my insurer wants to see a pentest report, what must I provide

What an insurer means by "pentest report"

Usually, the insurer does not ask for the full technical report, but for a summary: which scope was tested, when, by whom, and what were the findings at high and medium level. An executive summary with date, test firm and the status of follow-up is often sufficient in practice. You only send the full report with exploit details if specifically requested, and then it is advisable to check what you shield via the confidentiality button — an insurer has an interest in the conclusion, not in the technical vulnerabilities themselves.

If you have not had a pentest carried out, then "no, not yet planned" is a more honest answer than leaving the field blank or sending an old report from a different system. Many insurers ask this as part of a broader picture about a process for identifying and remediating vulnerabilities: a pentest is one piece of evidence there, not the whole answer. If the pentest is missing, it is often still possible to show whether scans, patch management or another detection process is running — that carries weight, even without a test report.

Where this comes from: Article 21(2) and Annex A

A pentest itself is not listed as a separate obligation in Article 21(2) of the NIS2 Directive; that lists ten categories of measures, including handling of vulnerabilities and assessment of the effectiveness of measures. A pentest is one way to demonstrate that effectiveness, alongside for example an internal audit — see also or whether the effectiveness of the security measures is tested periodically. In ISO/IEC 27001 Annex A, penetration testing does not appear as a separate control point either; it falls under the control measures for technical vulnerabilities. Outside this legislation, insurers often still ask for it as their own risk indicator alongside the statutory or normative requirements — that is an insurance practice, not a legal obligation from NIS2 or the Cybersecurity Act.