What would a serious breach actually cost us?
Business interruption, lost revenue, recovery, regulatory exposure, data loss, third-party liability. Not just the ransom.
What's your number?
What is your cyber risk in dollars?
Not a score. Not red, amber or green. A number.
Find out what your biggest cyber risks are, what they could cost, and whether your insurance would cover the loss.
A number
Not a score, not red amber green. Exposure in dollars your board can act on
Loss − cover
Your modelled loss tested against the limits, sublimits and exclusions you actually hold
The few
The handful of vulnerabilities driving most of the financial exposure
If you were breached tomorrow, could you answer these three?
Most organisations can answer the first one roughly, the second vaguely and the third not at all. The three are the same question asked at different depths.
How much of that loss would our cyber insurance cover?
Policy limits are not the same as knowing your exposure. Sublimits, waiting periods and exclusions decide what is actually payable.
Which vulnerabilities and control gaps are creating it?
Worked backwards from the number to the specific assets, data, vulnerabilities and controls behind it.
The coverage gap
A policy limit is not the same thing as knowing your exposure.
Illustrative example. Not an Astragar customer result.
The prioritisation gap
Thousands of vulnerabilities. A handful that move the number.
Fix these first.
Illustrative example. Not an Astragar customer result.
Your tools say what is vulnerable. Your policy says what might be covered. Astragar connects the two.
Security tools, risk scores and cyber insurance usually sit in three separate places. The exposure lives in the join.
- Vulnerabilities
- Critical assets
- Sensitive data
- Controls
- Business context
- What a serious incident could cost
- Modelled by scenario
- In dollars, not severity labels
- Limits and sublimits
- Waiting periods
- Exclusions
- Control representations
- The gap between loss and cover
- What to reduce
- What to accept
- What to insure
Two ways in
Test your coverage against your actual exposure.
- Potential financial loss, modelled by scenario
- Policy limits and the coverage that would actually respond
- Potential coverage gaps, including sublimits and exclusions
- The underlying vulnerabilities and controls creating the exposure
- Priorities for reducing what remains
Understand the risk before deciding what to insure.
- Quantify the exposure before deciding what to insure
- Identify the specific risks driving the number
- Use the evidence to inform limits and cover
- Reduce what can be reduced first
- For eligible US customers, connect to insurance options through Sternwake and participating carriers
The review
Five questions, answered with your own evidence.
- What are your most material cyber exposures?
- What could those exposures mean financially?
- What evidence supports it, from vulnerabilities, assets, data and controls?
- How does your existing cyber insurance relate to that exposure?
- What should be reduced, accepted or insured?
Reduce what you can. Insure what remains.
Know your risk. Fix what matters. Insure what remains.
Twenty minutes on your environment and your current cover, then the review.
Astragar Inc, 224 W 35th St Ste 500, New York, NY 10001. All dollar figures shown on this page are illustrative examples, not Astragar customer results, and are not a prediction of any organisation's loss. The Cyber Risk & Coverage Review quantifies risk and compares it against policy wording; it is not insurance advice and is not a determination of whether any claim would be paid. Insurance placement and advice sit with Sternwake, a licensed insurance brokerage, or with your own broker. Availability of insurance options through Sternwake and participating carriers depends on eligibility and jurisdiction.
