Know what’s exploitable across your whole book.
The RED Scan, short for Ransomware Exposure Detection, finds the vulnerabilities attackers are weaponizing right now, tests whether each one actually works against your insured, and reports only what’s real. It runs across every policyholder at once, with no credentials, no notifications and no policyholder lift.
Trusted by leading carriers and brokers
In-term, book-wide
You bound the risk. What has changed since?
Underwriting tells you whether to write a policy. Once it’s on the book, the question changes: which insureds are carrying an exposure that could become a ransomware claim this quarter? RED answers that question for the whole portfolio.
Two scans, two jobs
The Insight Engine casts a wide net. RED goes deep.
| INSIGHT ENGINE (UNDERWRITING) | RED SCAN (PORTFOLIO) | |
|---|---|---|
| Question | Should we write this risk, and at what price? | Which insureds could produce a claim, and what fixes it? |
| Scope | Every observable vulnerability and misconfiguration | Known exploited vulnerabilities, plus exposed services |
| Method | Passive, version-based detection | Active, non-destructive exploit testing by a human analyst |
| When | At submission and renewal | Any time during the policy term, across the whole book |
What RED reports
Two tracks. Independent, not redundant.
An insured can have exposed RDP with no known exploited vulnerability, or a known exploited vulnerability on a web server with no exposed remote access. Each track stands on its own, so neither is read as one long list.
Validated, not just flagged
When RED says exploitable, it’s exploitable.
An older software version can look alarming and still be safe because a backpatch or compensating control is doing its job. When the exploit is attempted and fails, RED marks the finding tested-cleared and reports it openly, so nobody chases a fix that isn’t needed and nobody misreads the insured’s real risk.
of known-exploited findings actively tested
policyholder credentials or coordination required
scan reviewed by a human analyst before results go out
Illustration · a book-wide RED readout
Every policyholder on the list is scanned. A short list rises to the top: insureds with a confirmed exploitable flaw, then insureds with exposed remote access or data services, then findings that looked risky but tested clean.
The book at a glance
Prioritize by what’s proven, not what’s possible.
See which policyholders carry a confirmed exploitable flaw, which have exposed services, and which looked risky on paper but tested clean. Start with the short list that matters, and rescan to confirm what was fixed.
Insureds and findings in the illustration are examples.
Portfolio scale
Your whole book. No policyholder lift.
Send your list of policyholders. Nothing to install and nobody to notify.
Outside-in discovery, then analyst-run exploit tests on every known exploited finding.
Findings for each insured, split by track, with tested-cleared items clearly marked.
Reach the insureds that need it with specific, verified fixes, run by your team or by CyRisk on your behalf. Then rescan to confirm what was fixed.
Deliberately scoped
What RED doesn’t do.
Not a full vulnerability report
It covers known exploited vulnerabilities, not every CVE. A clean RED result can sit alongside version-based findings from the Insight Engine.
Not an underwriting score
Use the Insight Engine to decide whether to write a risk. RED helps keep the risks you’ve written from becoming claims.
Not visible to the policyholder
No notifications and no disruption. Results come to you, and you decide what to share.
“Finally, we have visibility. A 10x in time savings for our workflow.”
Executive Vice President, Underwriter
Want your policyholders to strengthen their own programs too? See Loss Control (CyRisk Protect) →
Run RED across your book.
Tell us how many policyholders you’d like covered, and we’ll show you what’s exploitable right now and where to start.