# Cyber Insurance Assessment

URL: https://www.deepinfo.com/solutions/use-cases/cyber-insurance-assessment/

## Underwrite on What the Internet Shows Today.

An application form describes an organization as it saw itself on the day it filled the form in. Its internet-facing surface keeps changing after that.

Cyber Insurance Assessment scans an applicant or insured the way [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) scans a vendor: discovery from the primary domain, each data layer per asset, scored findings with evidence, and a timeline that runs through the policy term.

[Request demo](https://www.deepinfo.com/request-demo/) · [Talk to us about your book](https://www.deepinfo.com/contact/)

### Different Seats at the Same Table.

Underwriters

#### At Quote and Renewal

Read the applicant’s exposed services, certificate hygiene and exploited CVEs next to the answers on the form, and ask about the differences.

Brokers

#### At Placement

Prepare a client for underwriting questions by fixing what is visible before the submission goes out.

Insureds

#### Through the Term

Show the score timeline and the issues resolved since the last renewal, instead of describing them.

### From a Domain to Underwriting Evidence.

1. **Add**

   Add the applicant’s primary domain as a portfolio. No agent, credentials or questionnaire are needed from the applicant.
2. **Discover**

   Discovery maps the subdomains, IP addresses and related domains behind it, including the ones the application didn’t mention.
3. **Scan**

   Every approved asset is scanned across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP.
4. **Score**

   Findings arrive with a severity and their evidence, CVEs are ranked by CVSS, EPSS and CISA KEV, and the portfolio gets a security score with its timeline.

### Findings That Answer Underwriting Questions.

The form asks. The scan shows what anyone on the internet can already see.

| Question on the form | What the scan shows |
| --- | --- |
| Is remote access exposed? | Open TCP and UDP ports and the services behind them, such as remote desktop |
| How current is patching? | CVEs on internet-facing technology, with CVSS, EPSS and whether CISA lists them as exploited |
| Any ransomware exposure? | For KEV-listed CVEs, CISA’s own flag for known use in ransomware campaigns |
| Any end-of-life software? | Technologies detected on web assets, with end-of-life status |
| Is traffic encrypted? | Certificates, issuers, expiry dates and TLS configuration findings |
| Is the inventory complete? | Subdomains and hosts discovered that the application didn’t list |

Findings are also classified against compliance frameworks, from OWASP Top 10 2021 to PCI DSS 4.0 and HIPAA. See [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/).

### Separate the Exploited From the Theoretical.

A long list of high CVSS findings says less about loss likelihood than a short list of CVEs attackers already use.

EPSS estimates how likely each CVE is to be exploited in the next 30 days, and CISA KEV lists the ones already exploited. The ones at the top of that order are where the conversation starts.

### A Score Timeline Across the Term.

Scores are kept as a timeline from the day monitoring starts. A renewal can read a year of direction instead of a single day’s scan.

Score-decrease notifications flag a drop mid-term, so it is known before the renewal conversation instead of during it.

### One Engine Serves Other Decisions Too.

- [Security Risk Scoring](https://www.deepinfo.com/solutions/use-cases/security-risk-scoring/) (Use case): One scoring engine across organizations, with each score kept as a timeline.
- [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/) (TPRM · Capability): The engine that scores any organization added as a portfolio.
- [Mergers and Acquisitions Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) (Use case): This outside-in assessment, applied to an acquisition target.

### Use This Data in Your Tools

Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.

- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)
- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/)

### Questions About Cyber Insurance Assessment

**Does the applicant have to take part?**

No. Everything on this page is read from the internet-facing side, starting from the primary domain. The applicant can still review the findings with you, and fixes show up in the next scan.

**Is the scanning intrusive?**

No. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests. Port scans and web requests reach only what a host already exposes to the internet.

**Does this replace the application form?**

No. Scanning covers what anyone on the internet can see. Controls inside the organization, such as backups, training and internal access, still need the applicant’s answers.

**How often is an insured’s surface rescanned?**

Monitored assets are rescanned on the platform’s own schedule, with nobody on either side triggering it, and each layer keeps a dated history across the policy term.

**Can we assess a whole book of insureds?**

Each organization is a portfolio scored by the same engine, so organizations compare directly. Talk to us about the size and shape of the book you have in mind.

### Assess an Applicant From the Outside.

Bring a domain from a current submission to a demo and read the findings, the CVE ranking and the score with our team.

[Request demo](https://www.deepinfo.com/request-demo/)