Revenue tells a cyber underwriter how big a company is. A new Gallagher Re study suggests it says considerably less about how exposed that company is.
The paper, produced jointly with KYND, a commercial cyber risk analytics provider, draws on a benchmark portfolio of more than 63,000 insurance policies. It asks whether digital footprint data can predict cyber claim frequency beyond traditional underwriting factors. Its answer: it can, and the signal it provides is largely independent of company size.
Cyber underwriting has long rested on firmographic data, such as revenue, industry sector and country. Those inputs remain valid, but they do not capture the scale or structure of a company's internet-facing environment.
Two businesses at the same revenue level can have vastly different digital footprints. The study finds that footprint, not revenue, correlates more directly with claim likelihood.
The analysis combined Gallagher Re's claims and firmographic data with KYND's external technographic observations. An insurance-optimised machine learning model isolated which technographic attributes carry additive predictive value over and above traditional factors.
Distinct ISP count emerged as the strongest single contributor. Organisations with more internet service providers have a more distributed external digital presence, which the study links to greater exposure. Email provider diversity, externally exposed services, and IP footprint followed.
The pattern held consistently across different revenue bands. That consistency indicates the signal is not simply a proxy for company size. The study also confirmed little correlation between revenue and IP footprint across the benchmark portfolio.
"We've spent a lot of time in cyber asking whether the doors are locked, but we've spent much less time asking how big the building is," said Ed Pocock, global head of cyber security at Gallagher Re. He added that the research suggests understanding an organisation's digital footprint carries its own signal for claim frequency, beyond established firmographic factors.
On technographic data alone, the highest-risk 20% of the benchmark were 2.1 times more likely to suffer a claim than the portfolio average.
When technographic and firmographic data are combined, the separation widens. The highest-risk 20% were six times more likely to experience a claim than the lowest-risk 20%. The study notes the benchmark portfolio should be treated as an additional input to underwriting judgement rather than a standalone predictor.
The paper extends a prior Gallagher Re study from October 2024, conducted with Bitsight across 62,000 organisations. That work identified IP footprint size as a claims predictor. It also found that focusing on the highest-risk 20% of a portfolio could potentially reduce loss ratios by up to 16.4%.
The study notes that a more distributed internet-facing estate creates more points of exposure. It also raises the operational difficulty of maintaining consistent controls across the environment. The study suggests that where primary insurers price and select on firmographic factors alone, reinsurers accepting those cessions may carry the same information gap.
The study positions digital footprint data as one input alongside existing underwriting judgement. Gallagher Re notes it can be applied without lengthy questionnaires, which matters for high-volume SMB books where submission friction is a constraint.
"Two companies with similar revenues may have vastly different internet-facing environments, creating very different risk profiles," said Melanie Hayes, co-founder of KYND.
At the January 2026 renewal, cyber aggregate excess of loss rates fell 32% on a risk-adjusted basis, according to Gallagher Re data. In a softening market, risk selection increasingly determines portfolio performance. Digital footprint data offers one more externally verifiable signal to support that selection.
