Technical evidence for cyber underwriting
The insured declared the control was in place. The claim found out it wasn't.
Between the proposal form the insured fills in and the forensic review after a claim lies a gap that nobody measures today. Arandu runs offensive tests against every insured, across infrastructure and AI, and delivers the control-level evidence that supports pricing, policy conditions and claims defence.
Proposal questionnaireArandu evidence statement
| Control | Status |
|---|---|
| 01MFA on all privileged access | YesVerified |
| 02EDR active on every endpoint | YesVerified |
| 03API keys kept out of source code | YesExposed |
| 04Scoring endpoint behind authentication | YesNo authentication |
| 05Chatbot isolated from customer data | YesLeaks context |
| 06Immutable backups, restore tested | YesNot evidenced |
6 of 6 controls declared. Self-attested by the insured.Binding is subject to three open findings. Each comes with a fix and a deadline.
Cyber insurance in Brazil · Jan–Apr 2026 against the same period in 2025
Claims paid
+253.1%
≈ R$ 30m in four months
Premium written
+71.1%
R$ 134.6m in premiums
Claims are growing 3.5 times faster than premium. Underwriting is not keeping pace with the real risk.
Source: CNseg, Jan–Apr 2026
The problem
Every cyber policy starts from a question the insured answers alone.
- 01
Self-declaration
The security questionnaire records what the insured declares. What is actually exposed never reaches the form, and nobody checks again once the policy is bound.
- 02
Out of step
Claims are growing faster than premium: +253% against +71% in the first four months of 2026.
- 03
No verification
Brokers and insurers have no way to validate, technically, what the insured reports. The appetite to check is there. What is missing is the data.
- 04
AI blind spot
Chatbots, credit scoring and AI agents are already attack surface in production. No standard market questionnaire asks about them.
Arandu
The data your underwriting lacks, measured in the insured's live environment.
- 01
Technical evidence at inception and renewal
Real offensive testing against the insured's infrastructure, application and APIs.
- 02
Continuous monitoring after binding
Periodic revalidation for the whole policy period. A risk that emerges in month nine shows up in month nine.
- 03
AI testing, built in
Chatbots, credit scoring and agents tested as attack surface: prompt injection, context leakage, tool abuse.
- 04
Every finding comes with remediation
Prioritised fixes, each with a deadline. Claims fall when the flaw is closed.
- 05
Arandu Verified seal
Versioned and time-limited. The insured displays it, the insurer checks it by URL, and underwriting moves faster.
- 06
Ready-made models for the segments in your book
Payment-rail IT providers (PSTIs), fintechs, healthtechs, VC-backed startups, receivables funds (FIDCs) and B2B SaaS, each with its own weights in the grade.
Four steps from the proposal to monitoring through the policy period.
-
Day 0
01The insured runs the Arandu diagnostic at policy inception or renewal.
-
48–72 h
02Control-level technical evidence, converted into a risk grade for the segment.
-
Pre-binding
03The insurer uses the grade to price the risk, set subjectivities or require fixes before binding.
-
During the term
04Periodic revalidations feed risk monitoring until the last day of the policy.
From the field
With no credentials and within minutes, we had found exposed production API keys, unauthenticated endpoints and zero security headers, on a platform already processing customer data. No underwriting questionnaire asks about this kind of flaw. It shows up first as a claim.
Who it's for
Four desks get the same evidence. Each one decides something different.
“Is what the insured declared actually in place?”
“How do I bring the insurer a risk I can defend?”
“What is the target's cyber risk, and does it kill the deal?”
“How do we prove we're secure?”
What lands on the desk
Six deliverables, from the committee summary to the file for the technical team.
- 01
Score card
Overall grade from A to F, with sub-grades by category: AI, infrastructure, data, cloud and compliance.
1-page PDF + web dashboard
- 02
Executive summary
Three pages for the committee: blocking findings, quantified risk and recommended actions.
PDF
- 03
Technical findings
Every vulnerability with its evidence, severity, exploitability and business impact.
Web dashboard + JSON API
- 04
Deal-breaker report
What should stop or pause binding or the investment, with the evidence for each item.
2-page PDF
- 05
Arandu Verified seal
Digital seal with version and expiry date, verifiable at a public URL.
SVG + verification page
- 06
Remediation guide
Fixes listed in order of priority, with estimated effort.
Markdown + PDF
Reports in Portuguese, English, Spanish, German, French and Italian.
Comparison
Reputation scanner, AI governance platform or Arandu: three different answers.
Drag to see the whole table
| Criterion | External scannersBitSight, SecurityScorecard | AI governanceCredo AI, OneTrust | AranduCOST + Agent SPM |
|---|---|---|---|
| Data source | Public external signals: DNS, certificates, leaks | Declared policy and document inventory | Offensive testing run in the insured's environment |
| Depth | Surface visible from outside, no exploitation | Documentary; the production system goes untested | Real exploitation of infrastructure, application and API |
| AI surface | Not covered | Covered on paper: compliance and model tracking | Chatbots, scoring and agents tested in production |
| Operational risk | Reputation score, no remediation plan | Tracks compliance; exposure stays out of scope | Findings with prioritised remediation and deadlines |
| Fit for underwriting | Indicative; cannot support a policy condition | Does not address pricing or claims | Control-level evidence, segment grade and revalidation during the term |
Questions
Questions from underwriters.
01How does Arandu fit into our underwriting process?
The assessment enters as a technical step before binding. The insured runs the diagnostic, and the insurer receives the control-level grade and the evidence report through the same channel that brings in the questionnaire today. Delivery comes as a report, a structured spreadsheet or an API, with no change to underwriting systems.
02Does this replace the security questionnaire we already use?
No. The questionnaire still records the insured's declaration and the contractual responsibility that comes with it. Arandu tests what was declared and covers what the form leaves out, in particular AI surface, credential exposure and unauthenticated endpoints.
03How do the partnership and broker commission work?
The broker refers the insured for assessment and is paid on every contract closed with Arandu evidence. Tier-1 brokers that standardise the assessment across their whole book can use a volume model, with per-assessment pricing and queue priority.
04Which segments do you cover today?
Payment-rail IT providers (PSTIs), fintechs and payment institutions; hospitals and healthtechs; VC funds and M&A targets; receivables funds (FIDCs) and digital lenders; B2B SaaS and service companies. Each segment has its own risk model and weights in the grade.
05How does AI security testing work (chatbots, scoring, agents)?
The model in production is treated as attack surface: prompt injection, data leakage through context, policy bypass, credit scoring manipulation and abuse of agents with tool access. The result enters the grade as a separate control, kept apart from the infrastructure score.
06How long does the assessment take?
48 to 72 hours for the standard assessment, counted from scope sign-off. Complex environments, such as multiple subsidiaries, core banking integration or agents with access to sensitive data, take 5 to 10 working days.