How Aon’s Cyber Quotient Evaluation (CyQu) platform and our data and analytics can support cyber insurance submissions.

In April of 2021, Aon published its Cyber Risk Report1 highlighting findings from our proprietary Cyber Quotient Evaluation (CyQu,) a comprehensive assessment of cyber risk maturity. The 2020 data revealed a concerning trend: organizations across different regions and industries were only maintaining a basic level of cyber readiness. Specifically, only one in five organizations reported they were prepared to navigate new exposures, and only 17 percent reported having adequate application security measures in place.

It was clear that, because our clients were operating in independent silos, the traditional approach of technology firms, professional services and brokers had not translated into the most appropriate client solutions. With the persistent rise of ransomware attacks, twenty-four months of a hard cyber insurance market and the consistent trend of under-preparedness, it was clear that a new narrative and solution were urgently needed.

Driven by a commitment to provide an integrated and strategic approach to risk management, Aon’s Cyber Solutions underwent our own evolution. CyQu was redesigned to better streamline the complex process of gathering underwriting information year over year. Successfully aligning a market of 65-plus insurers around a single information intake process, the redesign led to greater efficiency and collaboration.

As we enhanced our CyQu platform to support cyber insurance submissions, we were guided by two influential market factors:

• Significant shifts in cyber loss events — both in frequency and severity2. This escalation prompted insurers to evaluate causality and the readiness of core controls. As a result, we reported a paradigm shift in underwriting guidelines, pricing models and the information required to underwrite. As insurers’ appetite for risk shifted, many organizations found themselves ill-prepared3.
• The additional scrutiny and information requirements caused a major inefficiency problem for insureds. The ad hoc approach varied based on market interest, leading to redundant information requests from various insurance companies.

By embedding a risk assessment, benchmarking and our red flag methodology into the placement process, with the support of our brokers and account team, our clients may now gain a clearer understanding of their control gaps, the impact on insurability and their balance sheet risk. The CyQu framework remains dynamic, regularly incorporating feedback from the cyber underwriting community, our proprietary broking insights and claims data. Its primary purpose is not just to prepare clients for risk transfer, but to help clients reduce their overall risk.

Managing cyber risk in today’s dynamic and interconnected environment remains a formidable challenge for our clients, highlighting the need for a more well-informed, strategic and data-driven approach. Aon’s integrated approach to risk transfer continues to evolve, with the CyQu Broking-enabled submission process continually enhanced by our analytics and proprietary insights.

Today, thanks to the lessons learned in the 2021 report, Aon’s CyQu platform and its proprietary data underpin this 2023 report. This year’s data demonstrates an encouraging shift, with clients across regions and industries reporting a “managed” level of cyber readiness. Notably, 70 percent of the organizations report they are prepared to navigate new exposures and 36 percent report having adequate application security measures in place.  Achieving cyber resilience is now a recurring theme in boardroom discussions and is finally being considered from a 360-degree, collaborative risk perspective4.

This report is the result of Cyber Solutions’ Data and Analytics teams’ efforts to unite stakeholders through data-informed decisions and address cyber risk with confidence.  At Aon, we hold ourselves to the same standards as our clients. Achieving this requires breaking down data silos and leveraging the connections among security controls, attack surfaces, insurance pricing and covered claims. Our focus is on providing clients with more comprehensive data and risk modeling to help them understand the impact of enterprise-wide investments and capital throughout the cyber life cycle.

Producing this report involved collecting feedback from our global subject matter professionals, who offer unique perspectives on addressing cyber risk. Leveraging insights from our professionals across various business lines, including Human Capital, Reinsurance, Aon Global Risk Consulting, and our esteemed Stroz Friedberg Incident Response team (with 20 years of experience responding to high profile breaches), our Security Advisory team and our brokerage team (which annually places over $2 billion in Cyber and E&0 premiums), we help ensure that our products and solutions better maximize the talents of each group to help support effective client decision-making. Our Data and Analytics team uses all these insights to better prevent data silos and provide a more comprehensive understanding of cyber risk.

This report is a testament to the power of collaboration and a global approach. By bringing together security professionals, consultants, and brokers, united by a shared goal, we have achieved the CyQu platform’s adoption, increased cyber maturity for our clients, and improved year-over-year insights. The result? An integrated response to cyber risk management.  After all, we are in the business of better decisions.

Nancy Eaves,
SVP, Product Leader, Cyber Solutions