Engineering Case Study: IAG Cybera360

"Cybersecurity is no longer just an IT problem — it's a business risk that demands an insurance-grade solution." — Krishna Nagashwaran, Venture Lead

Cybera360 (CA360) is an online platform that combines cyber insurance and cyber assurance (cybersecurity services) to serve Small-Medium Enterprises (SMEs) across Asia Pacific. Launched in 2019 through IAG's Firemark incubation program, the platform pioneered the one-stop holistic cyber service approach.

This article dissects the technical architecture, engineering challenges, and solutions built to transform a weeks-long underwriting process into minutes.

🏔️ 1. The Challenge

The Traditional Cyber Insurance Landscape

Before Cybera360, obtaining cyber insurance for small-medium businesses was painful:

Engineering Challenges

1. Risk Scoring Engine: Building a module that calculates a cyber risk score from multiple data points — security posture, vulnerability scan results, and business profile — to determine insurability and premium recommendations.
2. Real-Time Visualization: Interactive dashboard displaying risk assessment visually using D3.js — must be responsive and capable of rendering complex data in real-time.
3. Third-Party Integration: Integrating multiple APIs from cybersecurity partners (UpGuard, Acronis, RHCS) into one seamless platform.
4. Cross-Timezone Collaboration: Working directly with stakeholders in Australia and Singapore — requiring workflow adaptation, timezone management, and English-first documentation.
5. Insurance-Grade Security: A platform handling sensitive business data must meet enterprise-grade security standards — encryption, access control, audit trail.

🏗️ 2. Architecture Overview

Platform Architecture

Cybera360 was designed as a microservices-based platform integrating various third-party services into one seamless user experience.

graph TD
    A[SME Customer / Broker] -->|Access| B[Cybera360 Web Platform]
    B -->|Risk Assessment| C[Risk Scoring Engine]
    B -->|Insurance Flow| D[Quoting & Underwriting Service]
    C -->|Vulnerability Scan| E[UpGuard API]
    C -->|Security Posture| F[Risk Data Aggregator]
    F -->|Score Calculation| G[Cyber Risk Score Module]
    G -->|Eligibility Check| D
    D -->|Policy Creation| H[ERGO Underwriting System]
    B -->|Value-Add Services| I[Acronis - Backup & Endpoint]
    B -->|Training Module| J[RHCS - Cyber Education]
    B -->|Dashboard| K[D3.js Risk Visualization]
    H -->|Distribution| L[Broker Network]

Data Flow: From Assessment to Quote

sequenceDiagram
    participant U as SME User
    participant P as Cybera360 Platform
    participant RS as Risk Scoring Engine
    participant UG as UpGuard API
    participant UW as ERGO Underwriting
    participant D as Dashboard

    U->>P: Start application (< 30 questions)
    P->>RS: Submit business profile
    RS->>UG: Request vulnerability scan
    UG-->>RS: Security posture data
    RS->>RS: Calculate cyber risk score
    RS-->>P: Risk assessment result
    P->>UW: Submit scored application
    UW-->>P: Quote & premium
    P->>D: Render risk visualization
    P-->>U: Quote ready (< 30 min)
    Note over U,P: vs. Traditional: 3-4 days

Key Architecture Decisions:

🛠️ 3. Technology Stack

📁 4. Project Structure

• cybera360-platform

  • frontend

    • pages

      • index.vue
      • assessment.vue
      • quote.vue
      • dashboard.vue
      • policy.vue
    • components

      • RiskScoreChart.vue
      • VulnerabilityHeatmap.vue
      • QuoteCalculator.vue
      • SecurityPosture.vue
    • composables

      • useRiskScore.ts
      • useAssessment.ts
  • backend

    • services

      • risk-scoring

        • main.go
        • calculator.go
        • models.go
      • quoting

        • main.go
        • underwriting.go
        • premium.go
      • api-gateway

        • server.js
        • middleware/
        • routes/
    • integrations

      • upguard_adapter.go
      • acronis_adapter.go
      • ergo_adapter.go
  • infra

    • docker-compose.yml
    • nginx.conf

🔍 5. Feature Deep Dives

Feature #1: Cyber Risk Scoring Engine

Problem: Traditional underwriters needed 3-4 days to manually evaluate a business's cyber risk. They had to inspect IT infrastructure, security policies, incident history, and compliance — often through tedious 100+ question forms.

