Cyber insurance, human risk, and the potential for cyber-ratings

The report is a thought piece exploring the idea of a personal “cyber-rating” that insurers and employers could use to quantify and manage human cybersecurity risk, analogous to credit scores. It discusses insurers’ push for real-time assurance of security controls (like active EDR response), the potential application of individual risk scores in hiring and underwriting, possible benefits in fraud prevention, and significant concerns around privacy, legality, monoculture risk, and the potential weaponization of such ratings by attackers.