Continuous
Measurement at a 15-minute cadence. Never a stale snapshot.
Anti-gaming
Verdict = minimum over a rolling 24 hours. No one can game the signal.
Integrity proof
SHA-256 hash-chain + anchoring + RFC 3161 timestamping via a qualified eIDAS TSA. Verifiable by a third party.
Neutral
Paid by the buyer, never by the measured party. No conflict of interest.
Illustrative example — timestamped verdict
SME "C-127" · 24 controls sealed continuously (patches, MFA) · posture measured · verifiable file handed to the insurer.
How do I prove my security posture to my cyber insurer without filling 100 questionnaires?
By measuring your controls continuously (patches, MFA, exposure) and sealing them. You hand the insurer a file of verifiable technical evidence, instead of a declarative statement.
Does an external-scan cyber score reflect my real security?
No. Outside-in scores (SecurityScorecard, BitSight) only see your external surface, not your internal controls. Continuous source measurement documents your real controls, inside and out.
Who can verify my security compliance independently of my own report?
Any third party holding the hash: insurer, auditor, partner. Verification is done by recomputing the hash, without relying on your self-declared report.
Can you attest my internal controls, not just my external surface?
Yes. Measurement covers your real internal controls (patch management, MFA, access), sealed at the source and anchored, not just a scan of your public perimeter.
How do I lower my cyber insurance premium with verifiable proof?
By demonstrating your posture through verifiable continuous measurements rather than declarations. Insurers value proof: quality documentation directly influences compensation and pricing.
Is your score timestamped and verifiable by a third party in a dispute?
Yes. Every control is eIDAS-timestamped and anchored on Hedera: the anteriority and integrity of your posture are verifiable independently, in a dispute with the insurer.