Risk intelligence · Cyber insurance
Every insured depends on providers for mail, DNS, hosting and certificates. When many insureds depend on the same provider, one outage becomes many claims at once. Datazag shows those shared dependencies across your book, with the evidence for each insured underneath.
For underwriters, the same evidence answers a simpler question: what does this applicant actually run, before you bind and during the term?
Two readers
Should we write this risk?
The underwriter, before binding and during the term.
What happens to the book if one provider fails?
The portfolio and accumulation analyst.
Underwriting
A submission describes the estate the applicant knows about. Datazag finds more of it in public infrastructure: domains, providers and control gaps that do not reach the questionnaire.
No questionnaire, no agent, no asset inventory. Every finding carries the evidence that produced it, so a declination or a rate load can be explained to a broker.
Check a submission against what is publicly visible, not only what was self-reported. Estate discovery finds domains the applicant did not declare. Posture analysis shows whether the controls they claim are actually published in DNS.
A risk priced in January is not the risk you carry in July. Run the assessment again during the term to see new exposure and controls that are about to expire.
Submission assessment
Structure of a finding
Estate discovery
Every tier above “Declared” shows the relationship that evidenced it.
Control findings
Published but not enforcing — impersonation is reported, not blocked
Enforcing, within the lookup limit
Available at this provider, not deployed
What an underwriter acts on
These signals can inform a price or a condition. They are not a generic risk score. Each is read from public infrastructure and carries the record it was read from.
Domains the applicant owns but did not list, linked through certificate, mail and registration records and sorted into confidence tiers. Adverse selection can hide in the gap between the declared estate and the real one.
Whether SPF and DMARC are published and enforcing, not just present. One policy blocks impersonation; the other only reports it. Business email compromise remains a significant source of cyber loss.
What expires next, what has already lapsed, and which controls will fail if nobody acts. The expiry calendar shows how the insured runs their estate.
Where the estate sits on the ladder from baseline (SPF and DMARC) to hardening (CAA and DNSSEC). A maturity path you can write conditions against, not a pass or fail.
Concentration
Anyone can count how many insureds use a provider. Datazag shows that share as it is, then rates how serious it is by two things: how resilient the provider is, and how hard it is to leave. Exit friction stands in for restoration time, and restoration time drives business interruption severity.
This is not hypothetical. In October 2016 an attack on the DNS provider Dyn made many major websites unreachable at the same time, across many unrelated companies.
Where each insured's mail is hosted.
The filtering service in front of the mailbox.
Who answers for the insured's domains.
Whose signing keeps a signed zone resolving.
Who serves the insured's websites.
The network (ASN) each service runs on.
Who issues the insured's certificates.
Who holds the insured's domain registrations.
Compound exposure
That is worse than two separate concentrations of the same size. Datazag reports it as its own finding, so it is not hidden inside two provider shares.
Concentration does not depend on refresh speed. Enterprise DNS changes rarely, so a nameserver record observed a month ago is almost certainly still correct.
Provider A fails: one function lost.
Provider A fails: both functions lost.
The same concentration exists across the internet. 6 networks carry half of all domains that sit on a network, and 227 carry nine in ten. Method and caveats →
Reverse index
After a provider outage, the first question is: what is our exposure? Working that out from policy files is slow. Datazag answers from the other direction. Name a provider, and see which domains on your list depend on it, and for what.
Which insureds' domains depend on the affected provider, for DNS, mail or hosting, with the evidence for each.
Name a provider and an outage, for example "authoritative DNS unavailable for twelve hours". See which insureds lose which functions. The result feeds systemic-scenario and reinsurance reporting.
Datazag reports which policies are exposed and how. It holds no claims or loss data, so pricing the scenario stays with your own models.
Change during the term
Enterprise DNS changes rarely. The estate is what changes: new subdomains, new certificates and new hosting under a domain you already cover. Datazag reads Certificate Transparency logs continuously, so a new certificate under an insured's domain is seen as it is logged.
Changes show up in the next report and in the tables. Our daily posture history starts on 20 August 2026, so change is measured from then, not before.
Names that appear in new certificates, then resolved to see where they point.
Issued for an insured's domains, with the issuing authority.
Services appearing on networks or providers the insured did not use before.
Freshness
Different data changes at different speeds, so it is refreshed at different speeds. Portfolios can be moved to a faster schedule.
Measured record age across the served corpus: median 13 days, 95th percentile 28 days. Measured .
Every row carries the time it was observed. A domain we have not checked recently shows as not checked. It never shows as clean.
For analysts
Each dataset is documented on its own page. Availability is shown per dataset, and is only marked available when a route is live.
Which providers does each insured depend on?
DNS, mail, hosting and CDN providers behind each domain.
Provider Intelligence
Coming soonWhat does each insured publish for email security?
SPF, DMARC, MTA-STS, DNSSEC and BIMI, and what those records actually say.
Domain Posture & Intelligence →
Coming soonWhich network does each service run on?
Maps an IP address to its network, operator and registry country.
Delivery
A report answers questions about one moment. The reverse index and accumulation trends need the data itself, kept as a series. So delivery comes in two parts.
Reports on a submission or a sample of the book, with discovery, posture and concentration shown separately.
The underlying tables in your own warehouse, refreshed on the schedule above, for accumulation trends and actuarial work.
Where your book goes
Your book can stay in your own Snowflake or Databricks account. The claim below is specific to that route, and it does not cover the others.
The dataset is delivered into your own cloud account and queried there. Your tables, your queries and your results stay in your environment. Nothing you join against our data is sent to us, and we cannot see it.
On this path Datazag is not a processor of your data: there is no processing agreement to negotiate for it, no international-transfer assessment, no sub-processor list to review, and no breach of ours that could expose it.
You send us domains to be assessed in a report, so Datazag receives and processes what you send.
This path is a processing relationship and is governed by the data-processing agreement. The architectural argument above applies to the share path and does not extend to this one.
A report is different: you send us the domains, so Datazag processes them under the data-processing agreement. Trust center →
M&A due diligence
The same evidence answers an acquirer's questions before a deal closes: what the target owns, how it is configured, and which providers it depends on. The forgotten parts of an estate are where risk hides, and the target may no longer track them itself.
Domains the target owns but may no longer track, found through shared certificates, mail and registration records. Discovery is evidence-based: we show what we can link, not a promise of every domain.
Whether email authentication, certificates and DNS controls are in place across the estate, not just on the main domain.
Which mail, DNS, hosting and CDN providers the estate relies on, and how much of it sits with each one.
Diligence firms can run the same assessment across many deals, with every finding in the same format.
Evidence for diligence, not an acquisition risk score. Each finding shows the record it came from, so it can be raised with the target and checked.
Evidence, not a score
A number an underwriter cannot explain is a number an underwriter cannot use. Datazag attaches the observation behind each finding: the record, the source and the time it was read. A rate load, a condition or a declination survives the conversation that follows it.
You set the thresholds. Datazag supplies the evidence and the reasoning. The underwriting decision stays yours.
Talk to us about your bookEvery finding states why it fired.
The DNS, certificate or routing observation it was read from.
How strongly an asset is linked to the insured.
A broker can dispute a finding against its evidence.
Questions
Start here
Send a list of domains for a sample of your book, one or more per insured. We find the rest of each estate from there, and return the discovery, posture and concentration layers separately.
Underwriters
See a sample estate reportAnalysts
Request sample data