Why does a cyber insurance form ask whether my VPN login pages are tied to my domains?
One form asks whether you use a VPN that you sign in to through a web page, and whether every such login page sits on the domains you listed.
Last read from the sources at the foot of this page.
What exactly does the form ask?
These are the form's own words, with the page they come from.
Do you use SSL VPN (Web VPN) for remote access into your network?
If "Yes", are all SSL VPN (Web VPN) login pages tied to the domain(s) listed in question 3 of this application?
While convenient, it is easily discoverable by threat actors.
What does it mean for a small firm?
An SSL VPN, or web VPN, is a VPN you start from a login page in a browser. That page is on the internet, so anyone can find it and try passwords on it.
The question checks that every such page is on a domain you told the insurer about.
How do I answer it truthfully?
Find every VPN or remote-access login page you run. Note the address of each. If one sits on an address that is not on a domain you listed, add that domain to your list, or answer No and say why in the comments.
What can an outside reading check for this question?
An outside reading can see whether a remote desktop port, a file sharing port, or a VPN or other remote-access login page answers from the internet on your domain and its host names.
Host names issued a certificate for your domain are in public certificate logs, so an outside reading can find a login page on a host name you had forgotten.
It cannot see a login page on an address that has nothing to do with your domain.
Where does this come from?
- Tokio Marine HCC, TechGuard Cyber Liability Insurance application (TEO-RNA 6.2026)tmhcc.comRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/