Cyber underwriting risk assessment that finds the contradicted answer before the quote
Control gaps found before the quote, each linked to the answer or scan.
See one case, screen by screen ↓Software that reads a cyber submission — the application, ransomware supplement, outside-in scan, pen test and loss history — and grades each security control against the carrier’s minimum-controls guide. Cyber Underwriting Risk Assessment puts every signed answer beside the evidence for it, flags the contradictions and writes the subjectivities before the quote.
How to choose AI solutions for insurance →
Updated
A cyber submission is four or five documents talking about the same dozen controls: the application, the ransomware supplement, the outside-in scan you ordered, sometimes a penetration test summary, and the loss history. They often disagree. The application says MFA covers all remote access; the scan finds remote desktop open to the internet with no MFA gateway in front of it.
Today the underwriter reads every one of them end to end to find that line — three to four hours on a mid-market account. Subjectivities get written from memory, so the wording changes from one underwriter to the next. And a contradiction nobody caught becomes the coverage dispute after a ransomware event: in Travelers v. International Control Services (2022) the signed application said MFA was in place, forensics after a ransomware attack found it was not, and the carrier sued to rescind; the parties agreed the policy was void from the start.
Estimated split, in hours, for one mid-market cyber submission, by hand and with the solution.
Five specialist agents put every signed answer beside the scan and pen test; the cyber underwriter decides and sends.
Lattimer Freight Systems, a freight and warehousing company in Columbus, Ohio, wants a $5,000,000 limit. Its wholesale broker sent five documents. Here is what happens next, screen by screen, in the working solution.
Nadia opens Lattimer Freight: revenue $186.4m, 640 employees, 14 terminals, $5,000,000 excess of a $250,000 retention, effective 1 Nov 2026, quote due Friday. The grade strip already reads 3 contradicted, 1 partial, 3 gap, 1 ask the broker, 1 watch and 6 meets. The control score is 58 out of 100 — below the appetite floor of 60.
“Below the floor of 60 · 78 once S1–S3 are met”
The queue ranks 11 cyber submissions by the date the broker needs the quote, with the documents each one carries: application, supplement, scan, pen test, loss history. Six have a contradicted answer and seven quotes are due by Friday. Brindlewood County Schools is waiting on the broker for its ransomware supplement; Ostrander Cold Storage has its scan still running.
The application is 14 pages, signed 18 Sep 2026 by Martin Greaves, CFO. Each answer the scorecard uses carries a mark in the margin, coloured by its grade — Q22 on remote access MFA and Q31 on critical patching are marked contradicted. A blank stays “not answered”; nothing is inferred.
Limit: never infers an answer that was not given.
The scan ran on 9 Oct 2026: 37 internet-facing assets, 11 findings, mapped to 5 controls. SC-01 is the edge VPN appliance on firmware 7.0.12, on the known-exploited list since 21 Aug 2026. SC-03 is remote desktop open on 203.0.113.47 with no MFA gateway, first seen 2 Aug 2026.
The scan is read, never run — the agents do not probe the insured’s systems.
“Run the check again” replays the grading in view. The claims fill in first. On MFA on remote access the drawer slides open with the signed answer highlighted on the application page — Q22, “Yes” ticked, signed 18 Sep 2026 — while the grader matches the evidence.
The scan finding slides in as the scanner recorded it: 203.0.113.47:3389/tcp open, remote desktop, CN=LFS-TS01, login page with no MFA gateway. The sign turns to ≠ and the grade to Contradicted. Under “Why this grade”: the remote desktop login has been open for at least 68 days, and remote desktop with stolen passwords is the most common way ransomware gets in.
“The evidence contradicts the signed answer.”
Three pre-bind subjectivities, three conditions after binding and one question to the broker, each worded from library v14 and citing both sides. DMARC at p=none becomes condition C2 within 60 days; 214 warehouse scanners on the office network become C3 within 90 days; 23 leaked credentials with no admin account stay on watch. The run log shows each step and its time.
Limit: never invents wording outside the library, never relaxes a condition.
The indicated terms on the Corvane Specialty form: $142,800 annual premium against $96,400 expiring, a $250,000 social engineering sublimit, a 10-hour waiting period. If S1 is not met at binding, ransomware cover is sublimited to $2,500,000 at 50% coinsurance. Nadia can edit any wording or move an item between pre-bind and post-bind.
“Nothing reaches Delia Ashcombe until you send it.”
Nadia sends the quote with three pre-bind subjectivities to Delia Ashcombe at Wexmoor & Pike. The underwriting note is already drafted — the risk, every grade with its evidence, and the basis for quoting below the floor. Score 58 is above the referral line of 50, the limit is within her authority and no contradiction was overridden, so no referral is needed. She signs.
418 submissions graded in Jul–Sep 2026: 146 contradictions in 97 of them, each turned into a subjectivity before the quote. MFA on remote access is contradicted in 31% of transport and logistics submissions. Of 212 conditions on bound policies, 13 are overdue — one click reminds the brokers.
The same submission, seen by the five people who carry it — in their own words, and what their week looks like now.
Five specialist agents put every signed answer beside the scan and pen test; the cyber underwriter decides and sends.
Reads the application, ransomware supplement, pen test and loss history; extracts every answer with its question number, page and signer, and counts such as devices with EDR as numbers.
Reads the outside-in scan the carrier commissions and maps each finding — open ports, firmware, email records, leaked credentials, banners — to a control. Reads the pen-test findings the same way.