Solution: A risk scoring engine that automatically aggregates data from multiple sources and produces an actionable numerical risk score.

graph TD
    A[Business Profile Data] --> D[Risk Data Aggregator]
    B[UpGuard Vulnerability Scan] --> D
    C[Questionnaire Responses] --> D
    D --> E[Risk Scoring Engine]
    E --> F{Score Classification}
    F -->|Score >= 80| G[Low Risk - Standard Premium]
    F -->|Score 50-79| H[Medium Risk - Adjusted Premium]
    F -->|Score 30-49| I[High Risk - Premium Surcharge]
    F -->|Score < 30| J[Uninsurable - Remediation Required]
    G --> K[Auto-Quote Generation]
    H --> K
    I --> L[Manual Underwriter Review]
    J --> M[Remediation Recommendations]

    style G fill:#d1fae5,stroke:#10b981,color:#000
    style H fill:#fef3c7,stroke:#f59e0b,color:#000
    style I fill:#fed7aa,stroke:#f97316,color:#000
    style J fill:#fee2e2,stroke:#ef4444,color:#000

// Cyber Risk Scoring Engine
type RiskScore struct {
    Overall          float64            `json:"overall_score"`
    Categories       map[string]float64 `json:"category_scores"`
    Vulnerabilities  int                `json:"vulnerability_count"`
    RiskLevel        string             `json:"risk_level"`
    Insurable        bool               `json:"insurable"`
    Recommendations  []string           `json:"recommendations"`
}

type RiskInput struct {
    BusinessProfile  BusinessProfile    `json:"business_profile"`
    VulnerabilityScan VulnerabilityData `json:"vulnerability_scan"`
    Questionnaire    []QuestionAnswer   `json:"questionnaire"`
}

func (s *ScoringService) CalculateRiskScore(ctx context.Context, input RiskInput) (*RiskScore, error) {
    // 1. Score each category independently
    categories := map[string]float64{
        "network_security":   s.scoreNetworkSecurity(input.VulnerabilityScan),
        "data_protection":    s.scoreDataProtection(input.Questionnaire),
        "access_control":     s.scoreAccessControl(input.Questionnaire),
        "incident_response":  s.scoreIncidentResponse(input.Questionnaire),
        "business_continuity": s.scoreBusinessContinuity(input.Questionnaire),
        "compliance":         s.scoreCompliance(input.BusinessProfile),
    }

    // 2. Weighted average — network security and data protection weighted higher
    weights := map[string]float64{
        "network_security":   0.25,
        "data_protection":    0.25,
        "access_control":     0.15,
        "incident_response":  0.15,
        "business_continuity": 0.10,
        "compliance":         0.10,
    }

    var overallScore float64
    for category, score := range categories {
        overallScore += score * weights[category]
    }

    // 3. Determine risk level and insurability
    riskLevel, insurable := classifyRisk(overallScore)

    return &RiskScore{
        Overall:         overallScore,
        Categories:      categories,
        Vulnerabilities: input.VulnerabilityScan.TotalFindings,
        RiskLevel:       riskLevel,
        Insurable:       insurable,
        Recommendations: generateRecommendations(categories),
    }, nil
}

func classifyRisk(score float64) (string, bool) {
    switch {
    case score >= 80:
        return "LOW", true
    case score >= 50:
        return "MEDIUM", true
    case score >= 30:
        return "HIGH", true
    default:
        return "CRITICAL", false // Remediation required before insurable
    }
}

Results:

Feature #2: Interactive Risk Visualization Dashboard

Problem: Raw risk assessment data is meaningless to SME business owners. They need intuitive visual representations to understand their security posture and areas that need improvement.

Solution: Interactive dashboard using D3.js that renders risk scores visually — radar charts for risk categories, heatmaps for vulnerabilities, and trend charts for continuous monitoring.

graph LR
    A[Risk Score API] --> B[Data Transform Layer]
    B --> C[D3.js Rendering Engine]
    C --> D[Radar Chart - Risk Categories]
    C --> E[Heatmap - Vulnerability Severity]
    C --> F[Gauge - Overall Score]
    C --> G[Timeline - Risk Trend]
    D --> H[Interactive Dashboard]
    E --> H
    F --> H
    G --> H
    H --> I[Export PDF Report]
    H --> J[Share with Broker]

// D3.js Radar Chart for Risk Category Visualization
interface RiskCategory {
  category: string;
  score: number;
  maxScore: number;
  label: string;
}

function renderRadarChart(
  container: string,
  data: RiskCategory[],
  options: ChartOptions,
): void {
  const svg = d3
    .select(container)
    .append("svg")
    .attr("width", options.width)
    .attr("height", options.height);

  const radius = Math.min(options.width, options.height) / 2 - options.margin;
  const angleSlice = (Math.PI * 2) / data.length;

  // Draw concentric circles (score levels)
  const levels = [20, 40, 60, 80, 100];
  levels.forEach((level) => {
    svg
      .append("circle")
      .attr("r", (radius * level) / 100)
      .attr("class", `level-${level}`)
      .style("fill", "none")
      .style("stroke", getRiskColor(level));
  });

  // Draw radar area
  const radarLine = d3
    .lineRadial<RiskCategory>()
    .radius((d) => (radius * d.score) / 100)
    .angle((_, i) => i * angleSlice)
    .curve(d3.curveLinearClosed);

  svg
    .append("path")
    .datum(data)
    .attr("d", radarLine)
    .style("fill", getOverallColor(data))
    .style("fill-opacity", 0.3)
    .style("stroke", getOverallColor(data))
    .style("stroke-width", 2);

  // Interactive tooltips on hover
  data.forEach((d, i) => {
    const x = radius * (d.score / 100) * Math.cos(angleSlice * i - Math.PI / 2);
    const y = radius * (d.score / 100) * Math.sin(angleSlice * i - Math.PI / 2);

    svg
      .append("circle")
      .attr("cx", x)
      .attr("cy", y)
      .attr("r", 6)
      .on("mouseover", () => showTooltip(d))
      .on("mouseout", hideTooltip);
  });
}

Results:

Feature #3: Streamlined Insurance Quoting Flow

Problem: The traditional cyber insurance quoting process required 100+ question forms, manual underwriter review, and back-and-forth via email — totaling 3-4 business days. Many SMEs gave up midway through the process.

