Insurance · External monitoring evidence

Most of an IRDAI cyber-security file is self-reported.

Policies, registers, control narratives, remediation logs: every one of them authored inside the organisation being examined. The external view is the part an insurer cannot write for itself: what its intermediaries are exposing, whose policyholder credentials are already circulating, and which domains are collecting quote data under its name. ShadowMap produces that record, dated, and hands it to whoever is assembling the file.

Request an exposure snapshot How this works across financial services

What this is

A dated, external record of the exposure attributable to your organisation and to the firms distributing on your behalf. Produced continuously, and exportable.

Where this stops

It is not an audit, an opinion, or a determination that any instrument binds your entity. Security Brigade does that work, under CERT-In empanelment, on its own site.

The supervisory cycle

What changes at each stage, and where self-reported evidence runs out

The same estate, seen at three points in a cycle. The gap between what you can assert and what you can evidence does not move — it only gets more expensive to close.

01 Between examinations

Nobody is asking yet, and that is when the record has to be accumulating

What your team is doing: Running the control programme: patching, access reviews, intermediary questionnaires, the independent audits your own policy and your advisers have put in the calendar. Almost all of it inside the perimeter you operate and can instruct.
Where self-reported evidence runs out: A questionnaire returned by a corporate agent describes what that agent believes about its own estate. Nothing in it is dated to a day anyone can point at afterwards.
What the external record contributes: Continuous observation of the properties carrying your name from outside. A record started in response to a question proves only that you responded.

02 Assembling the file

The submission gets written, and its external half has to come from somewhere

What your team is doing: Pulling policies, registers, test reports and remediation logs into one file, with a compliance owner reconciling them against the guidelines mapping your advisers produced for your licence class.
Where self-reported evidence runs out: Where an item concerns an intermediary, or an exposure sitting on the customer side, the honest answer is often that nobody looked.
What the external record contributes: An exportable record of what was observed, when, under what scope, and what was deliberately left out.

03 When someone follows up

The question is how far back you can see, and it is rarely in the file

What your team is doing: Answering on a specific finding, a specific date or a specific distribution partner, usually at a level of detail the submission was never built to anticipate.
Where self-reported evidence runs out: Point-in-time testing answers for the day it ran. A question about the months in between has no artefact behind it, and reconstructing one after the fact is both expensive and unconvincing.
What the external record contributes: The dated history, retrievable per asset and per identity, corrections included. Because the raw source material is retained, an exposure first extracted this month can be shown to have originated on a machine compromised long before.

What a finding is allowed to claim

Four states, and what each one lets you write down

A finding that overstates what was verified is worse than no finding at all, so the states are published exactly as the platform shows them.

Credential states, read as evidence
State	What it means	What the record supports
Confirmed Working	Probed and it authenticated. The account is reachable with this credential now.	Supports a statement that a live credential existed on a stated date. Rotate today, and check for session persistence.
Maybe Working	Probing was inconclusive: rate limiting, an MFA interstitial, or an ambiguous response.	Supports “not ruled out”, and nothing stronger. Treat as live until your own team has checked it.
Not Working	Probed and rejected. The credential is stale against this service.	Still evidences a compromised endpoint, which is the finding a stale password tends to conceal.
Not Tested	Outside authorised scope, or no safe probe exists. An intermediary’s own systems usually land here.	The record says exactly that.

Key

Verified live
Not ruled out
Stale: endpoint still exposed
Unverified by us

Where the exposure sits

What carries your name, and who actually runs it

Insurers carry a large customer-identity estate and a long intermediary chain, so credential exposure and third-party observation are the two capabilities that do the most work here.

