Establish the evidence baseline
Connect approved sources and turn security observations, documents, and declarations into attributable Evidence Records.
SAGEN Cyber Readiness
Know what is exposed. Prove what is protected.
SAGEN Cyber Readiness connects verified security evidence to the business systems that matter, prioritizes remediation, and prepares customer-controlled evidence for cyber-insurance underwriting.
Available to customers. Request a demonstration and discuss onboarding for your organization.
Readiness OverviewLive evidence
82
Readiness Score
91%
Evidence Confidence
7Open Remediation Items
3 daysEvidence Freshness
From a business-critical system to an evidence-backed fix.
Follow a fictional customer-billing system through the workflow. Open each step to see the evidence, decision, and responsible party.
Illustration, not a live demo. All systems and findings below are fictional. This example illustrates the workflow using fictional data, not a customer result.
1. Identify the system and exposure
Example: A billing server is associated with an internet-facing administration service. The business owner declares billing critical. Technical exposure and declared business context remain separately labeled.
2. Explain the business impact and confidence
Review which billing workflow, identities, and dependencies could be affected. Check source reliability, freshness, integrity, coverage, and consistency before relying on the finding. Missing evidence remains unknown, not proof of safety.
3. Define the action; the customer implements it
SAGEN explains the required outcome and evidence needed: review whether public access is necessary and document an approved access restriction. The customer or its IT provider assesses the change, obtains approval, implements it, and retains rollback responsibility. SAGEN does not perform the remediation.
4. Verify the result with fresh evidence
The workflow checks a new observation against the original finding. If the service remains exposed, the finding stays open. A completed task alone is not a verified fix; risk acceptance is recorded separately.
5. Approve a point-in-time evidence package
The insured selects the recipient, purpose, and evidence scope before release. A frozen package preserves the approved state and timestamp; it does not grant a carrier live access to the environment.
See what an actionable finding should explain.
Fictional example - not a customer report. This is an illustrative report format for SAGEN Cyber Readiness, not a generated product output or a compliance assessment.
Finding: publicly reachable billing administration
Business context: The fictional billing owner identifies invoicing as a critical workflow. Unauthorized administrative access could disrupt invoicing or expose billing data. Reachability alone does not establish a breach.
Suggested priority: High, subject to customer validation of access controls, dependencies, and business impact. No financial loss estimate is implied.
Evidence and confidence: what is known and missing
An illustrative external observation reports a reachable administration endpoint. Internal access policy, authentication controls, and asset ownership have not yet been corroborated. Confidence is limited until those gaps are resolved; missing evidence is not treated as a passed control.
Recommended outcome and implementation owner
SAGEN: Explain the exposure, clarify the intended access boundary, prioritize the action, and specify evidence needed for verification.
Customer or its IT provider: Validate the finding, approve and test an appropriate access restriction, implement the change, and maintain recovery access and a rollback plan. The exact configuration depends on the customer environment.
Evidence required to verify the fix
Provide a dated change record, relevant access-policy evidence, and a fresh authorized observation showing that unintended public access is no longer available while approved access still works. Do not include passwords, tokens, or unnecessary personal data.
Example status: Open - awaiting customer implementation and verification evidence. A completed task does not, by itself, justify a Verified Fix status.
Controlled sharing and point-in-time context
A frozen package records the approved finding, evidence scope, remaining uncertainties, and snapshot timestamp. The insured approves the recipient and purpose. Later changes require a new review; the snapshot is not continuous assurance.
01 / One evidence spine
One trusted record, rendered for every stakeholder.
Evidence is normalized once and used to derive readiness, system exposure, remediation, questionnaire, and coverage views. The insured, its delegated advisor, broker, and carrier do not receive competing versions of the same security fact.
- Continuous evidence replaces a once-a-year screenshot scramble
- Every material figure traces back to the evidence that produced it
- Confidence and freshness travel with the score
- Frozen packages preserve exactly what was released and when
02 / Business-critical systems
Translate technical exposure into business impact.
A CVE on a server is only the beginning of the story. SAGEN is designed to show which business system depends on that asset, how critical the system is, which identities, data, integrations, and controls surround it, and why the exposure deserves attention.
- Map hosts and software to declared business systems
- Distinguish verified, declared, stale, and conflicting context
- Connect findings to controls and underwriting answers
- Explain impact through a human-readable propagation trail
A questionnaire answer is useful - but it is not equal to verified technical evidence.
