Outside-in attack surface scanning
Examining from the internet, without internal access, what an organization exposes, open ports, vulnerable services, certificates, leaked credentials, which cyber insurers use to check declarations and alert their insureds.
Outside-in scanning means observing an organization as an attacker would, from the internet, without any access to its internal systems: addresses and domains belonging to it, open ports, exposed services and their versions, known vulnerabilities, email configuration, expired certificates, employee credentials that appeared in leaks. Cyber insurers use it at three moments. At underwriting, to check the application's statements and detect exposures the applicant is unaware of. During the contract, to alert the insured when a critical vulnerability appears on one of its exposed services, which makes the insurer a prevention actor. And across the portfolio, to measure within hours how many insureds are exposed to a new flaw, which is the first estimate of an accumulation. The method has known limits: it sees neither internal defects, nor backup quality, nor human behavior, and it sometimes attributes to a company assets that are not its own. It therefore complements the application without replacing it.
In the days after the Log4Shell flaw was disclosed on December 9, 2021, several cyber insurers scanned their insureds' exposed services to identify those running the vulnerable library, and sent them named alerts before the first mass exploitation turned into claims.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.