Pre-binding cyber posture assessments for insurers, underwriters, and brokers. Passive, evidence-based, independent. Gives you a credible view of risk before you accept it — without requiring anything from the applicant.
The applicant's security questionnaire tells you what they think. A passive OSINT assessment tells you what's actually visible from the outside.
Independent pre-binding assessment of the applicant's external posture. Evidence-based, framework-mapped, produced without applicant cooperation — so the view is unfiltered.
Differentiate your brokerage by offering clients a GRC posture assessment alongside the renewal process. Demonstrate value beyond the quote.
Post-incident assessment of what was externally visible before the event. Establish whether the insured's posture matched their policy declarations.
Screen an entire portfolio of policyholders to identify the accounts carrying the highest external exposure before they become claims.
Independent view of cedent portfolio quality. Passive assessment across a sample of underlying risks to validate the book's actual posture.
Embed cyber posture assessment into your binding authority workflow. Evidence-based risk selection without slowing the process.
Stop relying on self-reported questionnaires. See the applicant's actual external posture — email security, credential exposure, infrastructure gaps, privacy compliance — before you commit capital.
Show existing clients what's changed since their last assessment. A year-on-year comparison of their external posture gives them a reason to stay and a reason to invest in remediation.
After a claim, assess what was externally visible before the incident. Establish whether the insured's posture matched their policy representations.
Screen your book to find the accounts with the highest external exposure. Address them proactively before they become loss events.
The following is drawn from a real passive OSINT assessment conducted in 2026. Company details have been anonymised.
A pre-binding assessment of an ASX-listed technology company operating in the regulated wagering space identified five sets of live API credentials sitting in public GitHub repositories. All five were confirmed active against their respective provider APIs on the day of assessment.
The applicant’s security questionnaire had reported no known credential exposure. DMARC was set to p=none — offering zero protection against email spoofing. Five historical origin server IPs were found bypassing the CDN. No WAF was in place.
None of this was visible from the application form. All of it was visible from public data in under 24 hours.
The difference between what an applicant reports and what an independent assessment reveals is the difference between pricing risk and inheriting it.
The following is a reduced extract from a real BlackFlag Advisory assessment conducted in 2026. Company details have been anonymised. The full engagement includes a complete risk register, framework mapping, remediation roadmap, and Board-level executive summary.