Ryvx

More UK businesses now meet this question on a cyber insurance renewal or a customer's supplier questionnaire: how do you test the security of your website, and when did you last do it? A vague answer can mean a higher premium, an exclusion or a lost contract. This guide covers what they are usually looking for.

What they want to see

Most questionnaires ask three things. Has the website been tested by someone trying to break in, rather than only scanned? When was the last test? Were the problems it found fixed? A dated report that shows what was tested, what was found and that the fixes were checked answers all three.

Read the exact wording before you buy anything. If it asks for a CREST-accredited penetration test, a CHECK test or a PCI ASV scan by name, only that will satisfy it. Many questionnaires ask more generally whether the site has been tested, and then a clear, dated report is what counts.

Cyber Essentials is not the same thing

Cyber Essentials checks your office IT: firewalls, updates, accounts and malware protection. It does not try to break into your website. If the question is about your website, a Cyber Essentials certificate alone does not answer it.

A report you can send

A Ryvx Launch Security Review costs £495 per site. You get a dated report in 3 to 5 working days with a plain summary for directors, the proof behind every finding, and the fixes for your developer. It includes a page written to share with your insurer or customers, while the rest of the report stays confidential. After you fix things, we retest once, so you can show the problems were closed. A person checks every report before you get it.

Each finding lists the standards it affects, such as ISO 27001, SOC 2, Cyber Essentials Plus, UK GDPR and PCI DSS, which helps when a questionnaire asks about them. That gives you evidence for those questions. It does not make Ryvx an auditor or a certification body, and Ryvx is not CREST accredited.

If the question comes up every year, Monthly Monitoring (£100 a month for one site) runs automated checks every two weeks and keeps a dated record of what was checked, so you have a current answer when the next renewal arrives.