Why Brokers Are Building Their Own Technology Panels

Cyber insurers have discovered that their sharpest distribution weapon in 2026 is not price or capacity — it is prevention technology. Scan tools, dark web monitoring, phishing simulations: bundled free with the policy, they open doors that premium quotes alone no longer open. For underwriters, prevention services promise lower claims frequency and better risk selection. For carrier sales teams, they provide a reason to be present in the client conversation long before a renewal discussion begins. Two of the most visible players driving this shift are Stoïk and Baobab Risk Solutions, and their technology is genuinely good. That is precisely why a growing number of brokers are now declining carrier-tied tooling and assembling technology panels of their own. The analysis below sets out what each carrier has built, why the offer to brokers is so effective, and where the structural conflicts of interest sit.

The carriers’ prevention tech is genuinely impressive

Start with Stoïk Protect. The platform combines external and internal scanning, phishing simulation, and ongoing employee training, with the external scan “launched automatically every week to detect security vulnerabilities.” Stoïk reports that this external scanning identifies 20,000 vulnerabilities yearly, and that 70% of critical vulnerabilities are remediated thanks to proactive alerts — backed by a 24-hour team reaction time and a 24/7 Stoïk-CERT. For a typical small or mid-sized client with no internal security operations team, that weekly cadence matters: exposure windows that would otherwise stay open for months get flagged within days, and the remediation push comes from the insurer rather than from an overstretched IT generalist. In effect, the policy ships with a lightweight managed detection and remediation service attached, at a price point an SMB would rarely buy standalone.

Baobab Risk Solutions is running a parallel playbook with its in-house Deep Scan and Dark Web Monitoring, which continuously analyze publicly exposed IT infrastructure and the dark web for compromised credentials. Baobab claims its Deep Scan identifies 98% of all digital risks, scans 6x more data than traditional providers, and resolves vulnerabilities 20x faster than the market average. Those are vendor figures, but the direction of travel is consistent with what independent exposure scanning has demonstrated across the market: most SMBs have significantly more internet-facing surface than their IT providers believe.

In March 2026, Baobab escalated: a Berlin press release dated March 03, 2026 announced that Dark Web Monitoring would be integrated into its Cybersafe and E-Crime policies across Germany, Austria, and the Benelux countries as a free preventive measure. The technical design is smart, too — a credential-to-infrastructure correlation that triggers an alarm only when both a stolen “key” and a live “lock” (a VPN, firewall, or OWA endpoint) are active. That is a false-positive filter most standalone monitoring vendors have not cracked, and it addresses the single biggest reason monitoring programs fail in smaller businesses: alert fatigue. A client who receives two actionable alerts a quarter will act on both; a client who receives forty will act on neither.

The underlying threat model is real. A Baobab blog post from 17.02.2026 notes that “around 90% of all attacks use stolen identities, and 54% of ransomware victims already have data leaks on the dark web before the incident occurs.” Dark Web Monitoring is now available at no extra cost to existing Cyber Safe and Crime customers, with results surfaced as a “Leaks Report” — including a Leak Summary, a Risk Assessment (High/Medium/Good), a 24-month Leak Timeline, and a Detailed Leak Table — inside the “Documents” tab of the broker portal. Note where that report lives and who it is written for: it is formatted so a broker can walk into a client meeting and present it directly. The distribution channel is the audience, which is the first clue about what this technology is really for.

The pitch to brokers is compelling

Both carriers aim their tooling squarely at the distribution channel. On its French broker landing page, Stoïk cites a figure that deserves every brokerage principal’s attention: “76% des dirigeants d’entreprise attendent de leur courtier en assurance un accompagnement face au risque cyber” — 76% of business leaders expect their insurance broker to guide them on cyber risk. Stoïk’s answer is a broker platform with 100% online subscription, continuous 24/7 prevention, A-to-Z in-house claims management, instant quote generation, and portfolio performance tracking — plus a free scan report for clients “avant même qu’ils soient assurés,” before they’re even insured.

Baobab mirrors this: pre-bind scans that accelerate risk assessment and quote creation, and a portal serving more than 1,000 Makler.

The commercial logic is straightforward. A free pre-bind scan lowers the cost of the first client meeting, gives the broker something concrete to present, and shortens the sales cycle from weeks to days. For the carrier, it converts marketing spend into qualified, pre-assessed leads that arrive with scan data attached. It is a formidable door-opener. It is also, looked at coldly, a lead-generation funnel — and the leads flow in one direction only.

The catch: every scan funnels somewhere

Here is the structural issue brokers have started naming out loud. Stoïk sits within the Versicherungskammer Group, and Protect results feed VKG policies. Baobab’s Deep Scan funnels to its own Lloyd’s/Liberty capacity. The tools are excellent — and capacity-tied. That produces four concrete problems:

1. Data lives in the carrier’s portal, not the broker’s book. The Leaks Report, the 24-month timeline, the scan history — all of it resides in Baobab’s or Stoïk’s infrastructure. Exporting that history at renewal, or moving it when the client’s risk profile changes, is in practice difficult and rarely contractually guaranteed. The broker’s file ends up thinner than the underwriter’s.

