Cyber Risk Insights Platform / How It Works
Cyber Risk Insights Platform · How It WorksThree passes. One outside-in read.
Every scan maps what’s reachable, matches what’s running against known vulnerabilities and checks for misconfigurations. Nothing touches the applicant’s internal systems.
Trusted by leading carriers and brokers
Map the footprint.
Before any vulnerability analysis, the engine maps every internet-facing service on every host in scope: web servers, remote management, databases, mail, file transfer and admin panels. It also finds subdomains, which often surface staging servers and internal tools that were never meant to be public. Everything else builds on this map.
Illustration · a footprint
Match versions to known vulnerabilities.
Software versions are checked against the National Vulnerability Database and CyRisk threat intelligence. This is version-based detection: it reports flaws known to affect what’s running, without trying to trigger them.
Industry-standard 0–10 severity of the vulnerability itself.
Estimated probability it will be exploited in the near term.
Flagged when there’s evidence of exploitation in the wild. Prioritize these regardless of CVSS.
Check for misconfigurations.
Not every exposure has a known vulnerability attached. The engine flags security hygiene gaps across eight hazard categories, each mapped to a technology domain and a peril.
- Exposed remote management (RDP, SSH, Telnet)
- Unsecured databases reachable externally
- Weak or missing TLS
- Open or misconfigured cloud storage
- Missing email authentication (SPF, DKIM, DMARC)
- Unencrypted plaintext services
- Exposed file transfer without access controls
- Network boot / imaging services reachable from outside
Every finding gets two tags.
What any outsider could see. Nothing more.
Starts from CyRisk infrastructure on the public internet. No access to internal networks is required or attempted.
No credentials, agents or applicant cooperation.
No downtime, no alerts and no changes to any system.
No exploit testing. It observes and identifies; it doesn’t attack.
Today’s exposure, not last quarter’s.
Back-test us against your own book.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our read next to the call you made.