Digital Exposure Quantification Engine Built on Real-World Data.
Nine Years of AI. Not Nine Months.
The Thrivaca™ Engine has been built, trained, and validated since 2016 in collaboration with US Strategic Command, MITRE, the University of Chicago, the Society of Actuaries, NIST, and Anthropic.
AI operates at every stage of the risk quantification pipeline —
not as a single model, but as a collection of purpose-built components, each trained for a specific function.
The result: the only actuarial AI engine for digital exposure with NIST-approved methodology, patent-granted technology, and measured outcomes validated against real-world losses.
Explore Cyber Exposure →
Explore AI Exposure →
Explore Cyber Insurance Application →
AI Since
2016
32 Authoritative
Data Sources
47,000+ Threat-Vulnerability Pairings
.png?width=73&height=73&name=Scatter%20Plot%20(2).png)
r = .668 Breach
Correlation
Patent Granted
NIST-Approved
Within 7% of UHC Actual Losses
.png?width=656&height=656&name=AN%20AI%20Data%20Engine%20Stage%201%20(1).png)
What it does:
-
Ingests and classifies data from every available source — the depth of ingestion scales with the deployment model.
-
At minimum: historical loss data, breach pattern records, and external attack surface intelligence.
-
With client access (CORE and UNIFY deployments): audit reports, risk registers, penetration testing results, security documentation, SME attestation, SIEM and vulnerability management feeds via direct API connection (Qualys, Wiz, CrowdStrike, Armis, ServiceNow, Fortinet, and others), SBOM/ RBOM/ AIBOM data from the software and AI supply chain, and full asset inventory including IoT and ICS systems.
How AI operates:
-
Machine learning classifies and tags incoming data to the appropriate risk type and organizational profile regardless of source format.
-
Supervised classification trained on years of categorized incident data routes each record correctly despite significant source heterogeneity — SEC filings, FBI Internet Crime data, SIEM event streams, vulnerability scanner outputs, and audit documentation all look different but must produce consistently structured outputs for downstream modeling.
-
The more data sources connected, the richer the risk model — Thrivaca UNIFY, for example, sits on top of the organization’s entire security stack and normalizes every signal into one actuarial-grade schema.
What it does:
-
Normalizes raw data to enterprise value per-billion denominators and applies industry adjustment factors.
How AI operates:
-
Statistical AI models normalize across all six-digit NAICS codes, ensuring comparability regardless of organization size or industry.
-
Anomaly detection models flag data quality issues or outliers that require review before downstream modeling.
What it does:
-
Maps control findings to specific NIST 800-53 sub-controls and MITRE ATT&CK techniques. In external-scan deployments, findings come from attack surface analysis.
-
In full-access deployments (CORE with client data, UNIFY on the security stack), findings come from direct evidence: API feeds from vulnerability scanners, SIEM event patterns, audit reports, penetration test results, asset inventory data, and SBOM/RBOM component vulnerabilities — providing dramatically richer control status evidence.
How AI operates:
-
This is the patent-pending, NIST-approved methodology. AI traverses ~47,000 threat-vulnerability pairings to identify which specific controls are relevant to each detected signal — whether that signal originates from an external scan, an internal vulnerability management platform, a SIEM correlation rule, or a supply chain component analysis.
-
Logical constraints enforce real-world attack chains — a firewall vulnerability does not relate to insider threat because the insider is already inside the firewall. These constraints were developed in direct collaboration with NIST and MITRE.
-
Maps findings across two taxonomies simultaneously: FFIEC (23 high-level threat categories) and MITRE ATT&CK (~1,200 techniques).
What it does:
-
Calculates potential financial impact across eight risk types: hacktivism, denial of service, ransomware, digital fraud, insider threat, data breach, IP theft, and business interruption.
How AI operates:
-
AI-assisted formula selection executes economic formulas developed with the University of Chicago, managing parameter selection based on organizational profile inputs.
-
Produces Near Worst Case Scenario (NWCS) values calibrated at 85% of worst-case loss — realistic yet conservative, as determined by leading economists.
.png?width=656&height=656&name=AN%20AI%20Data%20Engine%20Stage%205%20(2).png)
What it does:
-
Ingests and classifies data from every available source — the depth of ingestion scales with the deployment model.
-
At minimum: historical loss data, breach pattern records, and external attack surface intelligence.
-
With client access (CORE and UNIFY deployments): audit reports, risk registers, penetration testing results, security documentation, SME attestation, SIEM and vulnerability management feeds via direct API connection (Qualys, Wiz, CrowdStrike, Armis, ServiceNow, Fortinet, and others), SBOM/ RBOM/ AIBOM data from the software and AI supply chain, and full asset inventory including IoT and ICS systems.
How AI operates:
-
Machine learning classifies and tags incoming data to the appropriate risk type and organizational profile regardless of source format.
-
Supervised classification trained on years of categorized incident data routes each record correctly despite significant source heterogeneity — SEC filings, FBI Internet Crime data, SIEM event streams, vulnerability scanner outputs, and audit documentation all look different but must produce consistently structured outputs for downstream modeling.
-
The more data sources connected, the richer the risk model — Thrivaca UNIFY, for example, sits on top of the organization’s entire security stack and normalizes every signal into one actuarial-grade schema.
What it does:
-
Normalizes raw data to enterprise value per-billion denominators and applies industry adjustment factors.
How AI operates:
-
Statistical AI models normalize across all six-digit NAICS codes, ensuring comparability regardless of organization size or industry.
-
Anomaly detection models flag data quality issues or outliers that require review before downstream modeling.
What it does:
-
Maps control findings to specific NIST 800-53 sub-controls and MITRE ATT&CK techniques. In external-scan deployments, findings come from attack surface analysis.
-
In full-access deployments (CORE with client data, UNIFY on the security stack), findings come from direct evidence: API feeds from vulnerability scanners, SIEM event patterns, audit reports, penetration test results, asset inventory data, and SBOM/RBOM component vulnerabilities — providing dramatically richer control status evidence.
How AI operates:
-
This is the patent-pending, NIST-approved methodology. AI traverses ~47,000 threat-vulnerability pairings to identify which specific controls are relevant to each detected signal — whether that signal originates from an external scan, an internal vulnerability management platform, a SIEM correlation rule, or a supply chain component analysis.
-
Logical constraints enforce real-world attack chains — a firewall vulnerability does not relate to insider threat because the insider is already inside the firewall. These constraints were developed in direct collaboration with NIST and MITRE.
-
Maps findings across two taxonomies simultaneously: FFIEC (23 high-level threat categories) and MITRE ATT&CK (~1,200 techniques).
Built on Real-World Data, Not Synthetic Assumptions.
The Thrivaca AI architecture was not built by a single team working from publicly available data.
It was co-developed with institutions that control unique, non-public data and possess specialized expertise that no single organization could replicate.
.png?width=1031&height=412&name=How%20Thrivaca%20Was%20Built%20(2).png)