Engineering Case Study: IAG Cybera360

"Cybersecurity is no longer just an IT problem — it's a business risk that demands an insurance-grade solution." — Krishna Nagashwaran, Venture Lead

Cybera360 (CA360) adalah platform online yang menggabungkan cyber insurance dan cyber assurance (keamanan siber) untuk melayani Small-Medium Enterprises (SME) di Asia Pasifik. Di-launch tahun 2019 melalui program inkubasi IAG Firemark, platform ini menjadi pioneer dalam pendekatan one-stop holistic cyber service.

Artikel ini membedah arsitektur teknis, tantangan engineering, dan solusi yang dibangun untuk menghadirkan platform yang mampu mengubah proses underwriting berminggu-minggu menjadi hitungan menit.

🏔️ 1. The Challenge

Lanskap Cyber Insurance Tradisional

Sebelum Cybera360, proses mendapatkan asuransi cyber untuk bisnis kecil-menengah sangat menyakitkan:

Tantangan Engineering

1. Risk Scoring Engine: Membangun modul yang mampu menghitung cyber risk score dari berbagai data point — postur keamanan, vulnerability scan, dan profil bisnis — untuk menentukan insurability dan rekomendasi premi.
2. Real-Time Visualization: Dashboard interaktif yang menampilkan risk assessment secara visual menggunakan D3.js — harus responsif dan mampu merender data kompleks secara real-time.
3. Third-Party Integration: Mengintegrasikan multiple API dari partner keamanan siber (UpGuard, Acronis, RHCS) ke dalam satu platform yang seamless.
4. Cross-Timezone Collaboration: Bekerja langsung dengan stakeholder di Australia dan Singapore — memerlukan adaptasi workflow, timezone management, dan dokumentasi berbahasa Inggris.
5. Insurance-Grade Security: Platform yang menangani data sensitif bisnis harus memenuhi standar keamanan enterprise-grade — encryption, access control, audit trail.

🏗️ 2. Architecture Overview

Platform Architecture

Cybera360 dirancang sebagai platform microservices-based yang mengintegrasikan berbagai layanan third-party ke dalam satu pengalaman pengguna yang seamless.

graph TD
    A[SME Customer / Broker] -->|Access| B[Cybera360 Web Platform]
    B -->|Risk Assessment| C[Risk Scoring Engine]
    B -->|Insurance Flow| D[Quoting & Underwriting Service]
    C -->|Vulnerability Scan| E[UpGuard API]
    C -->|Security Posture| F[Risk Data Aggregator]
    F -->|Score Calculation| G[Cyber Risk Score Module]
    G -->|Eligibility Check| D
    D -->|Policy Creation| H[ERGO Underwriting System]
    B -->|Value-Add Services| I[Acronis - Backup & Endpoint]
    B -->|Training Module| J[RHCS - Cyber Education]
    B -->|Dashboard| K[D3.js Risk Visualization]
    H -->|Distribution| L[Broker Network]

Data Flow: From Assessment to Quote

sequenceDiagram
    participant U as SME User
    participant P as Cybera360 Platform
    participant RS as Risk Scoring Engine
    participant UG as UpGuard API
    participant UW as ERGO Underwriting
    participant D as Dashboard

    U->>P: Start application (< 30 questions)
    P->>RS: Submit business profile
    RS->>UG: Request vulnerability scan
    UG-->>RS: Security posture data
    RS->>RS: Calculate cyber risk score
    RS-->>P: Risk assessment result
    P->>UW: Submit scored application
    UW-->>P: Quote & premium
    P->>D: Render risk visualization
    P-->>U: Quote ready (< 30 min)
    Note over U,P: vs. Traditional: 3-4 days

Key Architecture Decisions:

🛠️ 3. Technology Stack

📁 4. Project Structure

• cybera360-platform

  • frontend

    • pages

      • index.vue
      • assessment.vue
      • quote.vue
      • dashboard.vue
      • policy.vue
    • components

      • RiskScoreChart.vue
      • VulnerabilityHeatmap.vue
      • QuoteCalculator.vue
      • SecurityPosture.vue
    • composables

