Every finding starts with a real visit.
CyRisk loads the applicant’s public website the way an ordinary visitor would. It watches what runs, what leaves the browser and how the site responds to consent choices, then turns that into findings an underwriter can act on.
Visit. Match. Place. Prove.
No login, no cooperation from the applicant and no access to internal systems. Just the public website, observed carefully.
Browse the site like a real visitor
The scan watches four kinds of signal on every page it loads:
- Technology presence: which scripts, pixels, cookies and SDKs load.
- Data in transit: what those technologies send, and to which third parties.
- Consent behavior: what happens before a choice, after Reject All and after an opt-out.
- Page context: ordinary marketing pages versus logged-in account areas.
Identify what’s running
Every detection is matched against a global catalog that grows as new tracking technologies appear:
Consent managers, privacy tooling and Global Privacy Control handling are recognized too. They count as mitigating controls.
Map it to an underwriting risk
A curated catalog of underwriting risks translates each detection into insurance terms:
- The legal theory a plaintiff or regulator would use.
- A damages model and whether there’s class-action or private-right-of-action exposure.
- A default severity: Critical, High or Medium.
- A default placement: Critical to Bind or May Affect Coverage.
Rescan to verify the fix
When an applicant says a finding is fixed, you don’t have to take their word for it. The next scan shows whether the tracker still fires after Reject All, so subjectivities close on evidence.
Proof, not a signature.
We don’t check that a banner exists. We check that it works.
A consent banner can be present and still fail. That gap between the banner’s promise and the site’s behavior is what plaintiffs look for, so CyRisk tests it in three phases.
What loads before the visitor chooses
Pixels, third-party cookies, fingerprinting and input monitoring that start before any consent decision.
What keeps running after “no”
The strongest evidence of a consent failure, and one policy language can’t cure.
Whether opt-outs are honored
Does the Do Not Sell/Share link stop tracking? Is the Global Privacy Control browser signal respected?
One pixel, several risks.
Privacy findings come from two complementary layers. The first decides what can be detected. The second decides how much a detection matters to your policy, and that’s where your team tunes.
“Is this technology present, and is it firing?”
Maps a detected vendor or script to a privacy finding and base severity. Maintained globally by CyRisk, so it’s the same for every account.
“What’s the exposure, and should it gate the policy?”
Ties detections to a legal theory, severity and report placement. Tunable per account.
For example, a single advertising pixel can feed several risks: one for its presence, another if it fires before consent, and another if it sends hashed email addresses to an ad platform.
Defaults, not decrees.
Every risk starts with a default placement based on its severity. Your underwriting team can elevate, downgrade or drop any risk to context-only, rule by rule and per account, so the report surfaces only what’s material to your book.
| SEVERITY | DEFAULT PLACEMENT | WHAT IT MEANS |
|---|---|---|
| Critical | Critical to Bind | Resolve or formally accept before the policy binds. |
| High | May Affect Coverage | Informs terms, sublimits or price without gating the deal. |
| Medium | May Affect Coverage | Context for terms and portfolio view. |
Not just how bad. How sure.
Severity tells you how much a finding matters. FAC tells you how much to trust it. Every finding is scored for whether it’s real, attributable to the applicant and reachable, so you can act on high-confidence findings and question the rest.
Real: observed in live network traffic
Attributable: on the applicant’s own domain
Reachable: on a public, high-traffic page
Illustrative only.
Where the results show up.
Insight Engine
An interactive report with the privacy read side by side with the security scan.
REST API
Feed ratings and findings into your underwriting workbench or rating engine.
Configurable rules
Your placement overrides, applied automatically to every scan.
Automatic reports
Shareable reports for the file and the broker, with a plain-English summary.
A detected exposure is not a proven violation.
CyRisk observes what a technology does on the public site. Consent, disclosure and contract terms decide liability, and many of those sit outside what any external scan can see.
Detected ≠ violated
A fact pattern common to privacy litigation, not a legal finding.
Not detected ≠ clean
It may be absent, or the scan couldn’t check it. Ask, or use a supplemental.
Back-test us against your own book.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. Litigation theories explain why a finding is tracked; they are not legal advice.