Puts each signed answer beside the evidence against the minimum-controls guide and grades it: meets, partial, gap, contradicted, ask or watch.
Turns each contradiction into a pre-bind subjectivity, each gap into a condition with its due days, and each “ask” into a question to the broker — from the approved library, with the assets and accounts filled in.
Drafts the note for the file and the letter to the broker, every statement cited.
Decides each contradiction; head of cyber on referral. The agents propose; a named person decides.
Ask about any control, answer, finding or subjectivity — or tell it what to add. Every answer points to the page or finding behind it.
Why is MFA on remote access contradicted?
Because the signed answers and the scan disagree. Application Q22 and supplement Q4.2 both say yes: MFA on all remote access, including remote desktop. The scan of 9 October reached a remote desktop login at 203.0.113.47:3389 (LFS-TS01) with no MFA gateway in front of it, first seen 2 August. That made it S1, a pre-bind subjectivity with a rescan.
Which subjectivities must be met before binding?
Three, each with a rescan or written proof: S1, MFA on remote access (outside-in scan SC-03); S2, MFA on privileged accounts (pen test PT-4); S3, critical patching (outside-in scan SC-01). If S1 is not met at binding, ransomware cover is sublimited to $2,500,000 at 50% coinsurance.
Has Lattimer had a claim that points to these gaps?
One: LF-24-031, March 2024 — a spoofed carrier invoice, $84,300 paid. They adopted call-back verification on 30 April 2024, and the supplement confirms it for changes over $10,000. What is still open is the email side: DMARC is at p=none, so anyone can still send mail as the company. That is condition C2, due 60 days after binding.
Add EDR to 98% as a condition within 60 days
Added as C4. The application says EDR covers all endpoints and servers, but the supplement counts 612 of 651 devices with the agent — 94%, with 39 terminal servers missing it. The wording is library L-EP-02, due 60 days after binding. The quote and the letter to the broker now carry it.
12 screens from the working solution, on its sample data. Pick one to see it large.
What every submission is read against, how grades are set and who decides are settings — versioned and on the record.
| Setting | Default | Choose from |
|---|---|---|
| Documents read | Application, ransomware supplement, outside-in scan, pen test, loss history | Each on or off |
| Ransomware supplement | Required for revenue over $25m | Requested from the broker when missing |
| Partial grade for EDR coverage under | 98% | Step up or down by 1% |
| Scan older than | 30 days | Rescan before grading |
| Control score floor | 60 | Step up or down by 5 · below it, the quote needs a reason on the file |
| Refer to the head of cyber | Score under 50, limit over $5m, or an overridden contradiction | Celeste Imbert |
| Conditions after binding | 30 · 60 · 90 days | Default due days |
| Overriding a contradiction | Underwriter, with a reason | Goes to referral |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample submission · “target” = the design goal, measured in the live solution · “estimated” = our estimate (3–4 h by hand and the hours split) · “typical” = published figures (Coalition, 2025 Cyber Claims Report — 60% of claims began with business email compromise or funds transfer fraud). The Travelers v. International Control Services case is as reported by Reed Smith (2022). People, insureds, brokers and carriers named on this page are fictional — characters and sample data in the working solution.
Software that reads a cyber submission — the application, ransomware supplement, outside-in scan, pen test and loss history — and grades each security control against the carrier’s minimum-controls guide. Cyber Underwriting Risk Assessment puts every signed answer beside the evidence for it, flags the contradictions and writes the subjectivities before the quote.
The submission reader extracts each answer with its question number and page; the scan matcher maps each scan and pen-test finding to a control. The control grader then puts the two side by side. When the evidence shows a signed yes is untrue — remote desktop open with no MFA gateway after the application said MFA covers all remote access — the row is graded Contradicted.
Fifteen, in six groups: identity and access (MFA on remote access, email and privileged accounts, separate admin accounts), endpoint (EDR, critical patching, unsupported systems), recovery (immutable tested backups, MFA on the backup console, incident response plan), exposure (network segmentation, leaked credentials), email and payments (email authentication, payment verification) and governance (phishing training).
No. It reads the outside-in scan the carrier ordered and the pen test the broker sent, and reports only what they recorded. Where the scan was the evidence, a rescan before binding confirms the fix.
Only from the approved library the head of cyber owns — for example L-RA-02 for exposed remote desktop or L-EM-01 for DMARC to p=quarantine. The writer fills in the assets and accounts from the evidence and cites both sides. Every library change is a new version.
Yes. The agents never quote, bind, decline, relax a condition or contact the insured. The underwriter decides each contradiction — keep, ask the broker or override with a reason — edits the wording, sends the quote and signs the note. An override refers the file to the head of cyber.
Yes. Rules by revenue band, the EDR coverage threshold for a partial grade, how old a scan may be, the control score floor, referral triggers and the default due days for conditions are all settings.
The Agentic Solution Engine builds and deploys it from your requirements — your application and supplement forms, minimum-controls guide, subjectivity library and a sample of past submissions — and it goes live once every quality gate has passed. We will walk you through it on your own submissions first.
Exposed insureds and limit listed the day a vendor event breaks.
1-min demoPolicy Wording ComparisonEvery deviation from your form found in minutes, none bound without an approver.
1-min demoClause Library & Precedent SearchA cited precedent in seconds, not an email to the one specialist who knows.
1-min demoWe’ll run Cyber Underwriting Risk Assessment on a sample of your own cyber submissions.