      • useRiskScore.ts
      • useAssessment.ts
  • backend

    • services

      • risk-scoring

        • main.go
        • calculator.go
        • models.go
      • quoting

        • main.go
        • underwriting.go
        • premium.go
      • api-gateway

        • server.js
        • middleware/
        • routes/
    • integrations

      • upguard_adapter.go
      • acronis_adapter.go
      • ergo_adapter.go
  • infra

    • docker-compose.yml
    • nginx.conf

🔍 5. Feature Deep Dives

Feature #1: Cyber Risk Scoring Engine

Problem: Underwriter tradisional membutuhkan waktu 3-4 hari untuk mengevaluasi risiko cyber sebuah bisnis secara manual. Mereka harus memeriksa infrastruktur IT, policy keamanan, incident history, dan compliance — seringkali melalui formulir 100+ pertanyaan yang membosankan.

Solution: Risk scoring engine yang secara otomatis mengagregasi data dari multiple sources dan menghasilkan skor risiko numerik yang actionable.

graph TD
    A[Business Profile Data] --> D[Risk Data Aggregator]
    B[UpGuard Vulnerability Scan] --> D
    C[Questionnaire Responses] --> D
    D --> E[Risk Scoring Engine]
    E --> F{Score Classification}
    F -->|Score >= 80| G[Low Risk - Standard Premium]
    F -->|Score 50-79| H[Medium Risk - Adjusted Premium]
    F -->|Score 30-49| I[High Risk - Premium Surcharge]
    F -->|Score < 30| J[Uninsurable - Remediation Required]
    G --> K[Auto-Quote Generation]
    H --> K
    I --> L[Manual Underwriter Review]
    J --> M[Remediation Recommendations]

    style G fill:#d1fae5,stroke:#10b981,color:#000
    style H fill:#fef3c7,stroke:#f59e0b,color:#000
    style I fill:#fed7aa,stroke:#f97316,color:#000
    style J fill:#fee2e2,stroke:#ef4444,color:#000

// Cyber Risk Scoring Engine
type RiskScore struct {
    Overall          float64            `json:"overall_score"`
    Categories       map[string]float64 `json:"category_scores"`
    Vulnerabilities  int                `json:"vulnerability_count"`
    RiskLevel        string             `json:"risk_level"`
    Insurable        bool               `json:"insurable"`
    Recommendations  []string           `json:"recommendations"`
}

type RiskInput struct {
    BusinessProfile  BusinessProfile    `json:"business_profile"`
    VulnerabilityScan VulnerabilityData `json:"vulnerability_scan"`
    Questionnaire    []QuestionAnswer   `json:"questionnaire"`
}

func (s *ScoringService) CalculateRiskScore(ctx context.Context, input RiskInput) (*RiskScore, error) {
    // 1. Score each category independently
    categories := map[string]float64{
        "network_security":   s.scoreNetworkSecurity(input.VulnerabilityScan),
        "data_protection":    s.scoreDataProtection(input.Questionnaire),
        "access_control":     s.scoreAccessControl(input.Questionnaire),
        "incident_response":  s.scoreIncidentResponse(input.Questionnaire),
        "business_continuity": s.scoreBusinessContinuity(input.Questionnaire),
        "compliance":         s.scoreCompliance(input.BusinessProfile),
    }

    // 2. Weighted average — network security and data protection weighted higher
    weights := map[string]float64{
        "network_security":   0.25,
        "data_protection":    0.25,
        "access_control":     0.15,
        "incident_response":  0.15,
        "business_continuity": 0.10,
        "compliance":         0.10,
    }

    var overallScore float64
    for category, score := range categories {
        overallScore += score * weights[category]
    }

    // 3. Determine risk level and insurability
    riskLevel, insurable := classifyRisk(overallScore)

    return &RiskScore{
        Overall:         overallScore,
        Categories:      categories,
        Vulnerabilities: input.VulnerabilityScan.TotalFindings,
        RiskLevel:       riskLevel,
        Insurable:       insurable,
        Recommendations: generateRecommendations(categories),
    }, nil
}

func classifyRisk(score float64) (string, bool) {
    switch {
    case score >= 80:
        return "LOW", true
    case score >= 50:
        return "MEDIUM", true
    case score >= 30:
        return "HIGH", true
    default:
        return "CRITICAL", false // Remediation required before insurable
    }
}

Results:

Feature #2: Interactive Risk Visualization Dashboard

Problem: Risk assessment data mentah tidak berarti bagi pemilik bisnis SME. Mereka membutuhkan representasi visual yang intuitif untuk memahami postur keamanan mereka dan area yang perlu diperbaiki.

