Underwrite what the website actually does.
The application tells you what a company intends. CyRisk shows what its public website really does with visitor data, including what keeps firing after Reject All and the claim theory each behavior sets up. You read it side by side with your cyber security scan.
Trusted by leading carriers and brokers
Privacy claims don’t need a breach.
Wrongful-collection suits are built on what a site’s tracking technology does every day, not on an incident. That exposure sits on the applicant’s public website, where a plaintiff’s firm can see it too.
Data privacy class actions filed in 2025, up more than 200% since 2022.
Of web-privacy claims analyzed cited the California Invasion of Privacy Act (CIPA).
Of third-party cyber liability claims in 2025 were CIPA-related, up from 7% in 2023.
Visit. Match. Place. Prove.
Browse the site like a real visitor
Before consent, after Reject All, and after an opt-out. No credentials, questionnaire or install.
Identify what’s running
Pixels, session replay, keystroke capture, fingerprinting and data-broker flows, matched against a continuously updated catalog.
Map it to an underwriting risk
Each finding carries a legal theory, a severity, and a default placement: Critical to Bind or May Affect Coverage.
Rescan to verify the fix
Subjectivities are confirmed by evidence on the next scan. Proof, not a signature.
Where privacy claims start.
Eight families of exposure, each tied to the claim or regulatory theory it sets up.
Tracking & Advertising
Pixels, real-time bidding and identity-match transmissions.
Consent Failure
Tracking that continues after Reject All or an opt-out.
Fingerprinting
Cookieless device signatures visitors can’t easily block.
Session & Input Monitoring
Session replay, keystroke and form-field capture.
Sensitive Context
Tracking inside logged-in account pages.
Consent & Preference Signals
Global Privacy Control signals that aren’t honored.
Data Brokerage & Sharing
Visitor data flowing to registered data brokers.
Location & Geolocation
Location collected before consent or inside accounts.
Tracking continues after Reject All
Wiretap class-action theory · fix before bind
Read it in under two minutes.
- Suggested disposition. Write, Conditions or Refer, with the triggers behind it.
- Privacy rating. Read on its own. A strong security score doesn’t offset it.
- Indicator grid. Red and orange rows become your broker question list.
- Claims implication. The claim or regulatory theory each finding could trigger.
From submission to renewal.
Triage the queue on Security and Privacy ratings, then paste the drafted summary and broker questions into your note.
Critical to Bind findings become subjectivities you can verify with a rescan.
Rescan to catch new trackers, and see shared third-party dependencies across your portfolio.
A detected exposure is not a proven violation.
CyRisk observes what a technology does on the public site. Consent, disclosure and contract terms decide liability, and many of those sit outside what any external scan can see. Each finding narrows your attention and frames the right questions. It is not a legal determination.
Detected ≠ violated
A fact pattern, not a verdict.
Not detected ≠ clean
Ask, or use a supplemental.
Defaults, not decrees
Re-rank any risk to fit your book.
Confidence-scored
Every finding is rated for how sure we are, not just how bad.
“I’m blown away by the depth of CyRisk’s solution. Exceeded expectations.”
Executive Vice President, Underwriter
How long does a privacy scan take?
About five minutes on average. Results appear in the Insight Engine and are available through the API.
Can we change which findings are Critical to Bind?
Yes. Severity and placement are defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
How does this fit with the CyRisk security scan?
Both ratings use the same 0–1000 scale and appear side by side in one report. Read privacy on its own: tracking-technology claims need no breach.
Is there an API for our underwriting workbench?
Yes. Findings, ratings and reports are available by REST API with configurable rules.
How do we verify an applicant fixed a finding?
Rescan. The fix appears on the next scan, so the subjectivity is closed on evidence.
Does CyRisk tell us whether HIPAA applies?
Yes. Every privacy report includes a Health Privacy indicator (HIPAA, Healthcare or Not Detected) that identifies whether HIPAA likely applies, based on public information. It is shown alongside the grade as context. More on Health Privacy →
Back-test us against your own book.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. Litigation theories explain why a finding is tracked; they are not legal advice.