Searchlight Cyber Buys Intangic to Help Quantify Cyber Risk

Searchlight Cyber purchased a European cyber risk management startup to bolster its cyber insurance underwriting capabilities with predictive modeling.

The Portsmouth, U.K.-based firm said Luxembourg-based Intangic’s strength in predictive cyber risk quantification for the third-party risk and insurance sectors complements Searchlight’s focus on dark web intelligence and attack surface management.

“As we’ve grown and developed the business, we’ve gone from dark web Intelligence to extended attack surface management,” Searchlight CEO Ben Jones told Information Security Media Group. “What Ryan has been doing with Intangic fits in very well. It brings in additional information around quantifying and pricing the risk, which is really useful and interesting to customers across the board, not just within insurance.”

Intangic dates to 2018, employs four people, and hasn’t disclosed any significant outside funding. The company has been led since inception by Dodd, who previously spent six years as CEO of Ergo Investment Partners (see: Searchlight Cyber Bolsters Threat Intel With Assetnote Buy).

Quantifying Cyber Risk in a Way Businesses Can Understand

To hear Dodd tell it, a merger was nearly inevitable. Customer demand for more specific threat visibility and supply chain vulnerability data has grown. Intangic needed a partner that could provide the kind of dark web visibility that Searchlight already specialized in.

Dodd said Intangic brings financial modeling capabilities that allow enterprises to predict breach risk, quantify potential loss, and make data-driven insurance decisions. Integrating with Searchlight will allow technical alerts and risk reports to be translated into boardroom-ready dashboards for CFOs and chief risk officers.

“Early next year, we’ll be looking to add some additional features to what we’ve got in Intangic to align more with what we have in DarkIQ and Assetnote,” Jones said. “We’ll bring in additional data sources which will give even higher resolution, and we will bring in more ASM elements into the data, as well as the other dark web stuff. All of those things will become much closely integrated.”

Dodd sees Intangic as a financial modeling firm that helps insurers and enterprises predict cyber loss much like actuarial firms do in other lines of insurance. The company’s predictive analytics ranks vulnerabilities by urgency, which Dodd said is particularly relevant for organizations deciding whether to invest in additional cybersecurity tools or transfer risk through insurance.

“Security teams are overworked, so if you can provide prioritized actions backed by data, it’s pretty powerful,” Dodd said. “We’re not just saying, ‘Here’s your posture.’ We’re saying, ‘Based on what we’re seeing, here’s the risk, here’s the ranking, and here’s how to act.'”

Scaling Intangic’s Models to Monitor Third-Party Vendors

Dodd said Intangic’s strength lies in its ability to assess a supplier’s risk using data science models and predictive analytics, flagging those most likely to cause operational disruptions. Becoming part of Searchlight will let teams to present this data credibly, backed by verifiable threat signals from the dark web and attack surface intelligence, according to Dodd.

“If a CISO calls a supplier’s CISO, that conversation doesn’t go well,” Dodd said. “But if the risk officer calls with a report and says, ‘Here’s our concern backed by data,’ now you’re having a conversation between people managing money. That’s the point – provide proof and assurance to drive real actions that prevent business interruption, which is a financial risk, not just a cyber one.”

Searchlight plans to scale Intangic’s models and dashboards to support mass monitoring of third-party vendors, which Jones said will require significant engineering investment to scan tens of thousands of vendors with meaningful accuracy and low signal-to-noise ratios. Additional dashboard functionality will be developed to support non-technical audiences and help risk officers take proactive action, he said.

“We’ll bring in additional data sources which will give even higher resolution, and we will bring in more ASM elements into the data, as well as the other dark web stuff,” Jones said. “And so as we go into next year, all of those things will become much closer integrated. There is some engineering effort there to be able to then scale that and use that on a full third-party risk platform.”

Intangic historically focused on commercial insurance providers and large self-insured entities, but is now seeing demand from large enterprises with complex supply chains that want to quantify the risk of disruption. Dodd said a client detected increased dark web activity targeting a key supplier, and used Intangic to produce a report that the finance team used to engage the vendor and demand mitigation.

“We’re seeing more questions from boards and CFOs like, ‘How much insurance should we buy? What’s the right deductible?'” Dodd said. “We help answer that. If a CISO gets a Saturday morning email from the CFO asking that, then we’re the right partner. We help connect those dots between technical exposure and financial liability.”