Most insurers still buy security testing the same way. They hire a consulting firm once a year, get a PDF, and file it for the NYDFS or state certification.
Meanwhile the attack surface changes every sprint. Policyholder portals, agent and broker portals, quote APIs and claims apps all ship updates faster than an annual test can keep up with.
This guide covers the five main alternatives to the annual manual pentest: PTaaS, automated and AI penetration testing, bug bounty programs, in-house red teams, and hybrid models. For each one it explains where it fits in an insurance security program and what regulators expect.
Quick answer. Insurers have five main alternatives to a manual pentest firm. The first is PTaaS, which provides on-demand human testing through a platform. The second is automated or AI penetration testing, which tests continuously after releases. The third is bug bounty and vulnerability disclosure programs, where outside researchers find issues and are paid per finding. The fourth is an in-house red team, where internal staff simulate real attackers. The fifth is a hybrid of these. Most regulated insurers end up running a hybrid model, with continuous testing between releases and an independent annual test for certification.
Why Insurers are Rethinking the Annual Manual Pentest
The attack surface outgrew the annual cycle
An insurer's exposure no longer sits in one data center. It spans all of these:
Policyholder self-service portals
Agent and broker portals
Quote-and-bind and rating APIs
FNOL and claims mobile apps
Integrations with TPAs, MGAs and data vendors
Legacy policy administration systems behind them
Each of those changes on its own release schedule. A test run in March says little about the claims API rewrite that shipped in August.
Attackers are exploiting systems faster
For the first time in the report's 19-year history, exploiting vulnerabilities overtook stolen credentials as the top way attackers got in. The share of breaches that began with vulnerability exploitation rose to 31%, up from 20% the year before.
That said, breaches involving a third party jumped 60%, and third parties are now involved in 48% of all breaches. For insurers that rely on TPAs, MGAs and data aggregators, that finding directly affects what a pentest has to cover.
Insurers are a named target
In June 2025 the insurance sector became a specific target. Google Threat Intelligence Group reported that actors matching Scattered Spider's profile had shifted from retail to insurance, pointing to incidents at Erie Insurance, Philadelphia Insurance and Aflac. Google warned insurers to watch for social engineering aimed at their call centers.
Aflac's SEC filing said it detected unauthorized access on June 12 and believed the intrusion was contained within hours. The entry point was people and help-desk processes, not a flaw in an application. That shapes which of the alternatives below actually covers the risk.
The cost of getting it wrong is rising
IBM's 2026 Cost of a Data Breach Report put the average US breach at $11.5 million, more than twice the global figure. Of the 30 cost factors IBM analyzed, a business partner or supply chain compromise added the most to breach costs, about $227,250 above the global average.
For a deeper look at how these incidents unfold, see how insurance companies get hacked through portals, APIs and vendors.
What Regulators Expect From Insurer Penetration Testing
Before replacing a manual firm, check what your regulators actually require. The wording matters, because some rules say the test can be done in-house and others require independence.
Rule | What it requires | What it means for choosing an alternative |
|---|---|---|
NYDFS 23 NYCRR 500.5 | An annual penetration test from both inside and outside the system boundaries, performed by a qualified internal or external party. Automated scans, plus manual review of anything the scans miss, at a frequency set by the risk assessment and promptly after material system changes | Internal testers qualify. Continuous testing helps meet the change-driven scanning requirement |
NAIC Insurance Data Security Model Law (#668) | Licensees must develop, implement and maintain an information security program, investigate cybersecurity events, and notify the state insurance commissioner | Requires regular testing of controls. Check the exact text your state adopted |
EU DORA (TLPT) | Designated entities must run threat-led penetration testing at least every three years. Entities that use internal testers must bring in external testers for every third test | In-house red teams are allowed, but periodic external testing is required |
HIPAA (for health insurers) | HHS has proposed penetration testing at least once every 12 months and vulnerability scanning at least every six months | Whether the rule will be finalized as proposed, narrowed, delayed or withdrawn is still unknown. Many health plans are planning for it anyway |
PCI DSS v4.0.1, Req. 11.4 | Pentest by a qualified internal resource or external third party, with organizational independence | Applies wherever you take card payments for premiums |
The 2023 NYDFS amendments tightened this further. They removed the carve-out that had let continuous monitoring replace testing, and made annual inside-and-outside penetration testing a minimum requirement. Continuous testing now adds to the annual test. It no longer replaces it.
For section-by-section detail, see the guides to NYDFS penetration testing requirements, NAIC Model Law testing and GLBA penetration testing.
What Manual Pentest Firms Do Well and Where They Fall Short
A good consulting firm brings depth. Experienced testers chain business-logic flaws, abuse authorization edge cases in claims workflows, and write reports that auditors accept without questions.
