We gather any relevant information that can be found without logging into or performing any type of exploit on a client’s systems. The scan looks at obvious aspects, such as the company’s public-facing website, as well as less obvious ones, such as vulnerabilities in bits of software embedded in a company’s web applications, or unused domains owned by the company. Corvus does not require access to servers, and does not require a password. We see the same information a malicious actor would if they are poking around “trying car doors”. The Corvus Scan assesses a company’s cyber security hygiene and insurance risk by analyzing its public web infrastructure, combined with internet-wide vulnerability and threat research.
Then we provide to you in a concise summary in your quote, and a full report once you’ve purchased a policy. Some of the details in this report will be of a low priority, presented as purely informational, while others may be immediately critical to a client’s cyber security. All of the information represents clues as to where the “bad guys” might see vulnerabilities and find a way into those systems. For the most critical vulnerabilities we find, we send an email alert to your broker (your broker can also sign you up to receive these directly).