Cyber underwriting
A submission describes the estate the applicant knows about. Datazag finds the rest in public infrastructure: domains, providers and control gaps, with the evidence for each finding.
Prefer to talk first? Book a 20-minute call
Two questions
Should we write this risk?
Before binding: what the applicant runs, how it is configured and what it depends on.
What changed since we bound it?
During the term: run the assessment again to see new exposure and controls about to lapse.
Assessing accumulation across a book? Reinsurers & risk modeling →
Underwriting
Estate discovery finds domains the applicant did not declare. Posture analysis shows whether the controls they claim are published in DNS.
No questionnaire, no agent, no asset inventory. Every finding carries the evidence that produced it, so a declination or a rate load can be explained to a broker.
Check a submission against what is publicly visible, not only what was self-reported. See the undeclared estate, email authentication, certificates and the providers behind them.
A risk priced in January is not the risk you carry in July. Run the assessment again during the term to see new exposure and controls that are about to expire.
Submission assessment
Structure of a finding
Estate discovery
Every tier above “Declared” shows the relationship that evidenced it.
Control findings
Published but not enforcing — impersonation is reported, not blocked
Enforcing, within the lookup limit
Available at this provider, not deployed
What an underwriter acts on
These signals can inform a price or a condition. They are not a generic risk score. Each is read from public infrastructure and carries the record it was read from.
Domains the applicant owns but did not list, linked through certificate, mail and registration records and sorted into confidence tiers. Adverse selection can hide in the gap between the declared estate and the real one.
Whether SPF and DMARC are published and enforcing, not just present. One policy blocks impersonation; the other only reports it. Business email compromise remains a significant source of cyber loss.
What expires next, what has already lapsed, and which controls will fail if nobody acts. The expiry calendar shows how the insured runs their estate.
Where the estate sits on the ladder from baseline (SPF and DMARC) to hardening (CAA and DNSSEC). A maturity path you can write conditions against, not a pass or fail.
Concentration
That is worse than two separate concentrations of the same size. Datazag reports it as its own finding, so it is not hidden inside two provider shares.
Across a book, start from the provider. Name a provider and see which insureds depend on it, and for what.
Provider A fails: one function lost.
Provider A fails: both functions lost.
Evidence, not a score
A number an underwriter cannot explain is a number an underwriter cannot use. Datazag attaches the observation behind each finding: the record, the source and the time it was read. A rate load, a condition or a declination survives the conversation that follows it.
You set the thresholds. Datazag supplies the evidence and the reasoning. The underwriting decision stays yours.
Every finding states why it fired.
The DNS, certificate or routing observation it was read from.
How strongly an asset is linked to the insured.
A broker can dispute a finding against its evidence.
How strong is the evidence?
Every row carries the time it was observed. Measured record age across the served corpus: median 13 days, 95th percentile 29 days. Measured .
Free snapshot
Send one applicant's domain, or the primary domains of a sample of your book. We grade each one and show the top issue, with its evidence.
Prices
| Report and scope | Delivery | Price | |
|---|---|---|---|
Organization estate report Up to 10 registered domains, with associated-domain discovery and dependency mapping | Within the hour | $299 | Buy the report |
Organization estate report Up to 50 registered domains, with associated-domain discovery and dependency mapping | Within the hour | $799 | Buy the report |
Organization estate report Up to 250 registered domains, with associated-domain discovery and dependency mapping | Same day | $1,995 | Buy the report |
Portfolio report Up to 25 organizations and 100 registered domains, with a report per company | Same day | $995 | Buy the report |
Portfolio report Up to 50 organizations and 250 registered domains, with a report per company | Same day | $1,995 | Buy the report |
Analyst-reviewed diligence edition Attribution review, validation of priority findings, executive interpretation and a review call | Quoted | From $4,500 | Request a diligence edition |
Annual monitoring Quarterly reruns, drift alerts and "fixed since last run", for any report above. | Every quarter | 2 × the report price, per year |
Accumulation across your book? See the Book Accumulation Snapshot →
Where your list goes
You send us domains, so Datazag processes them under the data-processing agreement.
We ship our data to you. You query it on your own systems and join it to your book there. Your portfolio stays in your building.
Questions