Request demo

Cyber Insurance Assessment

Underwrite on What the Internet Shows Today.

An application form describes an organization as it saw itself on the day it filled the form in. Its internet-facing surface keeps changing after that.

Cyber Insurance Assessment scans an applicant or insured the way Third-Party Risk Management scans a vendor: discovery from the primary domain, each data layer per asset, scored findings with evidence, and a timeline that runs through the policy term.

Request demoTalk to us about your book
The application asksThe scan showsapplicant.example
Is remote access exposed? 3389/tcp · remote desktop Critical
How current is patching? a CVE listed in CISA KEV Critical
Any ransomware exposure? KEV flag “known ransomware campaign use”, read per listed CVE
Any end-of-life software? PHP 7.4 · end of life High
Is traffic encrypted? certificate expires in 6 days Medium
Is the inventory complete? subdomains not on the application

Different Seats at the Same Table.

Underwriters

At Quote and Renewal

Read the applicant’s exposed services, certificate hygiene and exploited CVEs next to the answers on the form, and ask about the differences.

Brokers

At Placement

Prepare a client for underwriting questions by fixing what is visible before the submission goes out.

Insureds

Through the Term

Show the score timeline and the issues resolved since the last renewal, instead of describing them.

From a Domain to Underwriting Evidence.

  1. 01

    Add

    Add the applicant’s primary domain as a portfolio. No agent, credentials or questionnaire are needed from the applicant.

  2. 02

    Discover

    Discovery maps the subdomains, IP addresses and related domains behind it, including the ones the application didn’t mention.

  3. 03

    Scan

    Every approved asset is scanned across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP.

  4. 04

    Score

    Findings arrive with a severity and their evidence, CVEs are ranked by CVSS, EPSS and CISA KEV, and the portfolio gets a security score with its timeline.

Findings That Answer Underwriting Questions.

The form asks. The scan shows what anyone on the internet can already see.

Question on the formWhat the scan shows
Is remote access exposed?Open TCP and UDP ports and the services behind them, such as remote desktop
How current is patching?CVEs on internet-facing technology, with CVSS, EPSS and whether CISA lists them as exploited
Any ransomware exposure?For KEV-listed CVEs, CISA’s own flag for known use in ransomware campaigns
Any end-of-life software?Technologies detected on web assets, with end-of-life status
Is traffic encrypted?Certificates, issuers, expiry dates and TLS configuration findings
Is the inventory complete?Subdomains and hosts discovered that the application didn’t list

Findings are also classified against compliance frameworks, from OWASP Top 10 2021 to PCI DSS 4.0 and HIPAA. See Risk Detection.

Separate the Exploited From the Theoretical.

A long list of high CVSS findings says less about loss likelihood than a short list of CVEs attackers already use.

EPSS estimates how likely each CVE is to be exploited in the next 30 days, and CISA KEV lists the ones already exploited. The ones at the top of that order are where the conversation starts.

CVE on the applicant’s assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

A Score Timeline Across the Term.

Scores are kept as a timeline from the day monitoring starts. A renewal can read a year of direction instead of a single day’s scan.

Score-decrease notifications flag a drop mid-term, so it is known before the renewal conversation instead of during it.

  • score decreased caught at the next scan
  • a scan
  • the change
  • caught at the next scan

One Engine Serves Other Decisions Too.

Use case Security Risk Scoring One scoring engine across organizations, with each score kept as a timeline. Read TPRM · Capability Vendor Risk Scoring The engine that scores any organization added as a portfolio. Read Use case Mergers and Acquisitions Due Diligence This outside-in assessment, applied to an acquisition target. Read

Use This Data in Your Tools

Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.

Questions About Cyber Insurance Assessment

Does the applicant have to take part?

No. Everything on this page is read from the internet-facing side, starting from the primary domain. The applicant can still review the findings with you, and fixes show up in the next scan.

Is the scanning intrusive?

No. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests. Port scans and web requests reach only what a host already exposes to the internet.

Does this replace the application form?

No. Scanning covers what anyone on the internet can see. Controls inside the organization, such as backups, training and internal access, still need the applicant’s answers.

How often is an insured’s surface rescanned?

Monitored assets are rescanned on the platform’s own schedule, with nobody on either side triggering it, and each layer keeps a dated history across the policy term.

Can we assess a whole book of insureds?

Each organization is a portfolio scored by the same engine, so organizations compare directly. Talk to us about the size and shape of the book you have in mind.

Assess an Applicant From the Outside.

Bring a domain from a current submission to a demo and read the findings, the CVE ranking and the score with our team.

Request demo