The claim is verifiable.The insurer sees no logs.
A cyber incident can be proven and its loss quantified without the insurer ever receiving the underlying records.
Insurance runs on trust.
Lenders check the history. Motor insurers check the driving.Cyber insurance still checks the form.
Both sides pay for that gap.
74%
of US cyber insurance claims closed in 2024 ended without a payment.
8 of 9
underwriters interviewed price the risk from the applicant's own form.
CA$18.3M
in recovery costs for one city whose claim was denied over MFA it had not fully deployed.
Who pays for the gap
Insurer pays
- To verify, not to protect: a forensic investigation decides whether it is liable at all.
- For what it cannot see: an incident is easy to stage, and the evidence cannot show who made it.
- In court: one insurer funded a $4.125M settlement, then sued to take it back.
Policyholder pays
- Up front: the investigation that proves the claim can be required, and paid for, before the claim is filed.
- At the worst moment: a control ticked on the form and found missing after the loss can void the policy from the start.
Why the usual fixes fall short
Records that a control was bought, not that it works.
Sees the perimeter, not the controls inside it.
Moves the question to the claim instead of checking it.
Answers after the loss, once it is a dispute.
Needs the very records the company insured.
How a claim is settled on evidence
The same move, without the data changing hands.Five steps. Each one can be inspected.
What the platform does
Real-time underwriting
Underwriting built into your stack. The insurer sees the result, not the data.
Security dashboard
Visual risk assessment drawn from the security systems you already run, updated as things change.
Incidents detection
Real-time incident signals from the security systems you already run.
pub fn verify_claim_proof( pvk: &PreparedVerifyingKey<Bls12_381>, proof: &Proof<Bls12_381>, public_inputs: &[Fr],) -> bool {Claims verification
Insurers receive a result backed by cryptographic proof rather than by an account of what happened.
Settlement handoff
The output is a verified claim with a quantified loss, handed to the insurer's existing settlement process.
Underwriting from what is already running
Watch Guardian connects to the policyholder's existing security systems and assesses exposure in place.
The incident is recorded where it happens
When an incident occurs, it is captured in real time from the signals the policyholder's security systems already produce.
What it cost, from the same evidence
The signals that establish the incident are also used to quantify the loss it caused.
A proof instead of a submission
The policyholder generates a signed, verifiable proof that the incident occurred and what it cost.
Checked, not believed
The insurer verifies the proof. Acceptance rests on a mathematical result rather than on a judgement about the policyholder's account.
Pilot: one claim, verified end to end
30 days from install. One policyholder, one incident.You set the pass criteria. No fee.
- One policy, its policyholder, your pass criteria.
- The proof, a written result, an integration map.
- One client and the insurer that covers it.
- The insurer's result, and a case for other insurers.
- Your broker or insurer, and room for Watch Guardian for 30 days.
- An incident proven without your logs reaching the insurer.
30 days
A pilot runs on one of your policyholder's environments and ends with your decision on a proof.
A pilot runs on one of your client's environments and ends with its insurer's decision on a proof.
A pilot runs on one of your environments and ends with your insurer's decision on a proof.
Scope
One policyholder, one claim path. Owner, criteria, NDA and DPA signed first.
Deploy
Your policyholder's team installs Watch Guardian beside its SIEM, SOAR, EDR or WAF.
Prove
A controlled test, or a replay of past logs, becomes a proof of the incident and its cost.
Decide
Your team checks the proof against the criteria, on its own verifier set up with us.
Scope
You bring one client and its insurer. The insurer sets the criteria; NDA and DPA are signed first.
Deploy
Your client's team installs Watch Guardian beside its SIEM, SOAR, EDR or WAF.
Prove
A controlled test, or a replay of past logs, becomes a proof of the incident and its cost.
Decide
The insurer verifies the proof against its criteria. The result is your case for other insurers.
Scope
Your broker or insurer agrees the criteria with us. NDA and DPA are signed first.
Deploy
Your team installs Watch Guardian beside your SIEM, SOAR, EDR or WAF.
Prove
A controlled test, or a replay of past logs, becomes a proof of the incident and its cost.
Decide
Your insurer verifies the proof against the criteria. Your logs never reach it.
What the pilot proves
Events are signed at the source
Watch Guardian signs every event it reads.
Tampering breaks the proof
A forged, deleted or inserted event fails verification.
The insurer gets only the proof
Logs, tickets and forensic reports never reach the insurer.
No fee. Four things agreed up front.
- Owner
- Someone at the insurer who owns the pilot and can approve the next step.
- Criteria
- What counts as a pass, in writing, before day 1.
- If it passes
- The next step is agreed before day 1, so a good result does not stall.
- Reference
- Anonymised by default; your name only if you agree.
All four are agreed on one scoping call, before anything is installed.
Book a scoping callNo fee. Four things agreed up front.
- Client
- One client willing to run Watch Guardian for 30 days.
- Insurer
- The insurer that covers it, with an owner who can approve the next step.
- Criteria
- What counts as a pass, agreed by the insurer in writing before day 1.
- Reference
- Anonymised by default; your name only if you agree.
All four are agreed on one scoping call, before anything is installed.
Book a scoping callNo fee, now or later
- Access
- Room for Watch Guardian beside one environment, for 30 days.
- DPA
- Signed before anything is installed.
- Data
- Signed logs reach Protectorium, which keeps none. The insurer gets only the proof.
- Owner
- Your broker or insurer owns the pilot and agrees the criteria.
Tell us who your broker or insurer is, and we take it from there.
Name your broker or insurerContact
If you underwrite cyber risk, or you are insured against it, we would like to hear how claims work for you today.
Frequently asked questions
What is Protectorium?
Infrastructure for cyber insurance claims. It records an incident inside the policyholder's environment, quantifies the loss, and produces a proof the insurer can verify without receiving the underlying evidence.
What is a zero-knowledge proof, and why use one?
A zero-knowledge proof establishes that a statement is true without revealing the information the statement is about. In a claim, it lets a policyholder demonstrate that an incident occurred and what it cost while the records that show it never reach the insurer.
How do you prevent fraud?
A claim is only accepted if it comes with a proof that verifies. There is no path that accepts a claim on description alone.
How is confidentiality maintained?
Watch Guardian signs security events where they happen and sends them to Protectorium, which builds the proof and keeps no logs. The insurer receives the proof and the assessed amount, never the records, so it never has custody of them.
Is this an AI judgement?
No. Verification is a check, not an opinion. It either passes or it does not, and the result does not depend on who is reading it.
How long does verification take?
Verification is an automatic check rather than an investigation, so it does not wait on scheduling, correspondence, or a forensic report.