2.1 - Scale of the Problem

Industry survey data consistently shows that approximately 50% of small businesses with 100 or fewer employees report being the target of a cyberattack in any given 12-month period.¹ Unlike large corporations, which possess legal, technical, and financial resources to absorb and recover from breaches, small businesses typically lack all three. Verizon’s 2025 Data Breach Investigations Report finds that 19% of small businesses suffering a breach report the incident contributed to bankruptcy.¹ The average per-incident cost - including direct remediation, legal exposure, lost productivity, customer notification, and reputational damage - is approximately $250,000.

The proximate cause of the majority of these breaches is not technological vulnerability but human behavior. The Verizon 2025 DBIR finds that the human element is implicated in 60% of all breaches^1,2, encompassing phishing, pretexting, social engineering, and the misuse of legitimate credentials. Within the broader human-element category, 22% of breaches were initiated through credential abuse and 16% through phishing attacks.³

2.2 - The Data Broker Threat Vector

A structural feature of the modern cyberattack ecosystem that receives insufficient attention in SMB security discourse is the role of commercial data brokers as attack infrastructure. Broker firms aggregate, package, and sell detailed personal records on hundreds of millions of individuals. A typical broker record contains: full legal name, current and historical addresses, email addresses, phone numbers, employer and work location, marital and family status, purchase history, and online activity patterns.⁴ This is precisely the information required to construct a credible, personalized phishing email or vishing call.

The global data broker market was valued at approximately $257 billion in 2023 and is projected to reach $561 billion by 2029, growing at 7.4% annually.⁵ Conservative modeling suggests broker-held employee data is implicated in approximately 30% of human-element attacks on small businesses - the basis of the Cluzy risk quantification model in Section 4.

2.3 - Why Data Deletion Alone Is Security Theater

The conventional response to broker data exposure has been deletion services: automated opt-out tools that submit removal requests to broker databases on an employee’s behalf. The privacy industry markets these services as meaningful protection. The evidence tells a more complex story.

2.3.1 - Cluzy's Layered Deletion Response

Cluzy operationalizes that strategy in three layers. First, Cluzy walks each employee through a Google Takeout DSAR workflow, supported by an AI agent and/or tutorial video, so the employee can complete a concrete deletion action. Second, Cluzy furnishes an included People Finder website removal service through its primary provider, which continuously handles removals across 300+ data brokers and keeps its coverage current. This included layer reduces the public identity and contact data used to make phishing and vishing attacks credible. Third, Cluzy diagnoses the employee’s remaining exposure and presents one or two additional protection options suited to those data types. The employee decides whether to add them, with an optional AI advisor available to explain the recommendations.

2.4 - The Failure of Traditional Cybersecurity Training

Compliance-driven training fails because it does not engage the employee as a stakeholder with a personal interest in the outcome. Retention of training content delivered in a single session decays rapidly; research on distributed practice shows that spacing and reinforcement improve long-term retention compared with a single massed session.¹⁴ More fundamentally, an employee completing a mandatory module understands that the beneficiary of their compliance is the organization - not themselves. There is no moment of personal recognition that their own data is exposed, that their family’s information is for sale, or that the phishing email they are being trained to resist will be crafted using information bought from a data broker.

3.1 - Conceptual Foundation

‘Data security’ in the conventional IT sense is a defensive, perimeter-oriented posture: firewalls, access controls, endpoint detection, and incident response. It treats the human employee as a liability to be managed. ‘Employee data wellness,’ by contrast, is a proactive, human-centric orientation. It starts from the premise that employees have their own data identities - personal records held by hundreds of brokers, behavioral signals generated by daily digital activity, and privacy habits that either protect or expose them and their employer.

The foundational philosophy of the Cluzy platform:

3.2 - The Data Wellness Score (DWS)

The Data Wellness Score (DWS) converts discrete employee actions - each with a documented relationship to threat surface reduction - into a normalized 0-100 score. The score is gamified and visible to the employee, creating intrinsic motivation and enabling peer benchmarking.

3.3 - The Threat Surface Reduction Index (TSRI)

The TSRI translates individual DWS tier classifications into a quantified estimate of reduced breach probability. The methodology is grounded in three empirical anchors: (1) Verizon's finding that 60% of breaches involve the human element¹; (2) the conservative industry estimate that approximately 30% of human-element attacks on SMBs rely on broker-sourced data; and (3) the plausible reduction in susceptibility associated with each DWS engagement level.