The problems come from the delivery model, not the testers:
Lead time. Booking a test often takes weeks.
Point in time. Coverage stops the day the engagement ends.
Retest cost. Retests are often billed separately.
Fixed scope. The scope is agreed before testing starts and doesn't follow new releases.
For insurers shipping portal and API changes every few weeks, that leaves long stretches with no testing at all. More detail on what manual penetration testing covers and on pentest pricing by test type.
The Five Alternatives at a Glance
Approach | How it works | Best fit for insurers | Can it cover the annual test alone? | Typical pricing | Example vendors |
|---|---|---|---|---|---|
PTaaS | Human testers booked through a platform, with findings in a dashboard | Mid-size carriers and MGAs that want faster scheduling and retests | Often, if testers meet "qualified" and cover inside and outside | Subscription or credits | Cobalt, BreachLock, Astra |
Automated / AI pentesting | Software runs attack paths and validates exploits continuously | Insurers and insurtechs with frequent releases | Rarely on its own. Pair with human sign-off | Subscription, per asset or per app | CodeAnt AI, XBOW, Horizon3.ai NodeZero, Pentera |
Bug bounty / VDP | Outside researchers report issues and are paid per valid finding | Public-facing portals and apps with mature triage | No. There's no guaranteed scope or coverage | Program fee plus bounties | HackerOne, Bugcrowd, Intigriti, YesWeHack |
In-house red team | Internal staff simulate real adversaries, including social engineering | Large multi-line carriers and DORA-scoped insurers | Yes under NYDFS if qualified. DORA needs an external test every third time | Staff salaries plus tooling | Built internally, often with MITRE ATT&CK-based tooling |
Hybrid | Continuous testing plus an independent annual test, plus a VDP or red team | Most regulated insurers | Yes, by design | Mixed | Combination of the above |
1. PTaaS (penetration testing as a service)
PTaaS delivers human-led pentests through a software platform. You book scope in a portal, see findings as testers log them, and request retests without writing a new statement of work. For insurers, the main gain is speed. A new agent portal release can be scoped and tested in days rather than waiting for the next annual engagement.
Where PTaaS fits:
Evidence. The reports carry the same weight as a traditional firm's, because the work is still done by qualified human testers.
Retests. Retesting a fixed finding usually takes days and doesn't need a new contract.
Traceability. Findings flow into Jira or ServiceNow, which gives you a record of remediation for certification.
Where it falls short:
Still scheduled. Testing happens on booked dates, even if those dates are easier to get.
Uneven depth. Quality depends on which testers are assigned to your engagement.
Credit limits. Credit-based plans can make you ration how many assets get tested.
When evaluating PTaaS platforms, ask four things:
Can you see each tester's qualifications?
Does the scope cover internal testing as well as external?
What are the SLAs for scheduling, reporting and retests?
How is policyholder data handled during testing?
For a primer, see what PTaaS is and how it works. For benchmarks, see the SLAs leading PTaaS providers guarantee.
2. Automated and AI Penetration Testing
This category covers three different kinds of tools, so it helps to separate them:
Vulnerability scanners find known issues. They don't exploit anything.
Automated pentest platforms such as Horizon3.ai NodeZero and Pentera validate attack paths through internal networks and Active Directory.
AI penetration testing tools such as CodeAnt AI and XBOW focus on applications and APIs. They chain findings into working exploits, and some also read source code to find the flaws that attackers reach from outside.
Where it fits for insurers:
Change-driven testing. NYDFS 500.5 expects scanning promptly after material system changes. Tools that test every release support that obligation directly.
Faster turnaround. Findings arrive with proof of exploit and can be retested on demand, which shortens the time from finding to fix.
Coverage between annual tests. The quote API or claims app that changed in August gets tested in August.
Where it falls short:
Social engineering. Automated tools don't test help-desk or call-center processes, which is the route used in the 2025 attacks on insurers.
Complex business logic. Some logic flaws in underwriting and claims workflows still need a human who understands the business process.
Qualified-party question. Some examiners want a named, qualified human to own the annual test. Plan for human review and sign-off.
In practice, insurers use AI pentesting to cover the months between annual tests rather than to replace the annual test.
More on how automated penetration testing works and where it stops, AI pentest cost compared with manual testing, and automated vs consulting pentests for NYDFS.
3. Bug Bounty and Vulnerability Disclosure Programs
A vulnerability disclosure program (VDP) gives outside researchers a safe, legal way to report issues they find. A bug bounty adds payment for valid findings.
The US federal government's CISA BOD 20-01 directive is a solid public template for a disclosure policy. ISO/IEC 29147 sets out the international process.
