All material subject to strictly enforced copyright laws. © 2021 Inside P&C is part of Euromoney Institutional Investor PLC.
Accessibility | Terms & Conditions | Privacy Policy | Modern Slavery Act | Cookies | Subscription Terms & Conditions

Aon pushing clients to protect networks ahead of cyber underwriting process

Aon cyber background.jpg

With the frequency and severity of cyber loss events expected to continue the dramatic increase seen in the last two years, Aon is working with clients to improve network protections as part of the underwriting process.

In a recent study, Aon found that only 17% of its clients report having adequate application security measures in place, and only 31% have adequate resilience measures deployed.

“There’s this perfect storm of factors, which is projected to cost business $20bn in 2021,” said Nancy Eaves, senior vice president of product management for Aon’s cyber solutions, during a panel discussion on managing ransomware risk.

“Anyone who's seen the headlines knows that it is impacting the most critical aspects of our lives, from health care to energy to meals to transportation to our food supply,” she added, noting that the Biden administration last week named ransomware and cybersecurity a national security threat.

The explosion in ransomware attacks reflects several factors. “The move to remote work has amplified the attack surface, with all the unmanaged devices,” Eaves said. “The drive for on-demand data and connectivity has just accelerated the threat.”

This expanded threat has changed the insurance marketplace and made underwriting a more complex and lengthy process, forcing changes to underwriting guidelines, pricing models and risk identification procedures.

“Cyber insurance is in a really challenged position,” said Alex Moen, Aon’s cyber solutions vice president for errors and omissions/cyber broking. “Insurers are requiring more information from companies in order to properly underwrite and offer terms on a company's risk.”

That means clients must expect a lengthy process – starting months ahead of renewal – to complete applications and supplemental materials that can show carriers what protection they have in place.

“This translates to higher premiums, more onerous retentions and potentially limited coverage, or likely limited coverage,” Moen said. “There's a lot of pain and frustration in the procurement.”

Phishing, or breaking into a network using emails with dirty attachments or suspect links, remains a key tactic for hackers, while remote access issues increased during the pandemic.

Hackers are also on the lookout for devices that are exposed to the internet but not properly secured – from VPN devices to remote desktop systems to a host of consumer gadgets – which are also increasingly problematic, said Jonathan Rajewski, managing director for digital forensic and incident response at Aon’s Stroz Friedberg.

“They don't have the adequate controls necessary to mitigate attacks,” Rajewski said, “and the threat actors can easily find that pivot through that and impact the network.”

He noted that hackers may not act right away but could wait weeks or even months after a breach before deploying ransomware on a company. Some also perform only the initial entry into a network, then sell the access to others.

Aon has developed bundled products that help clients identify and remediate vulnerabilities, along with providing a response to incidents once they take place. Its cyber risk assessment platform scores risk across nine control areas, including access management and email security, applications and network security, and business resilience.

This threat-hunting process often uncovers problems, including clients who spent significant time and money to deploy antivirus and other security programs, but find those systems aren’t properly configured to protect their networks.

“There’s a symbiotic relationship between cybersecurity and insurance,” Moen said. “What we're seeing is that a lot of discussions and actions to improve the company's security posture are happening after a very difficult renewal.”

Starting early and addressing vulnerabilities put a company in the best position, Moen said. “While increasing premiums is a very frustrating cost to bear, it's nothing like the cost of dealing with actual ransomware.”

We use cookies to provide a personalized site experience.
By continuing to use & browse the site you agree to our Privacy Policy.
I agree