Solution: Dashboard interaktif menggunakan D3.js yang merender risk score secara visual — radar chart untuk kategori risiko, heatmap untuk vulnerability, dan trend chart untuk monitoring berkelanjutan.

graph LR
    A[Risk Score API] --> B[Data Transform Layer]
    B --> C[D3.js Rendering Engine]
    C --> D[Radar Chart - Risk Categories]
    C --> E[Heatmap - Vulnerability Severity]
    C --> F[Gauge - Overall Score]
    C --> G[Timeline - Risk Trend]
    D --> H[Interactive Dashboard]
    E --> H
    F --> H
    G --> H
    H --> I[Export PDF Report]
    H --> J[Share with Broker]

// D3.js Radar Chart for Risk Category Visualization
interface RiskCategory {
  category: string;
  score: number;
  maxScore: number;
  label: string;
}

function renderRadarChart(
  container: string,
  data: RiskCategory[],
  options: ChartOptions,
): void {
  const svg = d3
    .select(container)
    .append("svg")
    .attr("width", options.width)
    .attr("height", options.height);

  const radius = Math.min(options.width, options.height) / 2 - options.margin;
  const angleSlice = (Math.PI * 2) / data.length;

  // Draw concentric circles (score levels)
  const levels = [20, 40, 60, 80, 100];
  levels.forEach((level) => {
    svg
      .append("circle")
      .attr("r", (radius * level) / 100)
      .attr("class", `level-${level}`)
      .style("fill", "none")
      .style("stroke", getRiskColor(level));
  });

  // Draw radar area
  const radarLine = d3
    .lineRadial<RiskCategory>()
    .radius((d) => (radius * d.score) / 100)
    .angle((_, i) => i * angleSlice)
    .curve(d3.curveLinearClosed);

  svg
    .append("path")
    .datum(data)
    .attr("d", radarLine)
    .style("fill", getOverallColor(data))
    .style("fill-opacity", 0.3)
    .style("stroke", getOverallColor(data))
    .style("stroke-width", 2);

  // Interactive tooltips on hover
  data.forEach((d, i) => {
    const x = radius * (d.score / 100) * Math.cos(angleSlice * i - Math.PI / 2);
    const y = radius * (d.score / 100) * Math.sin(angleSlice * i - Math.PI / 2);

    svg
      .append("circle")
      .attr("cx", x)
      .attr("cy", y)
      .attr("r", 6)
      .on("mouseover", () => showTooltip(d))
      .on("mouseout", hideTooltip);
  });
}

Results:

Feature #3: Streamlined Insurance Quoting Flow

Problem: Proses quoting asuransi cyber tradisional memerlukan formulir 100+ pertanyaan, review manual oleh underwriter, dan bolak-balik via email — total 3-4 hari kerja. Banyak SME menyerah di tengah proses.

Solution: Smart questionnaire yang mengurangi pertanyaan dari 100+ menjadi < 30 dengan teknik adaptive branching — pertanyaan berbeda berdasarkan jawaban sebelumnya.

graph TD
    A[Start Assessment] --> B{Business Type?}
    B -->|Tech/SaaS| C[Tech-Specific Questions - 12 Qs]
    B -->|Retail/F&B| D[Retail-Specific Questions - 8 Qs]
    B -->|Professional Services| E[Services Questions - 10 Qs]
    C --> F{Annual Revenue?}
    D --> F
    E --> F
    F -->|< SGD 1M| G[Basic Coverage Flow - 5 Qs]
    F -->|SGD 1M-10M| H[Standard Coverage Flow - 8 Qs]
    F -->|> SGD 10M| I[Enterprise Flow - 12 Qs]
    G --> J[Auto Risk Scoring]
    H --> J
    I --> J
    J --> K[Quote Generation < 30 min]