Every item in the evidence portfolio carries its own confidence profile, so the difference between a self-reported answer and a validated technical control is always visible.
- Source reliability
Whether the fact came from a technical observation, a document, or a declaration.
- Freshness
How recently the evidence was captured or last confirmed still accurate.
- Coverage
How much of the relevant environment or control the evidence actually speaks to.
- Consistency
Whether the evidence agrees with other related findings and records.
- Integrity
Whether provenance and integrity data support the evidence record.
04 / Evidence-backed remediation
Move from an exposure to a verified fix.
SAGEN identifies the exposure, prioritizes the action, and explains what needs to change. The customer or its IT provider performs the remediation; the product workflow verifies closure with new evidence. A task cannot become “verified fixed” merely because someone marked it complete.
- Pre-fill affected systems and supporting evidence
- Assign owners, approvers, deadlines, and justification
- Reopen work if an exposure returns in later evidence
- Never take autonomous remediation action
05 / Insured-controlled disclosure
The insured decides what to share, with whom, and for which insurance submission.
SAGEN Cyber Readiness is designed to give the insured a continuous evidence portfolio it controls, and a deliberate approval step before evidence is shared for underwriting.
- The insured approves every submission before it is shared
- Sharing is time-bound and purpose-specific, not standing access
- Brokers and carriers review a frozen view, not the raw environment
- Access can be revoked at any time
From security evidence to underwriting confidence.
Map what matters
Connect assets and surrounding context to the critical business systems the organization identifies.
Customer-led fix, evidence-backed verification
SAGEN clarifies the required action. The customer or its IT provider implements it, and new evidence is required before a finding is treated as fixed.
Freeze and release
The insured previews and approves the exact evidence view released to a broker or carrier.
One evidence portfolio, a view for every role.
Know and prove
See what matters, act on exposures, and control what leaves the organization.
Prepare clearer submissions
Coordinate requests and review a consistent package approved by the insured.
Review structured evidence
Read a consented, time-stamped package without live access to the customer environment.
Prioritize across clients
Work evidence and remediation for delegated tenants while preserving customer authority.
Cyber-insurance readiness, evidence, and control.
What is cyber-insurance readiness?
Cyber-insurance readiness is the ongoing ability to understand relevant security controls, identify material gaps, support questionnaire answers with current evidence, and prepare an accurate underwriting submission.
How is verified evidence different from an attestation?
An attestation records what a person declares. Verified evidence records what an approved technical source observed. SAGEN is designed to retain the source, scope, freshness, integrity, coverage, and consistency context so reviewers can distinguish between them.
Does a carrier receive live access to the customer environment?
No. The product model gives the insured continuous visibility while brokers and carriers receive only a customer-approved, time-stamped package. The package does not create unrestricted live access.
Does SAGEN take autonomous remediation action?
No. SAGEN provides prioritized guidance, not hands-on remediation. Implementation remains the responsibility of the customer or its IT provider. The workflow uses updated evidence to verify the result.
Organize evidence around the requirements in scope.
The evidence model supports readiness work in the areas below. These are engagement scoping areas, not a guarantee that every requirement or integration is included. A requested standard is a scoping choice; the applicability of a law requires a qualified review of the organization, activity, data, and jurisdiction.
Selected for the engagement
Structure scope, controls, owners, evidence, gaps, and remediation around an approved readiness objective.
- ISO/IEC 27001:2022 readiness
- SOC 2 readiness
- NIST Cybersecurity Framework alignment
Routed after applicability review
Collect evidence for privacy obligations only after the relevant role, data, geography, thresholds, and exemptions have been reviewed.
- CCPA, as amended by the CPRA
- EU General Data Protection Regulation (GDPR)
- Additional jurisdiction-specific modules as approved
Scoped to applicable systems
Support evidence organization for systems and controls relevant to internal control over financial reporting when SOX or a contractual dependency is confirmed.
- Sarbanes-Oxley Section 404 support
- IT general control evidence
- Service-organization dependencies
Scope and availability matter. The product is available to customers. Confirm the control mappings and capabilities relevant to your scope during a demonstration; advisory engagement scope is agreed separately. Readiness work does not determine legal applicability, issue ISO certification, constitute a SOC 2 examination, provide legal advice, or guarantee an insurance or compliance outcome.
See how your security evidence can support underwriting.
Discuss the evidence model for an insured organization, broker, carrier, MSSP, or security advisor.