Root Evidence Launches Evidence Scan Enterprise Preview

Bringing insurer-grade cyber risk intelligence directly to security teams

BOISE, Idaho--(BUSINESS WIRE)--Root Evidence, the cybersecurity startup championing evidence-based security, today announced the Enterprise Preview of Evidence Scan, the first vulnerability scanning tool designed to show organizations their attack surface the same way cyber insurers see it: through the lens of financial loss.

Root Evidence has been working behind the scenes with leading cyber insurance carriers, helping them scan portfolios to identify the specific, public-facing vulnerabilities that historically have led to multi-million-dollar payouts. Through that work, Root Evidence identified that less than one percent of all CVEs consistently drive material financial loss. Those risks are what Root Evidence refers to as FIREs (Financial Risk Exposures).

Until now, this loss data informed underwriting decisions, premiums, and policy terms. With the Enterprise Preview of Evidence Scan, that same “loss-first” intelligence is now available directly to enterprise security teams.

“For years, vulnerability management has measured effort instead of impact,” said Jeremiah Grossman, CEO of Root Evidence. “Teams are drowning in thousands of ‘critical’ findings that rarely translate into real-world financial loss. Volume isn’t useful information, it’s noise. If fixing 10,000 vulnerabilities doesn’t meaningfully change your probability of a claim, then you’re optimizing for activity, not outcomes.”

While the underlying intelligence comes from insurance use cases, Evidence Scan uses security‑team‑friendly workflows to surface clear, actionable priorities and is designed to evolve utilizing direct enterprise feedback to ensure efficacy and relevance.

Traditional scanners generate thousands of “critical” and “high” alerts, forcing teams to prioritize using scores that rarely correlate to real-world loss events. Evidence Scan flips that model. Instead of overwhelming backlogs, it delivers a focused list of exposures that are:

• Publicly exploitable
• Proven to cause financial loss
• Validated with high-fidelity evidence

“For the first time, organizations can see themselves through the same actuarial lens their insurers use. That changes everything,” said Grossman. “Zero shouldn’t mean zero findings; it should mean zero exposures that are proven to cause financial loss. When you eliminate those, you materially change your risk. That’s the visibility we’re putting directly into the hands of security teams.”

Root Evidence is inviting a limited number of organizations to participate in the Enterprise Preview and gain direct access to insurer-grade risk intelligence.

For more information on the new Enterprise Preview of Evidence Scan, visit our blog. And to request access, visit: https://preview.rootevidence.com.

About Evidence Scan

Evidence Scan is a cyber risk discovery platform built on real insurance loss data. Used by cyber insurers to identify the exposures most likely to lead to financial loss, it helps organizations focus on the vulnerabilities that actually matter, before they turn into costly breach events.

About Root Evidence

Root Evidence is a cybersecurity company advancing evidence-based vulnerability management to help organizations focus on the small percentage of vulnerabilities that are actually exploited in the wild, have caused reported breaches, and led to material financial losses. With Root Evidence, security teams can measurably reduce the financial risk to their organization, prioritize remediation efforts where they have the greatest impact, and genuinely reduce the likelihood of a breach. Founded in July 2025 by industry veterans Jeremiah Grossman, Robert Hansen, Heather Konold, and Lex Arquette, Root Evidence is headquartered in Boise, Idaho and backed by Ballistic Ventures, Grossman Ventures, and a roster of leading cybersecurity experts.