The problem they put to us
Two teams, one client, and two completely different sets of information
A global broker with a significant cyber risk, quantification and broking practice described a persistent problem in cyber insurance: the people responsible for cybersecurity and the people responsible for buying and managing insurance often work with very different information.
The CISO sees vulnerabilities, controls and technical exposure. The risk manager needs to understand financial impact, how much risk to retain, how much insurance to buy and what information to take to the market.
That disconnect creates friction during cyber insurance placement, and it makes valuable security data difficult to incorporate into risk quantification and underwriting decisions. It was their framing, not ours, and it has shaped the product ever since.
What we explored
Three questions, asked by people who place the risk
Working through the problem with the broker's cyber risk specialists, we tested whether an evidence layer could sit between cybersecurity and insurance.
01
Can security data become quantification-grade?
Whether vulnerability and control data can be structured and enriched so that it becomes genuinely useful for cyber risk quantification, rather than a feed nobody downstream can act on.
02
Can vulnerabilities be tied to loss scenarios?
Whether vulnerabilities can be mapped to controls and realistic loss scenarios, rather than treated simply as technical scores detached from what could actually happen.
03
Can the evidence travel to the market?
Whether technical evidence can be translated into a form that risk managers, brokers and ultimately underwriters can use in a placement conversation.
Astragar demonstrated an approach that works from vulnerability and asset data without requiring direct access to a client's security environment, then connects vulnerabilities, controls and scenarios to quantify residual risk.
What we took from it
Fewer findings. More decisions.
The opportunity is to turn thousands of vulnerabilities and control observations into a much smaller number of decision-ready insights. That conclusion came out of this conversation, and it directly shaped the evolution of Astragar into an evidence layer connecting cybersecurity, risk management and insurance.
What can realistically go wrong
The scenarios that actually occur, not the full universe of theoretical threats.
Which controls materially change it
The small set of controls that move residual risk, separated from the ones that do not.
What the financial consequence is
Exposure expressed in the reporting currency a board and a risk manager already use.
What that means for insurance
How much to retain, how much to transfer, and what evidence to take to the market.
Where this goes next
See the evidence layer your placement conversation is missing
We can walk a broking or risk team through the same approach on a live book, without touching your client's security environment.
← Back to our story
See your cyber risk in $ terms, not CVSS scores.
