The Hidden Cost Explosion
AI is exploding the volume of security findings and fixes. But every one still has to become proof: reviewed, approved, evidenced, and defensible to customers, suppliers, auditors, regulators, and insurers. The security back office was never built to scale manually at this speed.
See why security admin work is compounding.
CVE submission growth
NIST reported CVE submissions increased 263% from 2020 to 2025.vendor assessment work each week
Whistic 2025 TPRM survey: average weekly vendor-assessment work.initial assessments needing follow-up
Whistic 2025 TPRM survey: initial supplier assessments requiring follow-up.reporting clocks
NIS2 and Cyber Resilience Act reporting sequences include 24-hour early warning and 72-hour notification windows.Insurance creates a proof surface, not just a premium line.
Market data shows premiums and claims. The admin burden sits in control evidence, renewal packs, representations, and proof-of-loss readiness.
Insurance pressure is not just premium movement.
The useful signal is divergence: visible premium softened in 2024, while claims and control-evidence scrutiny kept the proof burden active.
US cyber direct written premium in 2024
NAIC aggregate including alien surplus lines.
reported claims in 2024
NAIC described claims as up almost 40% year over year.
policies in force
Reported for U.S.-domiciled insurers.
Insurance market metrics are not direct enterprise labor measurements.
How to read this exhibit
The exhibit separates visible insurance market metrics from the proof work they can create.
- Premium is the visible market price.
- Claims and policies show exposure and activity.
- The hidden work is control evidence, renewal evidence, representations, and proof-of-loss readiness.
Optimization target: economic impact, not just passing proof.
Evident's trust graph should not stop when proof exists. It should ask whether proof was rejected, whether an incident created real cost, whether admin cost missed its target, and where reusable evidence can reduce the next cycle.
Sources behind the public numbers.
Public claims stay attached to the reports, regulator materials, and standards references used for the figures and clocks above.