You’ve likely seen companies promoting security reports that can perform external scans on a business. While it can certainly be helpful when discussing cyber insurance with a client, it’s important to stress that these scans don’t provide a complete picture. The reality is that the vast majority of a business’s infrastructure and exposure lies on the inside of their networks. If surface scanning reports are solely relied on to show a company how vulnerable they are, they can do more harm than good if a company believes they are an accurate assessment without further analysis. While external scans of a client’s vulnerabilities provide insight into what criminals can easily detect from the outside, they unfortunately can lead to a number of false positives and work against the business. Reports like these should only be used to supplement an insurer’s existing claims data which is a proven measure of what exposures are happening to clients in real time. A good cyber insurance provider will be able to offer deep scanning services and continuous monitoring throughout the policy term, not just at the stage of quoting.