// Adaptive Questionnaire Engine
interface Question {
  id: string;
  text: string;
  type: "select" | "text" | "number" | "boolean";
  options?: string[];
  dependencies?: {
    questionId: string;
    condition: "equals" | "gt" | "lt" | "includes";
    value: any;
    action: "show" | "skip";
  }[];
  weight: number; // Impact on risk score
}

function getNextQuestions(
  allQuestions: Question[],
  answers: Record<string, any>,
): Question[] {
  return allQuestions.filter((q) => {
    if (!q.dependencies) return true;

    return q.dependencies.every((dep) => {
      const answer = answers[dep.questionId];
      if (answer === undefined) return dep.action === "skip";

      switch (dep.condition) {
        case "equals":
          return dep.action === "show"
            ? answer === dep.value
            : answer !== dep.value;
        case "gt":
          return dep.action === "show"
            ? answer > dep.value
            : answer <= dep.value;
        case "includes":
          return dep.action === "show"
            ? dep.value.includes(answer)
            : !dep.value.includes(answer);
        default:
          return true;
      }
    });
  });
}

Results:

Feature #4: Integrated Cyber Assurance Ecosystem

Problem: Asuransi cyber tradisional bersifat reactive — hanya membayar klaim setelah serangan terjadi. Tidak ada insentif atau alat untuk mencegah insiden sejak awal.

Solution: Platform one-stop yang menggabungkan insurance dengan layanan keamanan proaktif — vulnerability scanning, backup, dan edukasi — menciptakan ekosistem yang mengurangi risiko sebelum klaim terjadi.

graph TD
    A[Cybera360 Platform] --> B[Cyber Insurance]
    A --> C[Cyber Assurance]
    B --> D[Policy Management]
    B --> E[Claims Processing]
    B --> F[Premium Calculation]
    C --> G[UpGuard - Vulnerability Monitoring]
    C --> H[Acronis - Backup & Endpoint]
    C --> I[RHCS - Education & Training]
    G -->|Continuous Scan| J[Risk Score Update]
    J -->|Improved Score| K[Premium Discount Opportunity]
    J -->|Degraded Score| L[Alert + Remediation Guide]
    H -->|Incident| M[Faster Recovery = Lower Claim]
    I -->|Trained Staff| N[Fewer Human-Error Incidents]

🚢 6. Implementation & Collaboration

🤝 7. Key Partners & Ecosystem

Platform Cybera360 tidak berdiri sendiri — ia adalah pusat dari ekosistem partner yang saling memperkuat:

🚀 8. Business Impact

Implementasi Cybera360 membuktikan bahwa cyber insurance bisa di-deliver secara digital, cepat, dan terintegrasi:

Broader IAG Impact

Pembelajaran dari Cybera360 kemudian mempengaruhi strategi cyber insurance IAG secara global:

• Cylo (Australia): IAG meluncurkan "Cylo backed by CGU" — dedicated cyber insurance underwriting agency untuk SME Australia. Model yang serupa dengan pendekatan Cybera360.
• Firemark Ventures Fund II: IAG meluncurkan fund kedua senilai AU$75 juta (total AU$150 juta), dengan cyber risk sebagai salah satu tema investasi utama.
• UpGuard Growth: IAG terus meningkatkan investasi di UpGuard, yang kemudian menutup Series B-1 funding round senilai US$19 juta.

🎓 9. Lessons Learned

🎉 Conclusion

Cybera360 membuktikan bahwa asuransi cyber tidak harus rumit dan lambat. Dengan pendekatan technology-first, proses yang sebelumnya membutuhkan berminggu-minggu bisa dipadatkan menjadi hitungan menit — sambil memberikan value yang lebih dari sekadar polis asuransi.

Yang membuat project ini istimewa bukan hanya skala kliennya (IAG — perusahaan asuransi terbesar Australia), tapi filosofi di balik produknya: jangan hanya bayar klaim setelah serangan, bantu cegah serangan sejak awal. Itu adalah pergeseran paradigma dari reactive ke proactive insurance.