Kill the questionnaire — what underwriters actually need instead

November 23, 2025By John Lundgren, Co-Founder & CEO3 min readCyber insuranceUnderwriting

Cyber underwriting still leans on a long form. Applicants check boxes. Brokers chase completeness. Carriers try to read intent between the lines. Everyone knows the ritual. Fewer people still believe it answers the only question that matters: can an attacker actually break in?

That's what "Kill the Questionnaire" is about. Not chaos. Not underwriting without information. Replacing a slow, gameable proxy with continuous proof of exploitable exposure — so the application process gets lighter and the signal gets sharper.

The form was always a stand-in

A questionnaire asks people to describe their own defenses. Some answers are careful. Some are hopeful. Some are copy-pasted from last year. None of them are how an attacker evaluates a target.

Attackers don't read your MFA policy paragraph. They look for a reachable login, a forgotten VPN, a vulnerable edge service — and they try it. Underwriting that stays stuck in attestation is permanently one step removed from that reality.

You don't kill the questionnaire by asking nicer questions. You kill it by bringing better evidence to the desk.

What "instead" has to mean

If you remove the form and leave a vacuum, underwriters will invent a new proxy — or cling to the old one. The replacement has to be:

Outside-in — what the internet can see, the way a threat actor would start
Current — not a PDF from nine months ago
About break-in paths — places someone could actually get in, not a scrapbook of soft perimeter trivia
Verified where it matters — so the desk isn't ranking noise

That's the job of continuous attacker-grade assessment: discover exposure, verify what's real, score breach risk, hand underwriters something they can use at bind without making the applicant type their way through fifty fields.

Estimate vs proof (say it plainly)

There's a whole category of outside-in tools that estimate risk from perimeter datapoints — the Security Scorecard / BitSight style of grading. Easy to consume. Easy to compare. Also easy to pad with findings that aren't material to a breach or a claim (an expired SSL certificate is the classic example: visible, scorable, rarely the story of how the next loss happens).

Proof looks different. It asks: where could someone break in, and have we verified that path? That posture is how you keep false positives down and keep underwriting attention on claim-relevant exposure — not on theater.

What CQV is for

Cyber Questionnaire Validator (Kill the Questionnaire) uses the BreachRisk Platform to surface what should be flagged before underwriting — largely removing the need for the applicant to fill out the questionnaire at all. Less friction for brokers and applicants. Better signal for the carrier.

It doesn't claim the book can't be breached. It doesn't "certify" anyone. It replaces guesswork-on-a-form with verified outside-in evidence.

The bottom line

Kill the questionnaire only if what replaces it is more honest than the form. Attestation was convenient. Continuous proof of real intrusion paths is useful. That's the trade underwriting has been waiting for — and the standard ratings-style estimate was never quite it.