The claim is verifiable.The insurer sees no logs.
A cyber incident can be proven and its scope measured without the insurer ever receiving the underlying records.
Insurance runs on trust.
Lenders check the history. Motor insurers check the driving.Cyber insurance still checks the form.
Both sides pay for that gap.
74%
of US cyber insurance claims closed in 2024 ended without a payment.
8 of 9
UK underwriters interviewed use the applicant's self-reported form.
CA$18.3M
in recovery costs for one city. Its insurer denied the claim over MFA it had not fully deployed.
Who pays for the gap
Insurer pays
- To verify, not to protect: a forensic investigation decides whether it is liable at all.
- For what it cannot see: an incident is easy to stage, and the evidence cannot show who made it.
- In court: one insurer funded a $4.125M settlement, then sued to take it back.
Policyholder pays
- Up front: the investigation that proves the claim can be required, and paid for, before the claim is filed.
- At the worst moment: a control ticked on the form and found missing after the loss can void the policy from the start.
Why the usual fixes fall short
Records that a control was bought, not that it works.
Sees the perimeter, not the controls inside it.
Moves the question to the claim instead of checking it.
Answers after the loss, once it is a dispute.
Needs the very records the company insured.
How a claim is settled on evidence
The same move, without the data changing hands.Five steps. Each one can be inspected.
What the platform does
Underwriting on live controls
Underwriting from the controls that are actually running, not from a form. The insurer sees the result, not the data.
Controls on record
Proof that MFA, EDR and backups were in place, recorded continuously from the day of connection.
Claims verification
Insurers receive a result backed by cryptographic proof rather than by an account of what happened.
Underwriting from what is already running
Watch Guardian connects to the policyholder's existing security systems and assesses exposure in place.
The incident is recorded where it happens
When an incident occurs, it is captured from the signals the policyholder's security systems already produce.
How far it reached, from the same evidence
The signals that establish the incident also measure its scope: the systems, records and hours it touched.
A proof instead of a submission
A signed, verifiable proof is produced that the incident occurred and how far it reached.
Checked, not believed
The insurer verifies the proof. Acceptance rests on a mathematical result rather than on a judgement about the policyholder's account.
Pilot: 30 days, every incident verified
30 days from connection. Every incident in that time.You set the pass criteria. No fee.
- One policy, its policyholder, your pass criteria.
- The proof, a written result, an integration map.
- One client and the insurer that covers it.
- The insurer's result, and a case for other insurers.
- Your broker or insurer, and read-only access for 30 days.
- An incident proven without your logs reaching the insurer.
30 days
A pilot runs on one of your policyholder's environments and ends with your decision on a proof.
A pilot runs on one of your client's environments and ends with its insurer's decision on a proof.
A pilot runs on one of your environments and ends with your insurer's decision on a proof.
Scope
One policyholder, every incident in 30 days. Owner, criteria, NDA and DPA signed first.
Deploy
Your policyholder's team connects Watch Guardian to its identity, EDR and backup systems, read-only.
Prove
Every incident in the 30 days, or a controlled test, becomes a proof of what happened.
Decide
Your team checks the proof against the criteria, on its own verifier set up with us.
Scope
You bring one client and its insurer. The insurer sets the criteria; NDA and DPA are signed first.
Deploy
Your client's team connects Watch Guardian to its identity, EDR and backup systems, read-only.
Prove
Every incident in the 30 days, or a controlled test, becomes a proof of what happened.
Decide
The insurer verifies the proof against its criteria. The result is your case for other insurers.
Scope
Your broker or insurer agrees the criteria with us. NDA and DPA are signed first.
Deploy
Your team connects Watch Guardian to your identity, EDR and backup systems, read-only.
Prove
Every incident in the 30 days, or a controlled test, becomes a proof of what happened.
Decide
Your insurer verifies the proof against the criteria. Your logs never reach it.
What the pilot proves
Records are signed when collected
History is fixed before an incident, so it cannot be rewritten after.
Tampering breaks the proof
A forged, deleted or inserted event fails verification.
The insurer gets only the proof
Logs, tickets and forensic reports never reach the insurer.
No fee. Four things agreed up front.
- Owner
- Someone at the insurer who owns the pilot and can approve the next step.
- Criteria
- What counts as a pass, in writing, before day 1.
- If it passes
- The next step is agreed before day 1, so a good result does not stall.
- Reference
- Anonymised by default; your name only if you agree.
All four are agreed on one scoping call, before anything is connected.
Book a scoping callNo fee. Four things agreed up front.
- Client
- One client willing to connect Watch Guardian for 30 days.
- Insurer
- The insurer that covers it, with an owner who can approve the next step.
- Criteria
- What counts as a pass, agreed by the insurer in writing before day 1.
- Reference
- Anonymised by default; your name only if you agree.
All four are agreed on one scoping call, before anything is connected.
Book a scoping callNo fee, now or later
- Access
- Read-only access to one environment's security systems, for 30 days.
- DPA
- Signed before anything is connected.
- Data
- What we collect is encrypted. The insurer gets only the proof.
- Owner
- Your broker or insurer owns the pilot and agrees the criteria.
Tell us who your broker or insurer is, and we take it from there.
Name your broker or insurerContact
If you underwrite cyber risk, or you are insured against it, we would like to hear how claims work for you today.
Frequently asked questions
What is Protectorium?
Infrastructure for cyber insurance claims. It records security evidence from the policyholder's own systems before anything happens, and turns an incident into a proof the insurer can verify without receiving the underlying records.
How do you prevent fraud?
A claim is accepted only with a proof that verifies, and the history behind it is fixed before the incident, so it cannot be rewritten after the fact. No system can rule out an incident staged on a live network by someone with full control; ours makes it costlier and visible, and every proof states what it covers.
How is confidentiality maintained?
Access to the policyholder's systems is read-only, and what Protectorium collects is kept encrypted. The insurer receives the proof, never the records, so it never has custody of them.
Is this an AI judgement?
No. Verification is a check, not an opinion. It either passes or it does not, and the result does not depend on who is reading it.
Is there a blockchain or a token?
No. The proofs rest on signatures and an append-only log, not on a ledger, and there is no token.
How long does verification take?
Verification is an automatic check rather than an investigation, so it does not wait on scheduling, correspondence, or a forensic report.