Digital footprint data improves cyber claim prediction

Gallagher Re and KYND have published research showing that digital footprint data can improve cyber claim prediction. The study analysed more than 63,000 insured organisations.

It examined whether an organisation's external digital presence could help cyber insurers assess the likelihood of future claims more accurately than relying mainly on revenue, industry and geography.

The findings suggest conventional firmographic measures, though still widely used in underwriting, do not fully capture the scale, structure and complexity of a company's internet-facing technology estate. Digital footprint indicators had predictive value on their own, but delivered the strongest results when combined with traditional underwriting data.

Gallagher Re used its claims and firmographic data alongside KYND's external technographic observations. The research focused on observable features of an organisation's online footprint rather than internal questionnaire responses alone.

The approach could help insurers refine risk selection while reducing reliance on lengthy application forms for brokers and policyholders. The study also pointed to a possible role for this data in portfolio management.

Key indicators

The most predictive indicators included distinct ISP count, email provider diversity, externally exposed services and IP footprint. Distinct ISP count was the strongest contributor among the technographic factors assessed.

The analysis also found that organisations with more complex and distributed external digital footprints were more likely to experience cyber claims. That relationship appeared broadly consistent across revenue bands, suggesting digital footprint signals may offer insight beyond company size alone.

The findings come as cyber insurers seek more reliable ways to price risk and assess exposure in a market where loss patterns can be difficult to model. Revenue and sector remain standard reference points, but insurers are increasingly looking for additional external signals that can be observed without adding friction to the underwriting process.

Ed Pocock, Global Head of Cyber Security at Gallagher Re, said: "We've spent a lot of time in cyber asking whether the doors are locked, but much less time asking how big the building is. Security indicators matter, as do measures like revenue and industry, but they do not capture the size and complexity of an organisation's internet-facing footprint.

"This work with KYND suggests that understanding an organisation's digital footprint carries its own signal for claim frequency, beyond those established factors. We're only scratching the surface of what this data can tell us, but it gives us a useful, evidence-led starting point for understanding cyber exposure better."

The study compared a standalone model based only on technographic observations with a combined model integrating technographic and firmographic information. The blended approach delivered the strongest predictive performance.

That matters for insurers because cyber underwriting has often depended on a mix of disclosed company information and selected external security indicators. A broader view of an organisation's digital estate could give underwriters another way to distinguish between businesses that appear similar by revenue or sector but differ materially in their exposure.

Melanie Hayes, Co-founder at KYND, said: "For years, cyber underwriting has relied heavily on firmographic indicators. While these remain important, they do not always reflect the scale and complexity of an organisation's digital footprint.

"Understanding an organisation's external digital estate can provide a valuable additional lens on cyber exposure, as two companies with similar revenues may have vastly different internet-facing environments, creating very different risk profiles.

"As the cyber insurance market continues to mature, data-driven insights into digital footprint and complexity will become increasingly important in helping insurers make more informed underwriting decisions and improve risk selection."

KYND is a London-headquartered cyber risk analytics provider focused on the insurance market, while Gallagher Re is Gallagher's reinsurance broking arm. Their joint research adds to a broader industry effort to use external data sources to sharpen cyber risk assessment as insurers seek more consistent indicators of claims frequency.

The paper's central conclusion was that cyber risk cannot be measured by revenue alone, and that internet-facing complexity offers a meaningful additional signal when assessing the likelihood of future claims.