When you bind a cyber insurance policy with At-Bay or Coalition, they do something the other carriers don't — they run an outside-in security scan of your business and give you a report on what they find. No extra cost, no installation required. Just your website URL.

It's called a cyber risk report, and most businesses have never seen one before.

What it actually scans

The scan looks at your digital footprint from the outside — the same perspective an attacker would have. It typically checks for:

• Exposed ports and services on your network
• Outdated software versions visible to the internet
• Email security configuration (SPF, DKIM, DMARC records)
• SSL certificate validity and configuration
• Dark web mentions of your domain or employee credentials
• Known vulnerabilities in your public-facing systems

The carrier needs only your domain name to run it. No agent installed on your systems, no access to internal infrastructure.

Why carriers do this

Insurance carriers that offer cyber risk reports aren't being altruistic. They're protecting themselves. A business with strong security controls is less likely to have a claim, which is better for the carrier's loss ratio. The report also gives them a baseline — if you have a breach and the carrier sees that a known vulnerability existed before you bound the policy, that affects the claim.

For you as the insured, this is actually useful information regardless of the carrier's motivation.

What to do with the report

When you receive your cyber risk report, share it with your IT team or IT vendor. The findings are typically prioritized by severity, and even fixing the high-priority items can meaningfully reduce your breach risk. Some carriers will also proactively alert you if new vulnerabilities appear after you've bound the policy — that's the proactive monitoring feature.

Is it worth choosing a carrier just for the report?

Not on its own. But as a tie-breaker between two otherwise similar options — yes. If At-Bay and another carrier are at similar price points and coverage breadth, the included cyber risk report is a genuine additional benefit. It's the kind of thing you'd pay a security firm hundreds of dollars to produce otherwise.