Quick Answer
Generally yes, though it's usually framed as questions about scanning and patching rather than named as a programme. The answer underwriters want isn't whether you scan — it's how quickly you fix what the scan finds.
What the Questionnaire Asks
How often you scan, and whether both internally and externally
Your remediation timeframes for critical and high-severity findings
Whether unsupported or end-of-life software is still running
How internet-facing systems are identified and monitored
Whether you can produce a compliance rate against those timeframes
Note what's missing from that list: whether you own a scanner. Ownership isn't the question.
Scanning Without Fixing Doesn't Count
This is where most applications come apart. A business runs quarterly scans, answers yes, and then can't show what happened to the findings. From an underwriting perspective, an unremediated known vulnerability is worse than an unknown one — it's a documented weakness the business chose not to address.
Have remediation timeframes written down, and know your actual performance against them.
Internet-Facing Systems Get the Most Attention
Some insurers run their own external scan of your perimeter before quoting. An exposed VPN appliance with a known vulnerability is visible to them without asking you, so it's worth knowing what your external footprint looks like before they do.
End-of-Life Software Is a Specific Flag
Unsupported operating systems and applications can't be patched, which makes them a standing exception. Where you can't replace something, document the isolation around it rather than leaving it unexplained on the form.
Example Scenario
A 200-person healthcare organisation was asked at renewal how it identified and remediated vulnerabilities. Periodic scans were running, but remediation was inconsistent and there was little visibility into high-risk findings on internet-facing systems. PureStack introduced continuous scanning, prioritisation, and remediation reporting — giving the organisation evidence rather than intentions.
How PureStack Evidences Your Vulnerability Management
We scan internally and externally, prioritise by exposure, remediate, and produce the compliance reporting that answers the questionnaire properly.