Privacy risk, read the way you underwrite.
A suggested disposition, the evidence behind it, and broker questions already drafted. The decision, your rating and your authority stay with you.
From submission to renewal.
Sort the queue
Security and Privacy ratings on the same 0–1000 scale tell you which submissions need time.
Send better questions
Paste the plain-English summary and recommended questions into your broker note, instead of a generic supplemental.
Set subjectivities
Critical to Bind findings become specific, fixable conditions.
Shape coverage
Use findings to set wrongful-collection or VPPA sublimits, retentions and endorsements.
Confirm the fix
A rescan shows whether tracking still runs after Reject All. Close the subjectivity on evidence.
Catch drift
New trackers appear between terms. Rescan at renewal and across the book.
Five steps. Under two minutes.
Every CyRisk report includes an underwriter quick reference. Here’s the order experienced underwriters read it in.
See the sample report- Suggested disposition and both ratings. Write, Conditions or Refer, with the triggers behind it. CyRisk never suggests decline; that call stays with you.
- The indicator grid. Red and orange rows are your question list and likely subjectivities.
- Critical findings and their claims implication. The claim or regulatory theory each finding could trigger.
- Mitigating controls. The consent manager, Do Not Sell/Share link and data-request route, each tested, not just detected.
- Known matters. Lawsuits and regulatory actions from the last five years, weighed like loss history.
What to do with each finding.
Every privacy practice is labelled on a five-step scale. Each label points to a typical underwriting response.
| LABEL | EXAMPLE | TYPICAL RESPONSE |
|---|---|---|
| Critical non-compliance | Tracking continues after Reject All | Fix before bind as a subjectivity. May justify a wrongful-collection sublimit. |
| Non-compliant | Trackers load before the visitor chooses | A question for the broker or a condition on the indication. |
| Partially compliant | Opt-out link present but only partly working | Ask when it touches a coverage part or sublimit you’re offering. |
| Fully compliant | Consent manager gates every tracker | Note it in the file as a credit. |
| Not detected | Not found, or the scan couldn’t check it | Not a clean result. Ask the insured or use a supplemental. |
Tie each exposure to the coverage that responds.
| EXPOSURE | CLAIM OR REGULATORY THEORY | COVERAGE LEVER |
|---|---|---|
| Consent Failure | CIPA / ECPA wiretap · State UDAP | Subjectivity before bind · wrongful-collection sublimit |
| Session & Input Monitoring | CIPA wiretap | Sublimit or higher retention |
| Tracking & Advertising (video pages) | VPPA | VPPA sublimit or endorsement |
| Consent & Preference Signals | CCPA / CPRA | Regulatory coverage terms · subjectivity |
| Data Brokerage & Sharing | CCPA / CPRA · State UDAP | Regulatory coverage terms |
| Biometric & voiceprint technology | BIPA | Refer · exclusion review |
| Children’s services | COPPA | Ask about age screening before you indicate |
| Healthcare organizations (Health Privacy indicator) | HIPAA · FTC and state health privacy rules | Breach notification and regulatory terms · weigh health-related tracking findings more heavily |
A strong security score doesn’t offset a weak privacy score.
Tracking-technology claims need no breach. CyRisk rates both on the same scale, side by side in one report, with portfolio accumulation drawn from the same scan, so privacy gets the same rigor as security.
of 1000 · High Risk
of 1000 · High Risk
Prove it on decisions you’ve already made.
Five past submissions you bound, conditioned or declined.
Privacy and security reads, without seeing your decision.
Our disposition and subjectivities next to the call you made, file by file.
Not just a score. A program that gets built.
When an insured needs help closing what the scan finds, CyRisk’s vCPO team does the hands-on work: building and running the privacy program the findings call for. The rescan then shows the fix, so the subjectivity closes on evidence.
vCPO Services
Virtual Chief Privacy Officer leadership that designs, implements and maintains the privacy framework an insured needs.
Explore vCPO Services →Your next subjectivity, already drafted.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.