2. The free pre-bind scan primes the client for one capacity before the broker has run a market comparison. Once a client has seen “their” scan under a carrier’s brand, the placement conversation starts from a preferred answer. The “advice” has a preferred outcome built in, and the broker who presents it is, willingly or not, advancing the carrier’s distribution interest.

3. Findings double as underwriting evidence. A “High” Risk Assessment in the Leaks Report is simultaneously guidance for the client and a rating factor for the insurer running the scan. The party scanning the client is also the party pricing the client — a conflict an independent panel removes. There is also a subtler effect: remediation evidence gathered in year one becomes the insurer’s benchmark for terms in year two, which constrains the broker’s negotiating position at renewal.

4. Appetite risk. If the carrier reprices, tightens wording, or exits the segment, the broker loses the tool, the reports, and the remediation history in one stroke. That 24-month leak timeline only compounds in value if the client keeps the policy — a subtle retention mechanism, whether intended or not. Brokers who built advisory programs on top of carrier portals in earlier market cycles have lived through exactly this trade-off before.

The market has noticed. As of late 2026, brokers — and, notably, some insurers — are increasingly declining carrier-tied or capacity-tied tools, treating them the way they learned to treat carrier-tied claims panels: fine as an input, dangerous as a foundation. The comparison is instructive. Claims panels taught the market that a carrier-funded service can be excellent and still structure the relationship in the funder’s favor. Prevention tooling follows the same pattern, with better packaging and a friendlier interface.

What a broker-owned technology panel looks like

The answer is not boycotting Stoïk Protect or Baobab’s Deep Scan; their detection capabilities outperform what most SMBs would buy unaided, and clients placed with those carriers should use what the policy pays for. The answer is ownership of the layer that matters: independent tooling the broker controls across every placement, renewal, and carrier switch. A sensible panel includes four components.

• Carrier-neutral external monitoring, such as an independent domain exposure scan whose findings feed the broker’s file — not a single underwriter’s queue. This is the baseline input that belongs to the brokerage regardless of where the risk is eventually placed.
• A shared risk register to track findings and remediation across the whole client book, so continuity survives any capacity change. Track and manage cyber threats with our risk register; the discipline it enforces — owner, deadline, evidence of closure — is what turns a one-off scan into an ongoing service.
• Quantification and benchmarking that lets the broker defend a coverage recommendation with numbers rather than a carrier’s proprietary score. A structured FAIR-based risk report or a defensible cyber risk calculation gives the placement file an expected-loss rationale the client’s CFO can interrogate — and one that travels between markets.
• An internal maturity benchmark, e.g. a broker scorecard, to measure how far the house cyber advisory practice has actually progressed and where the next investment should land.

For clients in regulated sectors, the panel should also connect to obligations rather than only to insurance: an assessment mapped to NIS2 requirements positions the broker as the coordination point for both coverage and compliance, not merely the intermediary for a policy. With independent inputs in place, carrier tools become what they should be: one signal among several, competing on merit at every renewal.

A practical sequence for building the panel

Moving from carrier portals to an owned panel is an operational project, not a procurement decision. A sequence that works:

1. Audit current dependence. List every client deliverable that currently originates inside a carrier portal — scans, leak reports, training records — and flag which ones would disappear if the capacity moved.
2. Contract for neutral scanning first. Baseline the top accounts with carrier-independent external monitoring so the brokerage holds at least one continuous dataset it controls end to end.
3. Migrate what can be migrated. Where export is possible, pull prior reports into the shared register; where it is not, note the gap and re-baseline, so the historical record starts accruing under the broker’s ownership from that point forward.
4. Re-brand the advisory layer. Client-facing reports should carry the brokerage’s name, methodology, and recommendations — the carrier’s tooling becomes supporting evidence, not the headline.
5. Review annually. Score the panel on data ownership, export rights, pricing transparency, and coverage of the exposures that actually drive claims, and replace components that fail.

Takeaway

Stoïk’s 70% critical-vulnerability remediation rate and Baobab’s 98% risk-detection claim represent real progress for clients, and brokers should make full use of them wherever those carriers are placed. But the same 76% of business leaders who expect cyber guidance from their broker are expecting it from the broker — not from a white-labelled arm of whatever capacity happens to fund the scanner. The brokers winning that expectation in 2026 are the ones building their own panels and keeping the data, the advice, and the client relationship under their own roof.

Sources

• Prevention | Stoïk — https://www.stoik.com/en-us/prevention
• Espace Courtier | Stoïk — https://www.stoik.com/courtiers
• Deep Scan & Dark Web Monitoring | Baobab Risk Solutions — https://www.baobab.io/de-en/risk-solution/deep-scan
• Baobab press release, Berlin, March 03, 2026 — https://www.baobab.io/de-en/press-release/baobab-insurance-expands-deep-scan
• Baobab blog, 17.02.2026 — https://www.baobab.io/de-en/resources/blog/dark-web-monitoring.