Why insurers score small businesses from the outside
Underwriting a small business is hard to do at scale. Each applicant is small, premiums are modest and a manual security review costs more than it saves. An external scan solves that by producing the same evidence for every applicant within seconds, with no questionnaire fatigue and no access to the applicant’s systems.
For the insurer it standardises triage. For the business it is a preview of how the application will be read. RiskPulse publishes the same CyberScore to business owners and, through a read-only API, to insurers, so both sides see one number built from one method.
What underwriters see in an outside-in score
- Email spoofability. Missing SPF, DKIM or DMARC signals a business that can be impersonated in payment-fraud attempts.
- Exposed services. Databases or remote-access ports reachable from the internet are a direct route to ransomware.
- Known-vulnerable software. Version banners that match published vulnerabilities show weak patching discipline.
- Credential exposure. Leaked employee credentials predict account takeover.
- Encryption hygiene. TLS and certificate problems show how carefully the basics are maintained.
RiskPulse combines ten such checks into a 0 to 850 score with category breakdowns. The full method is described on the engine page, and the underwriter-facing interface on the Insurer API page.
What an external score cannot prove
An outside-in score is evidence of public hygiene, not of overall security. It cannot see multi-factor authentication coverage, backup and restore testing, endpoint protection, staff training or incident-response readiness. Responsible insurers pair it with a proposal form for exactly those reasons.
This page is general information for Indian SMEs and is not insurance, legal or financial advice. Policy terms and pricing are decided solely by insurers.
How to prepare before you apply for cyber cover
- Run a baseline scan and note your score, band and top findings.
- Fix the highest-impact items first: exposed ports, email authentication, patching.
- Turn on multi-factor authentication for email, admin panels and remote access. Insurers usually ask.
- Confirm that backups exist, are offline or immutable, and that you have tested a restore.
- Write a one-page incident-response plan with named owners and phone numbers.
- Re-scan, keep the dated report, and attach it to your proposal where appropriate.
Cyber insurance and risk-scoring questions
How do insurers assess the cyber risk of a small business?
Most combine a proposal form with an outside-in scan of the business’s public domain. The scan shows internet-facing weaknesses such as expired certificates, exposed services, spoofable email and known-vulnerable software. Underwriters use the findings to decide whether to quote, what to ask next and how to price.
Will a better cyber risk score lower my cyber insurance premium?
It can help your case, but premium depends on the insurer’s model, your industry, revenue, data held and claims history. A strong, well-documented security posture gives underwriters more confidence and fewer reasons to add conditions or exclusions. No score guarantees a particular price.
What do insurers ask for besides a scan?
Typically multi-factor authentication on email and remote access, backup practices, patching cadence, endpoint protection, incident-response arrangements and employee training. These are internal controls that an outside-in scan cannot see, so expect the proposal form to ask about them directly.
Does RiskPulse sell insurance?
No. RiskPulse produces the CyberScore and report. Insurers and brokers can request read-only access to the same scoring through the Insurer API. Whether a policy is offered and at what price is always the insurer’s decision.
Do I have to report cyber incidents in India?
Many organisations are covered by CERT-In’s 2022 directions, which require specified cyber incidents to be reported within six hours of noticing them. The DPDP Rules add breach-reporting duties to the Data Protection Board and affected people. Confirm which obligations apply to you with qualified advice.