Make cyber insurance evidence-backed.
Astragar connects an insured’s actual vulnerabilities, sensitive data, controls and threat scenarios to their cyber insurance policy, helping insurers understand the risk they are covering and maintain evidence against policy conditions throughout the policy lifecycle.
Book a meeting at ITC Start here
Which one are you?
I underwrite cyber.
Create evidence-backed cover and use evidence across underwriting, monitoring, renewal and claims.
See how it works →Brokers & MGAsI structure and place cyber.
Understand actual financial exposure, identify potential coverage gaps and help clients demonstrate their risk.
See how it works →InsuredsI buy cyber insurance.
Know whether your cover matches your actual risk and maintain evidence against important policy conditions.
See how it works →The insurance problem
Cyber insurance still relies on too much assumption.
Tell you what should be true.
Useful, but largely point-in-time and self-reported.
Tell you what is technically wrong.
CVSS scores and vulnerability counts rarely say what a weakness could cost.
Tells you what must remain true.
Conditions and security requirements matter all policy period, but are hard to connect to actual controls and evidence.
Connects all four.
Actual risk, financial exposure, policy requirements and the evidence behind them.
The Astragar evidence model
From security evidence to insurance evidence.
Each layer answers a question an insurer actually needs answered.
Residual risk is what you’re insuring. Now connect it to the policy.
Make the policy operational
Turn policy conditions into controls.
Astragar converts important cyber insurance policy conditions and security requirements into controls the insured can manage, test, evidence and attest.
Instead of waiting until renewal or a claim to find out whether a requirement was met, insurers and insureds build an evidence record throughout the policy period.
Capabilities
One platform. The evidence insurers need.
Know what’s financially exposed
Discover sensitive data automatically and quantify its financial value, so severity is understood, not guessed.
Know what could drive the loss
Prioritise vulnerabilities by the value and sensitivity of the assets they expose, separating material issues from noise.
Know what the loss could cost
Bring vulnerability, data, control and AI-agent evidence together to estimate potential business and financial impact.
Know whether policy requirements are being met
Move beyond whether a control exists to evidence that it is operating, tested and attested.
Evidence emerging AI risk
Attribution, permissions, behavioural activity and tamper-evident logging for AI agents. An exposure questionnaires were never built to assess.
Insurance use cases
From underwriting to claim: one evidence chain.
Understand the actual risk.
Connect vulnerabilities, sensitive data, controls and financial exposure to proposed cover.
Pilot
Don’t buy another platform. Test the idea first.
Can better cyber evidence change an underwriting decision?
Take one insured, or a small defined set of insureds, and connect vulnerabilities, sensitive data, controls and financial exposure.
Can policy conditions become continuously evidenced controls?
Take one policy or product, or selected requirements, convert conditions into controls and test the evidence workflow.
Can evidence collected during the policy period improve renewal and claims assessment?
Follow selected controls and evidence, and test how accumulated evidence supports downstream insurance decisions.
At ITC Vegas
Three conversations we’d like to have.
Can cyber cover become evidence-backed throughout the policy lifecycle?
Talk to us →What if the evidence required at claim already existed before the incident?
Talk to us →Can actual cyber exposure help clients buy better-matched cover and demonstrate the controls behind it?
Talk to us →Looking for design partners.
Test the model using one insured, one policy, one small book or one insurance workflow.
The vulnerability isn’t the risk.
A vulnerability matters because of what it exposes, what depends on it, what controls surround it and what happens to the business if it is exploited.
And the policy isn’t the protection unless it matches the risk.
Going to ITC Vegas?
Bring us a cyber risk. Or bring us a cyber policy.
In 20 minutes, we’ll show you how Astragar connects the risk, financial exposure, policy conditions, controls and evidence.
Meet Astragar at ITC Vegas
