Create evidence-backed cyber insurance.

Supplement point-in-time questionnaires with evidence about the insured’s vulnerabilities, sensitive data, controls, AI-agent activity and potential financial exposure, across underwriting, monitoring, renewal and claims.

Explore an insurer pilot

For Insurers

Create evidence-backed cyber insurance.

Explore an insurer pilot

For Insurers

Create evidence-backed cyber insurance.

Explore an insurer pilot

The proposition

Move from declarations to evidence.

Cyber underwriting relies on information captured at a point in time. The insured’s environment keeps changing after binding. Astragar links assets, vulnerabilities, sensitive data, loss scenarios, financial exposure, controls and policy requirements into evidence you can inspect and challenge. Not another opaque score.

What insurers use it for

Decision-ready evidence, not another score.

Every conclusion links back to the insured’s assets, vulnerabilities, sensitive data, controls and evidence, so you can see why a risk changed, not just receive a different number.

See the evidence model

Use cases:

Risk selection: support Accept / Refer / Decline with contextual evidence, not CVSS alone

Risk engineering: show insureds which remediation may reduce the most financial exposure

Continuous monitoring: observe agreed changes in risk and control posture during the policy period

Renewal and claims: compare with prior-period evidence and an established pre-incident history

Insurance lifecycle

One evidence layer across the policy lifecycle.

Supplement the questionnaire at binding, then keep the evidence current until renewal or a claim.

01 Underwrite: vulnerabilities, sensitive data, controls and modelled exposure as input to risk selection

02 Monitor: policy conditions become controls the insured tests, evidences and attests

03 Renew: compare current exposure and controls with the evidence from binding

04 Claim: pre-incident control and risk evidence to support the investigation

Underwrite → Monitor → Renew → Claim

The insured operates the controls. You receive agreed evidence or evidence-derived views.

Policy-to-control engine

Turn policy conditions into testable controls.

Conditions, warranties and security requirements become mapped controls the insured assigns, tests, evidences and attests. A view of compliance during the policy period, not just at binding.

Discuss an insurer pilot

Example: one policy condition

Policy requirement: MFA required for remote privileged access

Mapped control: privileged remote access requires MFA — tested Pass / Partial / Fail

Evidence: configuration evidence, endpoint evidence and attestation

Monitor: exceptions surface during the policy period, before renewal or a claim

Underwriting example

Move beyond CVSS.

A critical vulnerability on a revenue-critical application holding sensitive customer records is a different risk from the same CVE on a test server. Astragar connects finding → asset → data → loss scenario → modelled exposure → control strength → residual exposure, so the underwriting decision rests on context, not severity scores.