Where it fits for insurers:
Breadth. Many researchers test your public portals and mobile apps continuously.
Pay for results. You pay per valid finding rather than per day of testing.
Signal to regulators. A published VDP shows examiners and cyber underwriters a mature security posture.
Where it falls short:
Not a pentest. Researchers pick what to test, so nothing guarantees that your claims API or internal network gets covered. It can't serve as your 500.5 annual test.
Policyholder data risk. You need test accounts, clear rules against accessing real customer records, and safe-harbor language that legal has approved.
Triage load. Duplicate and low-quality reports take time to sort through.
Example platforms: HackerOne, Bugcrowd, Intigriti and YesWeHack.
4. In-house Red Team
A red team simulates a real adversary end to end. That includes phishing, vishing (phone-based social engineering), help-desk pretexting and lateral movement. A standard pentest is scoped to specific systems, while a red team exercise tests whether your detection and response can stop an attack as a whole.
After the 2025 call-center attacks, this is the approach that most directly tests the kind of entry point those attackers used.
Where it fits for insurers:
Business context. Internal testers know which systems hold policyholder data, where claims payments go, and which vendors have access.
Purple teaming. Findings feed straight into detection engineering through joint red-team and blue-team exercises.
DORA. For EU insurers that meet the TLPT criteria, an internal team can run the tests. Insurance and reinsurance undertakings fall under TLPT if their gross written premiums exceeded EUR 500 million for the past two years and they rank in the top 10% of premium distribution in their Member State, alongside an asset threshold. TRECCERT GmbH
Where it falls short:
Cost. A capable team means several senior hires plus tooling.
Independence. DORA requires external testers every third test, and PCI DSS requires organizational independence.
Blind spots. Internal teams can develop the same blind spots as the defenders they work alongside.
Frameworks to build on:
MITRE ATT&CK for adversary techniques
NIST SP 800-115 for testing methodology
TIBER-EU for threat-led testing in the EU
Before any exercise, get the paperwork right with a red team authorization letter.
5. Hybrid Testing (what most insurers end up running)
The strongest insurer programs combine approaches, so each one covers a gap the others leave open. A typical setup:
Layer | Approach | What it covers |
|---|---|---|
Continuous | AI or automated pentesting on apps and APIs | Every release of portals, quote APIs and claims apps |
Annual | Independent human test (PTaaS or a firm) | The 500.5 certification test, inside and outside |
Always on | VDP or private bug bounty | Public-facing issues found by outside researchers |
Periodic | Red team or social engineering exercise | Help desk, call center and identity attack paths |
Here's how that looks by type of insurer:
Insurer type | Suggested mix |
|---|---|
Small carrier or MGA | Annual PTaaS test plus continuous automated testing on public apps. Publish a VDP |
Mid-size regional carrier | Continuous AI pentesting, annual independent test, private bug bounty, and a yearly social engineering exercise |
Large multi-line carrier | All four layers, with an internal red team and external testing on a rotation |
Insurtech | Continuous AI pentesting in CI/CD, an annual test to satisfy NYDFS and SOC 2, and a VDP from launch |
For the insurtech version of this program, see insurtech penetration testing for NYDFS and SOC 2. For how often to test, see continuous vs annual penetration testing for NYDFS-regulated insurers.
How to Choose the Right Alternative
Work through these in order. The answers usually point to a clear mix.
Which regulators apply? NYDFS, state NAIC adoptions, DORA and HIPAA each set different rules on frequency and independence.
How often do you ship? If portals and APIs release monthly or faster, an annual test alone leaves you exposed for most of the year.
Where is your data? If PHI or payment data sits in third-party systems, extend testing to TPA and MGA integrations.
What internal skills do you have? Without senior offensive security staff, an in-house red team is a hiring project before it's a testing program.
What evidence does your certification need? Confirm that the report format maps to 500.5 and to your state's version of Model #668.
What's your budget model? Credits, subscriptions and bounties behave very differently at renewal time.
Questions to Ask Before Replacing Your Manual Pentest Vendor
Who performs the testing, and what makes them qualified under 500.5?
Does the scope cover both inside and outside the system boundaries?
Is retesting included, and how fast does it happen?
Does the report map findings to NYDFS, NAIC and PCI requirements?
How is nonpublic and health information handled during testing?
Does every finding include a working proof of exploit?
Can testing run automatically after material system changes?
Do findings sync to your ticketing system with remediation tracking?
To formalize the switch, use the penetration testing RFP template, define the scope of work, and confirm how retests work and why auditors care.
If you've already chosen an approach and want to shortlist providers, see the vendor-by-vendor comparison of pentest tools and platforms for insurers.
