Cyber Risk Insights Platform / For Underwriters

Cyber Risk Insights Platform · For Underwriters

From report to decision.

Eight sections, always in the same order. Here’s what each one is for, where to look first, and how it fits your workflow.

Trusted by leading carriers and brokers

Johnson Kendall Johnson
Crum & Forster
Allied World
Trium Property
Sullivan Group
Profinity
Intact Insurance
Munich Re
Old Republic Cyber
Where to look first

A reading order that saves time.

Read the report in three passes: get the headline, confirm where the exposure actually sits, then add context for pricing and the broker conversation.

Step 1 · Get the headline

Start with the scores

  • Security Score: read the overall score and the four dials together, and note any large gap between them.
  • Critical & High Risk Summary: a fast triage of what is driving the score. Useful, but don’t stop here.
Step 2 · Confirm the exposure

Find what’s real and where it sits

  • Security Risk Detections: every confirmed vulnerability. Prioritize anything flagged actively exploited, whatever its CVSS.
  • Infrastructure Risk Assessment: check this whenever the overall score looks worse than the dials. It shows whether findings are piled onto one host.
Step 3 · Add context

Weigh it for pricing

  • Mitigating Controls: protective technology in place that supports or undercuts your confidence.
  • Incident Lawsuits: comparable real cases for pricing and policyholder conversations.
  • Dependencies & Subdomains: forgotten assets and vendor concentration.
The Security Report

Eight sections, same order every time.

§1

CyRisk Security Score

The overall score and the four category dials, with a written summary of the most important findings.

§2

Critical & High Risk Summary

Headline counts and the Critical and High items driving them. A fast triage step.

§3

Security Risk Detections

Every confirmed vulnerability, with CVSS, EPSS and an actively-exploited flag.

§4

Security Mitigating Controls

Protective technology detected in place.

§5

Security Incident Lawsuits

Comparable real incidents and what they cost, matched by profile.

§6

Infrastructure Risk Assessment

Every external host, and the findings tied to each one.

§7

Technology Dependencies

The hosting, CDN and DNS providers the footprint relies on.

§8

Subdomain Inventory

Every discovered subdomain, with technology and vulnerability counts.

Sections that look alike

Same data, different question.

Detections, Infrastructure and Subdomains

One answers “what did the scan confirm?” The other two answer “where is it concentrated?”, by host and by subdomain.

Incident Lawsuits

A profile match against real cases for pricing context. It isn’t a prediction that this applicant will be breached.

Mitigating Controls

Controls in place don’t cancel findings. They change how much weight the findings carry.

Built into your workflow

From submission to subjectivity.

Triage

Sort the queue on the score and a suggested disposition: Write, Conditions or Refer.

Guidelines

Apply your own underwriting rules to every scan.

Subjectivities

Customizable subjectivity reports for brokers and policyholders.

API

Scores and findings into your workbench or rating engine, at the scale of thousands of submissions.

After you bind

Keep the read current.

Exposure changes during the policy term. Portfolio Management runs the RED Scan across the book to confirm which known exploited flaws actually work, and Loss Control gives insureds the tools to fix them.

Portfolio Management →   Loss Control →

“CyRisk has provided immeasurable value in our risk selection analysis.”

Vice President, Cyber

Back-test us against your own book.

Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our read next to the call you made.