Questionnaire-to-scan discrepancy

A questionnaire-to-scan discrepancy is the difference between what a company declares on its cyber underwriting questionnaire and what an external scan of its attack surface observes in the same month. The questionnaire is signed by an executive who does not always know the technical answer; the scan only sees what is exposed to the internet, but it sees it without a middleman. Colonial Pipeline, in May 2021, gave the market the extreme version of the problem: the intrusion came through a virtual private network (VPN) account with no MFA. Change Healthcare, in February 2024, showed the same hole on a Citrix server, which the group's chief executive acknowledged before Congress. DMARC (Domain-based Message Authentication, Reporting and Conformance) is often the first contradiction a scan finds, because it can be read with one public DNS query. The questionnaire answers yes to "have you implemented DMARC." The record says `p=none`, which monitors without blocking anything, or there is no record at all. The insured has not necessarily lied: a contractor published the record in monitoring mode three years ago, and nobody ever moved it to `quarantine` or `reject`. The underwriter does not decide on a single discrepancy. A follow-up question goes out, sometimes a request for a console screenshot or the corrected record, and the fix can become a subjectivity before inception. One isolated, explained discrepancy barely moves the price. Several on points the questionnaire treats as blocking, MFA on remote access or an exposed RDP port, change how the whole submission reads, including answers nobody can check from outside, such as backups. Under French law, the insured must answer accurately the questions the insurer asks (Article L. 113-2 2° of the Insurance Code). An intentional misstatement that changes the subject of the risk or lessens the insurer's view of it voids the policy (L. 113-8). Where bad faith is not established, an inaccuracy found before a loss leads to a higher premium the insured accepts or to cancellation; found after a loss, it cuts the indemnity in proportion to the premium rate paid against the rate that would have been due (L. 113-9). Since the Cour de cassation's mixed chamber ruling of February 7, 2014 (no. 12-85.107), an insurer can rely on an intentional misstatement only if it comes from answers to precise questions the insurer asked, and the court sets the sanction aside when the insured shows the insurer knew of the circumstance in question.