See the submission the way an attacker does.
The application tells you which controls a company says it has. CyRisk shows what its internet-facing environment actually exposes right now: open services, known vulnerabilities and misconfigurations, each mapped to the loss it could cause and scored on one 0–1000 scale.
Trusted by leading carriers and brokers
Attackers read the footprint first. So should you.
Most attacks start with reconnaissance: what’s reachable, what’s running, what’s out of date. The Insight Engine gathers that same view for every submission, without asking the applicant for anything.
What could this exposure turn into?
Each peril has its own 0–1000 dial in the report and its own page here.
Ransomware
Exposed remote access, actively exploited flaws on edge devices and unpatched software that give an attacker a way in.
Data Breach
Databases, storage and file transfer reachable from outside, plus weak encryption on services that carry data.
Social Engineering
Missing or misconfigured email authentication and exposed mail infrastructure that make impersonation easier.
Business Interruption
Vulnerable, internet-facing infrastructure whose compromise or outage would stop operations.
Where the exposure sits.
Remote Management
RDP, SSH, Telnet and other admin interfaces
Database
Database engines reachable from the internet
Web Server
Web servers, their software and their encryption
File Transfer
FTP and other file transfer services
Software
Versioned software matched to known vulnerabilities
Mail servers and email authentication
Printer
Network printers reachable from outside
Peer-to-Peer
File-sharing and peer-to-peer services
Likelihood and weakest asset. Read both.
Four category dials estimate how likely each loss is. The overall score asks how well protected the single most exposed host is. They can disagree, and both are right.
Illustration
Map, match, check.
Every internet-facing host, open service and subdomain tied to the organization.
Software versions checked against the National Vulnerability Database and CyRisk threat intelligence.
Misconfigurations across eight hazard categories, from exposed remote management to missing email authentication.
Controls in place count as context.
The report also lists protective technology detected on the footprint. It doesn’t cancel findings, but the same vulnerabilities behind layered defenses are a different risk.
An underwriting read, not a penetration test.
The Insight Engine reports what’s observable, the same view an attacker’s reconnaissance would gather. It doesn’t try exploits. When you need to know whether a known exploited flaw actually works on an insured’s host, that’s the RED Scan.
“CyRisk has provided immeasurable value in our risk selection analysis.”
Vice President, Cyber
Back-test us against your own book.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our read next to the call you made.