Solution: Smart questionnaire reducing questions from 100+ to < 30 using adaptive branching — different questions based on previous answers.

graph TD
    A[Start Assessment] --> B{Business Type?}
    B -->|Tech/SaaS| C[Tech-Specific Questions - 12 Qs]
    B -->|Retail/F&B| D[Retail-Specific Questions - 8 Qs]
    B -->|Professional Services| E[Services Questions - 10 Qs]
    C --> F{Annual Revenue?}
    D --> F
    E --> F
    F -->|< SGD 1M| G[Basic Coverage Flow - 5 Qs]
    F -->|SGD 1M-10M| H[Standard Coverage Flow - 8 Qs]
    F -->|> SGD 10M| I[Enterprise Flow - 12 Qs]
    G --> J[Auto Risk Scoring]
    H --> J
    I --> J
    J --> K[Quote Generation < 30 min]

// Adaptive Questionnaire Engine
interface Question {
  id: string;
  text: string;
  type: "select" | "text" | "number" | "boolean";
  options?: string[];
  dependencies?: {
    questionId: string;
    condition: "equals" | "gt" | "lt" | "includes";
    value: any;
    action: "show" | "skip";
  }[];
  weight: number; // Impact on risk score
}

function getNextQuestions(
  allQuestions: Question[],
  answers: Record<string, any>,
): Question[] {
  return allQuestions.filter((q) => {
    if (!q.dependencies) return true;

    return q.dependencies.every((dep) => {
      const answer = answers[dep.questionId];
      if (answer === undefined) return dep.action === "skip";

      switch (dep.condition) {
        case "equals":
          return dep.action === "show"
            ? answer === dep.value
            : answer !== dep.value;
        case "gt":
          return dep.action === "show"
            ? answer > dep.value
            : answer <= dep.value;
        case "includes":
          return dep.action === "show"
            ? dep.value.includes(answer)
            : !dep.value.includes(answer);
        default:
          return true;
      }
    });
  });
}

Results:

Feature #4: Integrated Cyber Assurance Ecosystem

Problem: Traditional cyber insurance is reactive — it only pays claims after an attack occurs. There's no incentive or tool to prevent incidents in the first place.

Solution: A one-stop platform combining insurance with proactive security services — vulnerability scanning, backup, and education — creating an ecosystem that reduces risk before claims happen.

graph TD
    A[Cybera360 Platform] --> B[Cyber Insurance]
    A --> C[Cyber Assurance]
    B --> D[Policy Management]
    B --> E[Claims Processing]
    B --> F[Premium Calculation]
    C --> G[UpGuard - Vulnerability Monitoring]
    C --> H[Acronis - Backup & Endpoint]
    C --> I[RHCS - Education & Training]
    G -->|Continuous Scan| J[Risk Score Update]
    J -->|Improved Score| K[Premium Discount Opportunity]
    J -->|Degraded Score| L[Alert + Remediation Guide]
    H -->|Incident| M[Faster Recovery = Lower Claim]
    I -->|Trained Staff| N[Fewer Human-Error Incidents]

🚢 6. Implementation & Collaboration

🤝 7. Key Partners & Ecosystem

The Cybera360 platform doesn't stand alone — it's the center of a mutually reinforcing partner ecosystem:

🚀 8. Business Impact

The implementation of Cybera360 proved that cyber insurance can be delivered digitally, fast, and integrated:

Broader IAG Impact

Learnings from Cybera360 subsequently influenced IAG's global cyber insurance strategy:

• Cylo (Australia): IAG launched "Cylo backed by CGU" — a dedicated cyber insurance underwriting agency for Australian SMEs. A similar model to the Cybera360 approach.
• Firemark Ventures Fund II: IAG launched a second fund worth AU$75 million (total AU$150 million), with cyber risk as one of the key investment themes.
• UpGuard Growth: IAG continued increasing its investment in UpGuard, which later closed a Series B-1 funding round worth US$19 million.

🎓 9. Lessons Learned

🎉 Conclusion

Cybera360 proved that cyber insurance doesn't have to be complex and slow. With a technology-first approach, a process that previously took weeks was compressed into minutes — while delivering more value than just an insurance policy.

What makes this project special isn't just the scale of the client (IAG — Australia's largest insurer), but the philosophy behind the product: don't just pay claims after an attack, help prevent attacks from the start. That's a paradigm shift from reactive to proactive insurance.