3.3.1 - The Two Leading TSRI Indicators

The TSRI is driven by two measurable leading indicators that give employers concrete, trackable milestones: self-sovereign profiles created and Number of Employees Who Have Taken Deletion Action. Deletion service enrollment remains a supporting operational submetric.

3.4 - The Personal Data Value (PDV) Score

The PDV Score quantifies the estimated economic value of the self-sovereign data profile each Cluzy user has built - the data they have actively contributed, verified, and consent-gated through the platform. PDV reflects what the profile is worth, not a claim about what has been removed from broker databases. (A consent-gated licensing program to vetted brand partners is a roadmap consideration and is not part of the initial Cluzy product release.)

The PDV is composed of three analytically distinct inputs:

3.5 - The Self-sovereign Data Stipend

Employers pay employees up to $250*/year to build and maintain a self-sovereign data profile. The data economy has been extracting value from employees without compensation for decades. Cluzy reverses that.

The Self-sovereign Data Stipend is Cluzy's most significant strategic departure from the deletion-first model that dominates the privacy services market. Rather than asking employees to opt out of the data economy - a largely futile exercise demonstrated in Section 2.3 - Cluzy invites employees to opt in to a better version of it, on their own terms and for their own financial benefit.

3.5.1 - Why $250* Works

The deletion services market has demonstrated that people will not opt out of data brokers for privacy reasons in meaningful numbers - consumer motivation for abstract privacy protection is low. People will, however, take concrete action for a concrete financial reward. The $250* stipend structure solves the adoption problem that has historically limited privacy product engagement to a small, already privacy-motivated minority.

The $250* framing also positions the stipend correctly within enterprise HR budgets. ‘$250* data wellness benefit’ fits alongside fitness reimbursement, mental health apps, and financial planning tools - benefits that HR teams already champion and CFOs already approve. It avoids the procurement friction of a new cybersecurity line item while delivering a cybersecurity outcome.

Critically, the $250* does not have to be delivered as cash. The employer determines how the benefit is administered through their own HR and payroll systems. Delivery formats include Money (direct payroll addition or deposit), Recognition (formal acknowledgment or awards), Time Off (additional PTO or flexible scheduling), or a custom benefit the employer defines. Cluzy does not prescribe or facilitate delivery - the employer is solely responsible for making all benefit options available to employees. This means the stipend can be structured to fit within existing HR systems - as a wellness benefit, a recognition program, or a cash equivalent - without requiring new payroll infrastructure or board approval for a new budget category.

* Cluzy recommended starting amount; the employer may choose to offer more.

3.5.2 - The Competitive Implication

Deletion services sell fear and deliver theater. Cluzy sells financial agency and delivers a measurable, self-sovereign data asset. The employee is not a passive subject of the data economy - they are a compensated participant in a better version of it that they control. This distinction is fundamental to Cluzy's brand, its user engagement model, and its long-term defensibility against deletion-first competitors.

Cluzy also functions economically like an insurance policy: it continuously reduces the human-element attack surface that drives the majority of SMB breaches. Because the DWS and TSRI metrics give employers an auditable, ongoing record of that risk reduction, Cluzy customers have a reasonable basis to raise the point with their cybersecurity insurance carrier and negotiate a lower premium - turning a wellness benefit into a line item with a second, independent source of return.

3.6 - The Three-Layer Deletion Experience

The updated Cluzy deletion experience converts an abstract privacy recommendation into a guided action path with a clear starting point, included People Finder website coverage, and employee-selected optional expansion.

3.6.1 - Additional Protection Marketplace

Beyond Cluzy's included People Finder website removal service, employees can choose additional protection matched to the specific data types found in their broker records.

4.1 - Foundational Framework: Existential Risk Buy-Down

The Expected Loss Reduction Model is grounded in a risk buy-down and annual loss expectancy framework, a standard methodology in enterprise cyber and actuarial risk quantification.^9,10 Rather than modeling breach cost as a per-employee multiplier - which conflates headcount with financial exposure - the model treats headcount-driven human risk as a driver of probability, not of cost magnitude. The relevant question for an SMB owner is not ‘what does an average breach cost,’ but ‘what is the probability that a breach becomes an existential, business-ending event, and how much can that probability be reduced.’

The model combines two probabilities: the Annual Rate of Occurrence (ARO, the likelihood of experiencing a cyberattack in a given year) and the Existential Risk Rate (ERR, the likelihood that a breach, once it occurs, contributes to business bankruptcy). The product of these two terms is the Baseline Existential Risk - the unconditional annual probability that an unprotected SMB suffers a bankruptcy-triggering event. The Threat Surface Reduction Index (TSRI, Section 3.3) then reduces that probability in proportion to employee engagement, and the resulting reduction in probability is priced against the enterprise’s value at stake.

By adopting this framework, Cluzy positions its value proposition in the same analytical language that CFOs, risk managers, and underwriters already use - enabling direct comparison between the cost of the program and the enterprise value it protects.

4.2 - Baseline Existential Risk for a 100-Person SMB

4.3 - Applying TSRI to Derive Protected Enterprise Value

4.4 - TSRI Impact of the Two Leading Indicators

The two leading indicators - self-sovereign profiles created and deletion service enrollments - drive TSRI directly. Under the updated operating model, the employer dashboard reports the deletion-side indicator as Number of Employees Who Have Taken Deletion Action, while provider enrollment remains a supporting measure. The table below models the incremental TSRI impact of each indicator at scale for a 100-person company:

4.5 - Dashboard: Real-Time Value Visibility

The real-time employer dashboard surfaces six core metrics continuously. These are not vanity metrics - each directly feeds the Value Protected calculation and can be reported to insurance underwriters, board members, and investors as evidence of active risk management. The updated dashboard adds the deletion-action milestone as the primary deletion-side indicator and retains provider enrollment as a supporting measure:

5.1 - Pricing and Structure

The Cluzy pilot is structured to minimize procurement friction for SMB decision-makers while delivering sufficient engagement data to validate the Expected Loss Reduction model. The pilot runs for three months at $40 per employee - a per-seat cost low enough to be approved at the operational budget level without board involvement in most small businesses. For a 100-person company, the total pilot investment is $4,000. Ongoing subscription pricing converts to $13.33 per employee per month, or $160 per employee per year.

The Self-sovereign Data Stipend ($250*/year) is funded separately by the employer as a benefit line item - not included in the platform subscription cost. Stipend funding is seeded by the employer and supplemented by licensed data revenue share as employees build active self-sovereign profiles.

5.2 - Target Customer Profile

Cluzy is initially targeted at organizations with fewer than 500 employees that do not employ a dedicated CISO or CDO. The typical decision-maker is the Owner/CEO or COO - not an IT department head. The Expected Loss Reduction model is designed to speak directly to this audience: it converts a technical cybersecurity problem into a financial risk management question that any business owner can evaluate using familiar cost-benefit logic.

5.3 - Go-to-Market via Partners

Cluzy's partner strategy is built around organizations that already advise SMB owners. The initial channels are managed service providers (MSPs) and benefits brokers. MSPs bring operational cybersecurity credibility and established client access; benefits brokers bring trusted relationships around workforce programs, insurance, and total rewards.

5.3.1 - Managed Service Providers

Many SMBs outsource cybersecurity because they lack the staff, expertise, or budget to manage it internally.¹⁵ Cluzy adds a measurable human-layer service to the MSP stack, complementing endpoint, identity, email, monitoring, and awareness controls by reducing the personal data that makes phishing and vishing credible.

5.3.2 - Benefits Brokers

Benefits brokers - particularly those affiliated with the country's largest insurance companies - already hold trusted relationships with SMB owners in major metropolitan markets. These firms are positioned to introduce Cluzy as an employee data wellness layer that complements existing HR-sponsored benefits and total rewards programs.

Broker partners receive a differentiated offering that strengthens client relationships, a concrete risk-reduction narrative that supports their value proposition, and a benefit employees immediately understand alongside the health and retirement programs those brokers already administer. This channel also connects employee participation, organizational risk reduction, and the broader insurance conversation without implying that Cluzy alone will change premiums or coverage.

5.4 - Investor-as-Lead Insight

Startup companies are among the most vulnerable organizations to social engineering and targeted phishing - founders, executives, and early employees are high-value targets whose personal data is extensively indexed in broker databases. Cluzy's investor-as-lead channel leverages this reality: impact investors who fund Cluzy portfolio companies can introduce Cluzy as a standard operating practice across their portfolio, creating an institutional distribution channel that operates independently of the channel partner network.

5.5 - Pilot Success Metrics

Pilot engagements are evaluated against the following KPIs, reported to the employer at the close of the 90-day pilot period: