> Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Definitely seen that one. I'm curious as to why an insurer wouldn't loo

> Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Definitely seen that one. I'm curious as to why an insurer wouldn't look at a bottom-tier pen-test for signs of gross negligence. They'll readily turn up things like failing to have authentication on key file shares, no access controls on the network, or no MFA in use. The sort of stuff that's easily exploited and shows utter neglect on the part of the insured. Basically, it's been my experience that a tick-box pen-test exercise does a reasonable amount to check if the supposed controls are actually there.