Does blacklens.io lower my insurance premium?

That is your insurer's decision. What blacklens.io does: you answer the questionnaire with provable data instead of estimates, attach current reports and reduce the entry points that insurers rate as the main risk. In practice this improves your negotiating position; we cannot guarantee a premium.

What happens if statements in the questionnaire are incorrect?

The answers become part of the contract. If it turns out in a claim that a stated measure was not in place, the insurer may reduce or refuse the payout. That is why it matters to know the actual state, for example which accounts really have MFA and which services are really exposed. This is not legal advice; the exact consequences are governed by your policy conditions.

Which documents should we attach to the application?

The executive report with exposure score and trend, the current vulnerability report, a pentest report and an overview of MFA status from the IAM inventory have proven useful. All can be generated on a schedule so that the current state is available at renewal.

Do insurers really scan our systems themselves?

Increasingly, yes. Many insurers and reinsurers check the externally visible attack surface of applicants with their own tools: exposed services, outdated software, expiring certificates, open ports. You should know that picture before the insurer does. The free exposure check shows it to you in seconds.

Is cyber insurance enough as a security measure?

No. Cyber insurance covers the financial consequences of IT security incidents, such as business interruption, recovery, forensics, crisis communication, liability towards third parties and, depending on the policy, extortion. It prevents no incident and does not fully replace reputational damage or production downtime. After the ransomware waves of recent years, insurers also require minimum measures. Prevention and insurance complement each other; one makes the other affordable.

How quickly can we provide evidence?

After registering your domains, first results on the external attack surface are available within 24 hours. An executive report can be generated immediately; for MFA status you connect Entra ID or Google, for the internal patch state you roll out Sentry as a VM.

Which requirements does blacklens.io not evidence?

EDR, tested offline or immutable backups, security awareness training and the incident response plan itself come from other tools. blacklens.io complements these answers: Sentry records endpoints and their vulnerabilities, compromised devices from stealer logs show where endpoint protection failed, and the platform shows whether backup management interfaces are reachable from the internet. Dark web findings reveal training needs such as password reuse; alert forwarding to Teams, Jira or SIEM and the activity log evidence your response process.

Which questions should we ask our insurer?

Clarify five points before signing: how a claim is reported and what evidence is required, within what period an incident must be reported, whether ransomware, business interruption and recovery are covered, whether the policy can be adapted when your IT or the threat landscape changes, and when and how payouts are made, including the deductible. A cumbersome reporting process costs time in an emergency, and models from cost coverage to forensics and crisis communication vary widely.

Compliance

Cyber insurance: proving insurer requirements

Insurers ask about MFA, patch management, backups and your attack surface, and increasingly check the answers themselves. Prove them with continuous monitoring instead of estimating.

Start free trial Book a demo

Reportsscheduled by email

PDFExecutive reportWeekly, Monday 07:00

PDFVulnerability reportMonthly

PDFPentest reportAfter every test

Management, head of IT

What insurers typically ask

The answers become part of the contract. You can evidence the first seven points with blacklens.io; the last one needs other tools.

MFA on remote access

Missing MFA on VPN, RDP or Microsoft 365 is the most common starting point for ransomware.

Patch deadlines

Insurers expect defined deadlines, often 14 days or less for critical vulnerabilities.

Exposed RDP

RDP reachable from the internet is an exclusion criterion for many insurers.

External attack surface

Many insurers now scan the perimeter themselves. Know the result before they do.

Credentials on the dark web

Leaked passwords lead straight into the network, stolen session cookies even despite MFA.

Scans and pentests

Regular testing proves that you know and handle your risks.

Cloud and service providers

Public storage, over-privileged accounts and weak third parties raise the risk of loss.

EDR, backups and training

Delivered by other tools. blacklens.io does show exposed backup interfaces and infected devices.

Not legal or insurance advice. Conditions differ by insurer and policy; clarify details with your broker or insurer.

Answers based on data, not self-assessment

The questionnaire asks about the current state. With continuous monitoring you answer with today's state, not that of the last audit.

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

Identities and MFA3 directories

312Identities

17No MFA

9Privileged

12Stale (90 days)

admin.it@beispiel-gmbh.atPrivileged role without MFA, Entra IDCritical

m.hu•••@beispiel-gmbh.atWeak authentication only, GoogleHigh

c.wi•••@beispiel-gmbh.atPasskey, Entra IDPhishing-resistant

Remediationone workflow for every source

12Open

5In progress

2Risk accepted

48Closed

CVE-2024-21762

Assigned to IT operations
Update installed
Re-scan confirmed: closed automatically

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Visuals show sample data.

Four steps before renewal

1
Register your domains
First results on the external attack surface are available within 24 hours.
2
Connect identities and network
Entra ID or Google for MFA status, Sentry as a VM for the internal patch state.
3
Close entry points
Fix exposed services, exploitable vulnerabilities and leaked credentials first.
4
Attach reports
Generate executive, vulnerability and pentest reports on schedule for the renewal date.

Premium, deductible and insurability

A provable security level affects premium, deductible and coverage amount in practice. There is no guarantee; the decision lies with the insurer. What you can influence is the quality of your evidence.

Prerequisite for acceptance
Some insurers require MFA, no exposed RDP and tested backups upfront.
Early warning lowers the risk
Spot stealer logs and leak site entries before they turn into a loss.
Proof in the event of a claim
Activity log and finding history show what was in place at the time of the incident.

Progresslast 90 days

Critical findings143

Exposed services3821

Frequently asked questions

: That is your insurer's decision. What blacklens.io does: you answer the questionnaire with provable data instead of estimates, attach current reports and reduce the entry points that insurers rate as the main risk. In practice this improves your negotiating position; we cannot guarantee a premium.
: The answers become part of the contract. If it turns out in a claim that a stated measure was not in place, the insurer may reduce or refuse the payout. That is why it matters to know the actual state, for example which accounts really have MFA and which services are really exposed. This is not legal advice; the exact consequences are governed by your policy conditions.
: The executive report with exposure score and trend, the current vulnerability report, a pentest report and an overview of MFA status from the IAM inventory have proven useful. All can be generated on a schedule so that the current state is available at renewal.
: Increasingly, yes. Many insurers and reinsurers check the externally visible attack surface of applicants with their own tools: exposed services, outdated software, expiring certificates, open ports. You should know that picture before the insurer does. The free exposure check shows it to you in seconds.
: No. Cyber insurance covers the financial consequences of IT security incidents, such as business interruption, recovery, forensics, crisis communication, liability towards third parties and, depending on the policy, extortion. It prevents no incident and does not fully replace reputational damage or production downtime. After the ransomware waves of recent years, insurers also require minimum measures. Prevention and insurance complement each other; one makes the other affordable.
: After registering your domains, first results on the external attack surface are available within 24 hours. An executive report can be generated immediately; for MFA status you connect Entra ID or Google, for the internal patch state you roll out Sentry as a VM.
: EDR, tested offline or immutable backups, security awareness training and the incident response plan itself come from other tools. blacklens.io complements these answers: Sentry records endpoints and their vulnerabilities, compromised devices from stealer logs show where endpoint protection failed, and the platform shows whether backup management interfaces are reachable from the internet. Dark web findings reveal training needs such as password reuse; alert forwarding to Teams, Jira or SIEM and the activity log evidence your response process.
: Clarify five points before signing: how a claim is reported and what evidence is required, within what period an incident must be reported, whether ransomware, business interruption and recovery are covered, whether the policy can be adapted when your IT or the threat landscape changes, and when and how payouts are made, including the deductible. A cumbersome reporting process costs time in an emergency, and models from cost coverage to forensics and crisis communication vary widely.

Ransomware readiness

Close the entry points insurers fear most.

NIS2

Many insurer questions overlap with Article 21.

Free exposure check

What the insurer sees from outside, in seconds.

Compliance & audit

Overview of all frameworks.

Know what the insurer sees, before they see it

Start with your domains and receive an executive report within 24 hours that you can attach to your application.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings