externally reachable infrastructure the same way an attacker's reconnaissance would. It catalogs what services are running, what certificates are installed, what email authentication records are published, and whether known vulnerability signatures are detectable. The results feed directly into the underwriter's risk model.

You are not notified when this scan runs. It does not require your cooperation or knowledge. In many cases the results inform your quote before you have finished your application.

The scanning tools used by underwriters and security researchers check the same categories, with the same methodology, against the same public data sources. The findings are not exotic. They are the standard configuration failures present on thousands of small business and public-sector domains.

• Expired or self-signed TLS certificates on public login pages and customer portals
• Remote desktop (RDP) or remote management interfaces visible on the public internet
• Missing DMARC records, or DMARC records published with a policy of "none," which provides zero enforcement and zero protection against spoofing
• SPF records with a "+all" qualifier, which explicitly permits any IP address on the internet to send mail as your domain
• Open administrative panels for content management systems, routers, or network equipment
• Services running outdated software versions with publicly documented vulnerabilities
• Staff email addresses appearing in public breach datasets, often paired with reused passwords

Each of these findings requires one lookup, one database query, or one port connection to identify. They take minutes to catalog and hours to remediate. The cost differential between fixing them before underwriting and explaining them after a quote returns is significant.

Not all findings produce the same outcome. Underwriters weight risk findings by severity and by how directly they correlate with known loss patterns. An open RDP port is weighted heavily because it is the initial access vector in a substantial percentage of ransomware claims. A missing or unenforced DMARC record is weighted heavily because Business Email Compromise is the leading cause of cyber insurance losses by total dollar amount, according to FBI cybercrime reporting.

The possible outcomes when a passive scan finds these issues during underwriting:

An external visibility review completed before your renewal window serves a specific purpose in the insurance context: it replaces the underwriter's passive scan as the primary source of truth for your external security posture. You control when the review runs and what it finds before the underwriter does their own check.

When you provide a third-party perimeter review that documents what was found, what was remediated, and what your current configuration looks like, you shift the conversation from reactive to proactive. Underwriters for policies above certain coverage limits frequently request this documentation as a condition of quoting.

More practically: if our review identifies open issues and your IT team resolves them before the underwriter runs their scan, the underwriter's scan finds a clean perimeter. The policy is priced against what exists, not what existed before you looked.