Whether you're underwriting cyber risk, managing your own vendor stack, or both — third-party security is the product. The Agency's combined-signal model gives underwriting and operations the same continuous, evidence-backed view across thousands of vendors.
Insurers do third-party risk twice, for two different purposes, and the distinction is worth keeping clear.
As regulated businesses, they carry the same obligations as other financial institutions: DORA applies to insurance and reinsurance undertakings in the EU, Solvency II treats outsourcing as an operational risk requiring governance and notification of critical functions, UK firms are subject to FCA and PRA operational resilience rules, Australian insurers to APRA CPS 230, and US insurers frequently to NYDFS Part 500 and the NAIC model law.
As underwriters of cyber risk, they assess third-party security as the product itself — pricing policies against an applicant's posture, managing accumulation where many insureds share a dependency, and monitoring exposure through the policy period rather than only at renewal. The 2024 CrowdStrike outage and the Change Healthcare breach both illustrated the same point: correlated loss across a book driven by a single shared supplier.
The two jobs want the same intelligence — continuous, evidence-backed, outside-in posture data across large numbers of organisations — which is why running them off one layer rather than two is usually the better structure.
Insurance organisations are doing third-party risk twice — once as a regulated business with a vendor stack, and once as the underwriter pricing other people's third-party risk. The same intelligence layer should serve both.
Three of The Agency's leads serve the dual mandate: continuous outside-in intelligence for the underwriting desk, regulator-formatted reporting for ops and compliance, and the evidence layer that makes both possible.
The 5M+ company data moat — for both sides of the business. REX powers continuous monitoring of your own vendors and outside-in intelligence for cyber underwriting. Same data, same signal, same continuous loop.
DORA, FCA, APRA — composed, not assembled. VANCE generates regulator-formatted reports from current evidence — Article 28 packs, FCA outsourcing reviews, APRA CPS 230 attestations — across the portfolio.
One evidence layer for vendor risk and claims. ARIA structures every piece of vendor evidence against the 157 Universal Controls — useful for vendor risk teams, useful for claims teams handling cyber incidents.
Insurance is the only industry where The Agency's combined-signal model serves the underwriting desk and the operational risk team from the same data.
ARIA's evidence reading + REX's external scanning — reconciled into one view. The "single source of truth" cyber underwriters have been promised, finally architected.
One evidence layer, multiple regulator-formatted outputs. The same data feeds the underwriting desk and the operational resilience report.
The DORA-driven question your board will ask — answered in real time, not assembled at quarter end.
Your insured book and your own vendor book monitored the same way, on the same cadence, against the same data.
We replaced two analysts' worth of questionnaire chasing with The Agency in eight weeks. The risk team is finally doing risk work.
Underwriting, accumulation, and the regulatory load on the business itself.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.