External exposure an insurer is answerable for, by owner and by evidence source
What carries your name	Who actually runs it	Where the dated record sits
Policyholder and employee credentials in stealer logs and breach corpora	Nobody you can instruct. The machines are personal; the identities are your customers and your staff	Dark Web Monitoring
Every credential carries an explicit state. The corpus is 12B+ breach and credential records against ~41TB of retained source material.
Corporate agents, brokers, web aggregators and bancassurance partners	The intermediary, on its own infrastructure, under its own change control	Third-Party Risk Management
Partners are assessed with the same method used on your own estate, and they arrive observed but not tested: an insurer cannot grant permission over a broker’s own servers.
Look-alike domains, and quote or renewal pages collecting policyholder details	Whoever registered them: sometimes a fraud operation, sometimes an over-enthusiastic agent	Brand Protection
Separated from the partner and reseller properties that legitimately carry your name, because an agent’s microsite and a credential-harvesting page look identical to a keyword alert. Confirmed impersonation is raised for takedown, and takedowns are unlimited, subject to fair use.
Self-network platforms, partner portals and quote APIs reachable from outside	Your platform team, or a vendor’s, or a team that has been reorganised twice since it shipped	Attack Surface Management
Each asset is attributed back to your organisation with the evidence for the attribution recorded alongside it. That matters for a group whose name is shared across several licensed entities and a set of joint ventures, where a name match on its own would pull in infrastructure that is not yours.
What IRDAI, and the other authorities supervising the same group, have published	The authority. It changes without telling you	Regulatory Intelligence
What an authority publishes on information and cyber security, and on outsourced and intermediated distribution, is tracked as it changes. It will not tell you whether any of it binds your entity. That is a legal determination, and it stays with your compliance function and your advisers.

External exposure an insurer is answerable for, by owner and by evidence source

Policyholder and employee credentials in stealer logs and breach corpora

Who actually runs it: Nobody you can instruct. The machines are personal; the identities are your customers and your staff
Where the dated record sits: Dark Web Monitoring

Every credential carries an explicit state. The corpus is 12B+ breach and credential records against ~41TB of retained source material.

Corporate agents, brokers, web aggregators and bancassurance partners

Who actually runs it: The intermediary, on its own infrastructure, under its own change control
Where the dated record sits: Third-Party Risk Management

Partners are assessed with the same method used on your own estate, and they arrive observed but not tested: an insurer cannot grant permission over a broker’s own servers.

Look-alike domains, and quote or renewal pages collecting policyholder details

Who actually runs it: Whoever registered them: sometimes a fraud operation, sometimes an over-enthusiastic agent
Where the dated record sits: Brand Protection

Separated from the partner and reseller properties that legitimately carry your name, because an agent’s microsite and a credential-harvesting page look identical to a keyword alert. Confirmed impersonation is raised for takedown, and takedowns are unlimited, subject to fair use.

Self-network platforms, partner portals and quote APIs reachable from outside

Who actually runs it: Your platform team, or a vendor’s, or a team that has been reorganised twice since it shipped
Where the dated record sits: Attack Surface Management

Each asset is attributed back to your organisation with the evidence for the attribution recorded alongside it. That matters for a group whose name is shared across several licensed entities and a set of joint ventures, where a name match on its own would pull in infrastructure that is not yours.

What IRDAI, and the other authorities supervising the same group, have published

Who actually runs it: The authority. It changes without telling you
Where the dated record sits: Regulatory Intelligence

What an authority publishes on information and cyber security, and on outsourced and intermediated distribution, is tracked as it changes. It will not tell you whether any of it binds your entity. That is a legal determination, and it stays with your compliance function and your advisers.

The sequence

How the record gets made

Each step bounds what the next one is permitted to look at, so an exposure snapshot starts at the perimeter.

Perimeter

Establish what is actually yours

One apex domain is the starting point and almost never the whole answer. Subsidiaries, acquisitions, trading names and the platforms operating under your licence are discovered from outside and attributed back.
Attribution

Split the exposure by whose it turns out to be

Corporate, policyholder or partner. An insurer’s profile is dominated by the second and third, and running all three as one queue is how a customer-identity leak gets triaged as a helpdesk password reset.
Validation

Probe, where it is safe and authorised

Continuous Automated Red-Teaming tests what can be tested and moves confirmed credentials to a working state.
Record

Write it down with the scope that bounded it

Every probe carries its evidence, its timestamp, the scope profile that bounded it and an audit identifier, so activity against your estate reconciles against your own logs.
Handover

Into the hands of whoever writes the submission

Exports for the file, and routing into Slack, Jira, ServiceNow or your SIEM for the fix. The people assembling a regulatory record and the people remediating the finding are rarely the same people, and both need the same underlying evidence.

The boundary

The output is an input to a regulatory decision, not the decision

Nothing on this page tells you what IRDAI requires of your entity. That determination is legal, it turns on your licence class and how you distribute, and it belongs to your compliance function and your advisers. The assessment practice at Security Brigade is where that work is done.

What monitoring can do is answer the questions sitting underneath such a determination. What was reachable from outside on a given date. Whose it turned out to be once it was attributed. Whether an exposed credential still opened anything, or only looked as though it might. And what was already known before the incident that prompted somebody to ask.

An insurer’s supervisory surface is wider than any single authority, and the same record is put to work across the rest of it. See how it reads for financial services as a whole.

Sourcing and boundaries

How the record is built, and what it deliberately leaves out

How the external record is produced As of August 2026

Collection is outside-in. Nothing is installed, no agent runs, no credentials are taken, and nothing is touched that is not already reachable from the public internet.
Attribution is evidenced per asset.
Credential and breach material is matched against our own corpus, not a licensed feed, and the raw source archives are retained, so a finding improves when our extraction improves.
Validation runs where it is safe and authorised, and the exclusions and rate limits that bounded a run are part of the record.
Regulatory tracking covers what an authority publishes, read from its circulars, guidelines, regulations and enforcement material separately.

Deliberately excluded

Whether any instrument binds your entity. That is a legal determination, it turns on your licence class and your distribution model, and it belongs to your compliance function and your advisers.
Assessment, gap analysis, control testing and audit readiness. That is Security Brigade’s practice, CERT-In empanelled since 2008, and it runs on its own site.
Source names, channel topology and collection methods. Publishing them is how collection gets blocked.
Testing of intermediary systems. Partner estates are observed, never probed.

Questions insurers actually ask

Before you evaluate this

Does ShadowMap make us compliant with the IRDAI cyber-security guidelines?

No. Compliance is a determination about your entity, made against instruments your advisers map to your licence class and your distribution model. What we produce is one input to that determination: a dated external record of what was exposed, whose it turned out to be, and what was actually verified. Security Brigade runs the assessment and audit side of this work under CERT-In empanelment, and the two are kept deliberately separate.

Our intermediaries already return security questionnaires. What does this add?

A questionnaire is a description of an estate written by the party that owns it. This is an observation of the same estate from outside, refreshed continuously, and it does not depend on anybody returning a form. The two are complementary, and the interesting cases are the ones where the returned questionnaire and the observed estate disagree. That gap is usually the conversation worth having with the partner.

How is policyholder exposure different from employee credential exposure?

Scale, and remedy. Employee exposure is small enough to rotate and serious enough to act on immediately, and you control the accounts. Policyholder exposure is far larger, sits on machines you do not manage, and you cannot force a reset. What you can do is know it exists, correlate it to the products and channels it reaches, and read a cluster of it as a signal about a distribution partner rather than about your customers’ password hygiene.

Can we get a record covering the period before we started monitoring?

Partly, and the two halves behave differently. Credential and breach exposure is historical by its nature: a first scan reaches into material collected long before you were a customer, and each finding is dated to the compromise that produced it, not to the day we saw it. Continuous observation of your external estate begins when monitoring begins.

See what is visible from outside before someone asks you for it

One apex domain, two business days, a written snapshot of what is already reachable from outside: assets, exposed credentials, leaked code and domains wearing your brand. No call required.

Request an exposure snapshot See how intermediaries are monitored