American International Group Inc. wanted to make sure it had a solid understanding of cyber risk and its potential effect on business.

“We wanted to get more consistency across the globe in how we underwrite all our policies,” said Tracie Grella, AIG’s head of cyber risk insurance.

To address the issue, AIG launched its Cyber Underwriting Model in late 2017, in which the insurer combines data and knowledge garnered over its 20 years writing cyber insurance with data security to develop a model that quantifies and scores policyholders’ cyber risk.

Policyholders receive a monthly “boardroom-ready” report, which details the probability of different types of loss, areas of strength and weakness and recommendations for the best risk-reducing controls that can be implemented, Ms. Grella said.

They are also provided with benchmarking data — a critical factor because boards “want to know where they fall relative to their peers,” she said.

“The report is somewhat interactive because clients can run it every month with updated threat intelligence based on the current threat environment,” Ms. Grella said.

They can also use the information it provides to analyze whether the amount needed to reduce the risk is worth the cost of implementing certain controls, she said.

“Everyone in the cyber community is trying to quantify risk, and this is one of the first steps in helping them to do that, showing how implementing controls can impact the decision-making,” Ms. Grella said.

“We also needed a model because we need all underwriters at AIG to understand how cyber risk impacts policies,” Ms. Grella said. “As we move toward affirmative coverage, we needed to make sure we have a platform that all underwriters can access, including those in other lines of business such as property and marine.”

“Clients are thrilled with the data that we’re able to provide back to them,” Ms. Grella said. “People have said to us, ‘This is great. It’s exactly how we see our risk, which is helpful when we go to management,’” because it is no longer a matter of just them saying this. “They have a leading insurance carrier also saying” where they need to invest, said Ms. Grella.

FINALISTS

• Axis Capital Holdings Ltd. — By applying Modern Portfolio Theory to the underwriting process and engaging in disciplined decision making, the Axis Financial Institution team built a diversified insurance portfolio comprised of a variety of products and risks across a geographic spread.

• Beazley PLC — Beazley’s new BBR Services, launched in November 2017, covers the universe of cyber risks confronting small and midsize business, including business interruption, in a streamlined 22-page policy.

• Executive Perils Insurance Services — ExecutivePerils Inc. has an insurance product with Arch Insurance, RE360, that enables today’s diversified real estate companies to choose from an extensive menu of coverages.

• Zurich Insurance Group Ltd. — In 2018, the Zurich North American Cyber Underwriting Team introduced an extensive and easy-to-understand cyber insurance policy written to include all of the core cyber coverages as well as market-standard enhancements.

2019 Business Insurance US Insurance Awards home